Repository navigation
Allow fixed proxy IPs per destination and disabling the automatic network for Compose service stacks #12188
nuxwin
started this conversation in
Feature Requests
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Problem
I’m using Coolify 4.4.6 with its integrated Traefik proxy to deploy a Docker Compose service stack with explicitly defined networks and static container IPs.
I would like to control two aspects through Coolify:
1. Configure Traefik’s IP when creating a destination
When creating or editing a destination, please provide an optional static proxy IP address setting.
For example:
Coolify would manage the corresponding proxy network attachment:
Currently, I configure this manually in the proxy’s Compose configuration. A destination setting would make this configuration explicit and maintainable through Coolify.
The address should be validated against the network’s subnet and existing allocations.
2. Select destination networks without adding the automatic stack network
Please allow a Compose service stack to use selected destination networks and its explicitly declared private networks without automatically attaching every service to the UUID-named stack network.
For example, my Compose definition explicitly connects the frontend to:
Coolify additionally generates an attachment such as:
I would like an option to disable that last attachment and preserve the network memberships declared in Compose.
The UUID-named stack network is distinct from the shared Docker network named coolify. The request concerns disabling the automatically added stack network, not merely disabling attachment to the predefined destination network.
Why this matters
The stack separates public ingress, identity management and application traffic.
Adding a common network to every component introduces connectivity outside those intended boundaries. It can also create multiple shared network paths between services.
This matters when downstream services trust forwarded headers only from a proxy’s exact IP address. If a connection uses the additional network, its source address can differ from the configured trusted address.
We currently avoid that ambiguity by configuring private upstream destinations with static IPs instead of Docker service names.
Expected behavior
Environment
Thanks.
All reactions