Skip to content

Reverse Proxy

Jump to bottom
sassanix edited this page Oct 30, 2026 · 4 revisions

server icon Reverse Proxy

A reverse proxy puts Warracker behind a proper domain with HTTPS — for example, https://warracker.example.com — instead of http://your-server:8005. This is the recommended setup for anything reachable beyond your home network.

One constraint first: Warracker must be served at the root of a domain. Subpaths like example.com/warracker are not supported.

Contents

Before you start

Set the public URL in your .env (see Configuration):

FRONTEND_URL=https://warracker.example.com
APP_BASE_URL=https://warracker.example.com

Both must match the real public address, or OIDC redirects and links in emails break. Then recreate the container (docker compose up -d).

Warracker's own container already runs nginx on port 80 (mapped to host port 8005 by default), so your reverse proxy forwards to 127.0.0.1:8005 on the same machine.

Nginx

server {
    listen 80;
    server_name warracker.example.com;

    # Must match or exceed MAX_UPLOAD_MB
    client_max_body_size 32M;

    location / {
        proxy_pass http://127.0.0.1:8005;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

For HTTPS, get a certificate with Certbot (certbot --nginx -d warracker.example.com) and let it add the TLS lines, or terminate TLS on the proxy another way — the proxy-to-Warracker hop can stay plain HTTP on your own machine.

Caddy

Caddy is the shortest path: it handles HTTPS automatically.

warracker.example.com {
    reverse_proxy localhost:8005
}

If you raise the upload limit above the default, add a matching request body limit (Caddy's default is generous, but check it if large uploads fail).

Traefik

Attach these labels to the Warracker service (adjust the network and entrypoint names to your own Traefik setup):

labels:
  - "traefik.enable=true"
  - "traefik.http.routers.warracker.rule=Host(`warracker.example.com`)"
  - "traefik.http.routers.warracker.entrypoints=websecure"
  - "traefik.http.routers.warracker.tls.certresolver=letsencrypt"
  - "traefik.http.services.warracker.loadbalancer.server.port=80"

Note the service port is 80 — the port inside the Warracker container — not the host-mapped 8005.

Cloudflare

Two ways to use Cloudflare, depending on whether you want to open any ports at all.

Cloudflare Tunnel (no open ports)

Cloudflare Tunnel exposes Warracker without port forwarding: a small cloudflared connector on your network makes an outbound connection to Cloudflare, and Cloudflare serves it on your domain.

  1. In the Cloudflare Zero Trust dashboard, create a tunnel and a public hostname, for example warracker.example.com, pointing at http://localhost:8005 (the host-mapped port — if cloudflared runs in a container on the same Docker network as Warracker, point it at http://warracker:80 instead).

  2. Run the connector with the token from the dashboard:

    cloudflare tunnel run --token <your-tunnel-token>

  3. Set FRONTEND_URL and APP_BASE_URL to the public https:// URL and recreate the container (see Configuration).

TLS is handled by Cloudflare, so no certificate setup is needed, and nothing needs to listen on the public internet. Cloudflare's free plan caps uploads at 100 MB per request — above Warracker's default 32 MB limit, so uploads are unaffected.

Cloudflare in front of your own proxy

If you already run nginx, Caddy, or Traefik and just want Cloudflare in front (an orange-cloud DNS record), keep your existing proxy config and set Cloudflare SSL/TLS to Full (Strict) so the connection is encrypted end to end. Keep the X-Forwarded-Proto header so Warracker sees https — without it, OIDC redirects and secure cookies can break (see Troubleshooting below).

Proxying directly to Gunicorn (advanced)

If your own proxy already handles static files and TLS and you do not want the container's nginx in the middle, set DISABLE_NGINX=true in .env, publish port 5000 instead of 8005, and point your proxy at port 5000. For most setups, proxying to the container's nginx on 8005 is simpler and recommended.

Troubleshooting proxy problems

  • Redirects loop or OIDC fails: FRONTEND_URL / APP_BASE_URL do not match the public URL, or the X-Forwarded-Proto header is missing so the app thinks it is on HTTP. See Troubleshooting.
  • Large uploads fail with 413: the proxy's body limit is smaller than the file. Raise client_max_body_size (nginx) and check MAX_UPLOAD_MB / NGINX_MAX_BODY_SIZE_VALUE in .env (see Configuration).
  • The app works locally but not through the proxy: check the proxy logs first, then docker compose logs warracker — the app log shows whether requests are arriving at all.
  • Cloudflare Tunnel returns a 502/1033 error: the connector is not running, or the ingress address is wrong. Check that cloudflared is running and that the hostname points at the right port — 8005 on the Docker host, or 80 inside the container network.

Clone this wiki locally