Reverse proxy and HTTPS

Reverse proxy and HTTPS

Use a reverse proxy when you want:

• HTTPS certificates
• Nice URL (without :18000)
• Better security headers and routing

By default, Expensave app runs on:

• http://localhost:18000

---

Option 1 — Caddy (recommended)

Caddy is the easiest production setup for most users.

Why recommended:

• Automatic HTTPS (Let's Encrypt)
• Automatic TLS certificate renewals
• Very small config
• No manual certbot or renewal cron needed

Caddyfile:

your-domain.com {
    reverse_proxy 127.0.0.1:18000
}

Reload Caddy:

sudo systemctl reload caddy

After DNS points to your server, Caddy will request and renew certificates automatically.

---

Option 2 — Nginx

Basic site config

Create file:

server {
    listen 80;
    server_name your-domain.com;

    location / {
        proxy_pass http://127.0.0.1:18000;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Enable site and reload Nginx:

sudo ln -s /etc/nginx/sites-available/expensave /etc/nginx/sites-enabled/expensave
sudo nginx -t
sudo systemctl reload nginx

Add HTTPS (Let's Encrypt)

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.com

---

Option 3 — Traefik (Docker labels)

Good if your stack is fully Docker-based and you prefer label-driven routing.

Minimal dynamic labels on Expensave app service:

services:
  application:
    image: ghcr.io/algirdasc/expensave:latest
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.expensave.rule=Host(`your-domain.com`)"
      - "traefik.http.routers.expensave.entrypoints=websecure"
      - "traefik.http.routers.expensave.tls.certresolver=letsencrypt"
      - "traefik.http.services.expensave.loadbalancer.server.port=80"

Typical Traefik static config requirements:

• entrypoints web (:80) and websecure (:443)
• ACME resolver named letsencrypt
• persistent ACME storage (for cert cache)

---

Firewall

If using UFW:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

---

Verify

• Open https://your-domain.com
• Login screen should load
• Browser should show valid TLS certificate