Own Reverse Proxy

Use this instead of the built-in HTTPS proxy when the server already runs nginx, Apache, Caddy or Traefik.

Keep COMPOSE_PROFILES empty and PUBLISH_ADDR=127.0.0.1 in .env; the shop listens on 127.0.0.1:8080, the admin on 127.0.0.1:4000. SHOP_PUBLIC_URL / ADMIN_PUBLIC_URL must be the exact public URLs.

nginx

/etc/nginx/sites-available/shop, then ln -s to sites-enabled and sudo certbot --nginx -d shop.example.com -d admin.example.com:

server {
    server_name shop.example.com;
    client_max_body_size 50M;
    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

server {
    server_name admin.example.com;
    client_max_body_size 50M;
    location / {
        proxy_pass http://127.0.0.1:4000;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Caddy

/etc/caddy/Caddyfile:

shop.example.com {
    reverse_proxy 127.0.0.1:8080
}
admin.example.com {
    reverse_proxy 127.0.0.1:4000
}

Tip: restrict the admin domain further (VPN, IP allow-list or HTTP basic auth) if only a few people need it.