Skip to main content

Behind a reverse proxy

If you already run nginx, Traefik, or your own Caddy to terminate TLS for the services on your box, front Cobblr with it instead of running the bundled proxy. You do two things: turn off the bundled Caddy, and point your proxy at the web container.

Turn off the bundled Caddy​

The bundled proxy is a compose profile. Leave COMPOSE_PROFILES empty and it never starts:

COMPOSE_PROFILES=

In the setup builder, the HTTP (no TLS) option generates exactly this: no Caddy in the stack, and the web container published on a host port. That is the config to start from when your own proxy handles HTTPS.

Point the proxy at the web container​

The web container listens on port 8080 inside the compose network and is published on the host as WEB_PORT (8088 by default). Two variables control where it is reachable:

WEB_BIND=127.0.0.1
WEB_PORT=8088
  • Proxy on the same host. Leave WEB_BIND=127.0.0.1 and proxy to 127.0.0.1:8088. Nothing is exposed on the LAN; only your proxy can reach it.
  • Proxy on another host or in its own container. Set WEB_BIND to an address that proxy can reach, or attach your proxy to the compose network and target the web service directly. Widen the bind deliberately, since it decides what can reach the app without going through your proxy.

Then add a normal proxy_pass (nginx), service (Traefik), or reverse_proxy (Caddy) block pointing at that address, and forward the standard proxy headers so the app sees the original host and client. Terminate TLS at your proxy as you do for your other services.

The camera still needs HTTPS​

The phone camera works in a secure context, which means the address in the browser's bar is https://. Since your proxy terminates TLS, that is satisfied as long as your members reach the instance through the proxy over HTTPS rather than hitting the host port directly. The reasoning behind the rule is in Install.

  • The full list of built-in TLS modes, if you would rather Cobblr handle HTTPS itself, is in Install.
  • To also reuse an existing database, combine this with external database.