HTTPS and Reverse Proxy

If Whittle is reachable from outside your home or office network, put it behind a reverse proxy that provides HTTPS. Then set:

WHITTLE_PUBLIC_URL=https://cad.example.com
WHITTLE_BIND=127.0.0.1:8080        # if the proxy runs on the same machine

and restart Whittle. With an https:// public URL, sign-in cookies are marked Secure.

Whittle needs nothing special from the proxy: no WebSockets, no path rewriting. Just raise the upload size limit to at least WHITTLE_MAX_UPLOAD_MB (64 MB by default) so large designs can be saved.

Caddy (automatic HTTPS)

cad.example.com {
    reverse_proxy 127.0.0.1:8080
}

Caddy gets and renews the certificate by itself. It has no upload limit by default.

nginx

server {
    listen 443 ssl http2;
    server_name cad.example.com;
    ssl_certificate     /etc/letsencrypt/live/cad.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/cad.example.com/privkey.pem;

    client_max_body_size 64m;          # match WHITTLE_MAX_UPLOAD_MB

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Get a certificate with sudo certbot --nginx -d cad.example.com.

Traefik (Docker labels)

services:
  whittle:
    image: ghcr.io/anand34577/whittle:latest
    volumes: [whittle-data:/data]
    environment:
      WHITTLE_PUBLIC_URL: https://cad.example.com
    labels:
      - traefik.enable=true
      - traefik.http.routers.whittle.rule=Host(`cad.example.com`)
      - traefik.http.routers.whittle.entrypoints=websecure
      - traefik.http.routers.whittle.tls.certresolver=letsencrypt
      - traefik.http.services.whittle.loadbalancer.server.port=8080
volumes:
  whittle-data:

Nginx Proxy Manager

Add a Proxy Host: domain cad.example.com, scheme http, forward to the Whittle machine's IP and port 8080. On the SSL tab request a Let's Encrypt certificate and enable Force SSL. Under Advanced, add client_max_body_size 64m;.

Cloudflare Tunnel, Tailscale

• Cloudflare Tunnel: point a public hostname at http://localhost:8080. Set WHITTLE_PUBLIC_URL to the public https:// address.
• Tailscale: tailscale serve --bg 8080 gives you https://<machine>.<tailnet>.ts.net; use that as WHITTLE_PUBLIC_URL. Only people on your tailnet can reach it, so this pairs well with WHITTLE_AUTH=none for a private setup.

A proxy that already handles sign-in

If your proxy authenticates people (Authelia/Authentik forward-auth, Cloudflare Access, oauth2-proxy), you can set WHITTLE_AUTH=none. Everyone who gets through then shares one Whittle workspace. For separate libraries per person, use Single Sign-On instead.

Use a subdomain

Whittle expects to be served from the root of its address (https://cad.example.com/), so give it its own subdomain rather than a sub-path such as /whittle/.