Skip to main content
Version: 2026.8.1

Behind a reverse proxy

If you already run nginx, Traefik, or your own Caddy to terminate TLS for the services on your box, front Cobblr with it instead of running the bundled proxy. You do two things: turn off the bundled Caddy, and point your proxy at the web container.

Turn off the bundled Caddy​

Leave COMPOSE_PROFILES empty and the bundled proxy never starts, since it is a compose profile:

COMPOSE_PROFILES=

In the setup builder, the HTTP (no TLS) option generates exactly this: no Caddy in the stack, and the web container published on a host port. That is the config to start from when your own proxy handles HTTPS.

Point the proxy at the web container​

Two variables control where the web container is reachable:

WEB_BIND=127.0.0.1
WEB_PORT=8088
  • Proxy on the same host. Leave WEB_BIND=127.0.0.1 and proxy to 127.0.0.1:8088. Nothing is exposed on the LAN, and only your proxy can reach it.
  • Proxy on another host or in its own container. Set WEB_BIND to an address that proxy can reach, or attach your proxy to the compose network and target the web service directly. Widen the bind deliberately, since it decides what can reach the app without going through your proxy.
  • Then add a normal proxy_pass (nginx), service (Traefik), or reverse_proxy (Caddy) block pointing at that address, and forward the standard proxy headers so the app sees the original host and client. Terminate TLS at your proxy as you do for your other services.
Ports, inside and out

The web container listens on port 8080 inside the compose network and is published on the host as WEB_PORT (8088 by default).

The camera still needs HTTPS​

Make sure your members reach the instance through the proxy over HTTPS rather than hitting the host port directly. The phone camera works in a secure context, which means the address in the browser's bar is https://, and since your proxy terminates TLS, that is satisfied as long as traffic comes through it. The reasoning behind the rule is in Install.

  • The full list of built-in TLS modes, if you would rather Cobblr handle HTTPS itself, is in Install.
  • To also reuse an existing database, combine this with external database.