How do I get inventree to use a non-standard TCP?

[tmacsevern]

I cannot seem to win. My setup

• TrueNAS Scale 25.10.5
• Installed Dockge

Trying to setup as follows:

Compose file:

services:
  # Database service
  # Use PostgreSQL as the database backend
  inventree-db:
    image: postgres:17
    container_name: inventree-db
    expose:
      - ${INVENTREE_DB_PORT:-5432}/tcp
    environment:
      - PGDATA=/var/lib/postgresql/data/pgdb
      - POSTGRES_USER=${INVENTREE_DB_USER}
      - POSTGRES_PASSWORD=${INVENTREE_DB_PASSWORD}
      - POSTGRES_DB=${INVENTREE_DB_NAME}
    volumes:
      # Map 'data' volume such that postgres database is stored externally
      - ${INVENTREE_EXT_VOLUME}:/var/lib/postgresql/data/:z
    restart: unless-stopped
  # redis acts as database cache manager
  inventree-cache:
    image: redis:7-alpine
    container_name: inventree-cache
    env_file:
      - .env
    expose:
      - ${INVENTREE_CACHE_PORT:-6379}
    volumes:
      - ${INVENTREE_EXT_VOLUME}/redis:/data
    restart: always
  # InvenTree web server service
  # Uses gunicorn as the web server
  inventree-server:
    # If you wish to specify a particular InvenTree version, do so here
    image: inventree/inventree:${INVENTREE_TAG:-stable}
    container_name: inventree-server
    # Only change this port if you understand the stack.
    expose:
      - ${INVENTREE_WEB_PORT:-8000}
    depends_on:
      - inventree-db
      - inventree-cache
    env_file:
      - .env
    environment:
      INVENTREE_SERVER: http://inventree-server:${INVENTREE_WEB_PORT}
    volumes:
      # Data volume must map to /home/inventree/data
      - ${INVENTREE_EXT_VOLUME}:/home/inventree/data:z
    restart: unless-stopped
  # Background worker process handles long-running or periodic tasks
  inventree-worker:
    # If you wish to specify a particular InvenTree version, do so here
    image: inventree/inventree:${INVENTREE_TAG:-stable}
    container_name: inventree-worker
    command: invoke worker
    depends_on:
      - inventree-server
    env_file:
      - .env
    volumes:
      # Data volume must map to /home/inventree/data
      - ${INVENTREE_EXT_VOLUME}:/home/inventree/data:z
    restart: unless-stopped
  # caddy acts as reverse proxy and static file server
  # You can adjust the ports that the proxy listens on via the .env file
  # https://hub.docker.com/_/caddy
  inventree-proxy:
    container_name: inventree-proxy
    image: caddy:alpine
    restart: always
    depends_on:
      - inventree-server
    ports:
      - ${INVENTREE_HTTP_PORT:-80}:80
      - ${INVENTREE_HTTPS_PORT:-443}:443
    env_file:
      - .env
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro,z
      - ${INVENTREE_EXT_VOLUME}/static:/var/www/static:z
      - ${INVENTREE_EXT_VOLUME}/media:/var/www/media:z
      - ${INVENTREE_EXT_VOLUME}:/var/log:z
      - ${INVENTREE_EXT_VOLUME}:/data:z
      - ${INVENTREE_EXT_VOLUME}:/config:z
networks: {}

and the ENV file:

COMPOSE_PROJECT_NAME=inventree
INVENTREE_TAG=latest
INVENTREE_SITE_URL="https://XXX-XXX.duckdns.org"
INVENTREE_WEB_PORT=8000

INVENTREE_USE_X_FORWARDED_HOST=True
INVENTREE_USE_X_FORWARDED_PORT=True
INVENTREE_USE_X_FORWARDED_PROTO=True
INVENTREE_SITE_LAX_PROTOCOL=True
INVENTREE_EXT_VOLUME=/mnt/NVMe_Pool/Apps/inventree

# Ensure debug is false for a production setup
INVENTREE_LOG_LEVEL=WARNING

# Enable custom plugins?
INVENTREE_PLUGINS_ENABLED=True

# Run database migrations automatically?
# Note: This does not negate the need to run "invoke update"
INVENTREE_AUTO_UPDATE=True

# InvenTree superuser account details
# Un-comment (and complete) these lines to auto-create an admin account
INVENTREE_ADMIN_USER=admin
INVENTREE_ADMIN_PASSWORD=XXXXXXX
INVENTREE_ADMIN_EMAIL=admin@example.com

# Database configuration options
# DO NOT CHANGE THESE SETTINGS (unless you really know what you are doing)
INVENTREE_DB_ENGINE=postgresql
INVENTREE_DB_NAME=inventree
INVENTREE_DB_HOST=inventree-db
INVENTREE_DB_PORT=5432

# Database credentials - These should be changed from the default values!
# Note: These are *NOT* the InvenTree server login credentials,
#       they are the credentials for the PostgreSQL database
INVENTREE_DB_USER=pguser
INVENTREE_DB_PASSWORD=XXXXXX

# Redis cache setup
# Refer to the documentation for other cache options
INVENTREE_CACHE_ENABLED=True
INVENTREE_CACHE_HOST=inventree-cache
INVENTREE_CACHE_PORT=6379

# Options for gunicorn server
INVENTREE_GUNICORN_TIMEOUT=90

This will startup and will only be accessible on port 443 -> https://XXX-XXX.duckdns.org:443

I really want to get this to run on, lets say, port 5143.
I have tried modifying many differnent VARs and nothing seems to work.
I am wondering if I am missing something obvious.

I just do not want any of this application (including the proxy) to run on ports 80 and 443.
Is it possible to run this using docker on just an IP and a port? http://192.168.100.10:5143

I am sort of new to docker. It is likely I am missing something

thanks

[tmacsevern]

I am converting my HomeNAS from Synology to TrueNAS.
I had this running on Synology with guidance from Marius Hosting

I do have a NGINX running also. It uses 80 and 443. I have stopped that to run/start inventree.

[lMysticl]

INVENTREE_WEB_PORT is the internal Gunicorn port, so leave it at 8000. The public port is controlled by Caddy and the Docker port mapping.

For a single HTTP endpoint on port 5143, use:

INVENTREE_SITE_URL="http://192.168.100.10:5143"
INVENTREE_HTTP_PORT=5143
INVENTREE_WEB_PORT=8000

Then change the proxy mapping to:

ports:
  - "${INVENTREE_HTTP_PORT}:${INVENTREE_HTTP_PORT}"

Remove the HTTPS mapping if you do not want the container to publish port 443.

Your current https://... site URL makes Caddy serve HTTPS. With the explicit http://...:5143 address, Caddy listens on port 5143 inside the container, so the mapping must be 5143:5143.

After changing it, verify the resolved configuration with:

docker compose config
docker compose up -d --force-recreate inventree-server inventree-proxy

[tmacsevern]

Oh man. This sounds super helpful. I’ll certainly be testing when I get a chance

I’m still learning here and it’s be difficult to find the right “details”

Thanks. If it works I’ll come back and mark solved

[tmacsevern]

I think my issue with trying to use HTTPS://xxx:5134 is that CADDY expects to use well known ports (443) for the Let's Crypt cert and is failing

[lMysticl]

I think my issue with trying to use HTTPS://xxx:5134 is that CADDY expects to use well known ports (443) for the Let's Crypt cert and is failing

Yeah, I think that’s exactly what’s happening.

Caddy can serve HTTPS on a custom port, but Let’s Encrypt still normally needs access through public port 80 or 443 to validate the domain. Since your NGINX is already using those ports, the easiest setup is to let NGINX handle HTTPS and the certificate, then proxy requests to InvenTree over HTTP on port 5143.

So basically:
https://your-domain → NGINX → http://<TrueNAS-IP>:5143
That also avoids NGINX and Caddy competing for ports 80 and 443.

[tmacsevern]

Ok. So I was able to do as you suggested

1. INVENTREE is running on HTTP:5143
2. NGINX is back on and properly redirecting Http://myurl.xxx.com -> http://192.168.100.10:5143 (so I can just go to Http://myurl.xxx.com for access)

I have been trying to now get it in https:5143, but not successful
I have added back these to the env

INVENTREE_SITE_URL="https://192.168.100.10:5143"
INVENTREE_HTTP_PORT=4433
INVENTREE_HTTPS_PORT=5143

and uncommented from the caddy stack
- "${INVENTREE_HTTPS_PORT}:${INVENTREE_HTTPS_PORT}"

Any idea if there is anything special I need to do in NGINX to allow this to work https?

[lMysticl]

You’re basically there. I wouldn’t try to enable HTTPS inside the InvenTree/Caddy container again.

Keep InvenTree running on HTTP port 5143, and let NGINX handle the SSL certificate and HTTPS.

In NGINX, proxy:

https://myurl.xxx.com → http://192.168.100.10:5143

So the upstream should still use http, not https.

I’d remove the new HTTPS variables and the extra Caddy HTTPS port mapping. The public HTTPS port and the internal InvenTree port don’t need to match.

[tmacsevern]

Nice. Just missing that little bit. Got it.
External access is https://myurl.xxx.com and nginix translates to http://192.168.100.10:5143. Working with a cert now.
Thank you agian

[tmacsevern]

I did have to add
INVENTREE_TRUSTED_ORIGINS="https://myurl.xxx.com"
to the env list

[SchrodingersGat]

I have made some improvements to the docs around this - #12588

[tmacsevern]

I think the biggest issue is not placing

INVENTREE_HTTP_PORT=80
INVENTREE_HTTPS_PORT=443

in the .env file. I was just missing it