Reverse Proxy

Reverse Proxy

Sample configurations for running Stillwater behind a reverse proxy. These are based on LSIO SWAG but apply to any Nginx setup.

Subdomain (Recommended)

Serve Stillwater at https://stillwater.example.com/.

No SW_BASE_PATH is needed for subdomain setups.

## Version 2026/02/20
# Make sure that your stillwater container is named stillwater
# Make sure that your DNS has a CNAME set for stillwater

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name stillwater.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 25m;

    # enable for ldap auth (requires ldap-location.conf in the location block)
    #include /config/nginx/ldap-server.conf;

    # enable for Authelia (requires authelia-location.conf in the location block)
    #include /config/nginx/authelia-server.conf;

    # enable for Authentik (requires authentik-location.conf in the location block)
    #include /config/nginx/authentik-server.conf;

    location / {
        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        # enable for ldap auth (requires ldap-server.conf in the server block)
        #include /config/nginx/ldap-location.conf;

        # enable for Authelia (requires authelia-server.conf in the server block)
        #include /config/nginx/authelia-location.conf;

        # enable for Authentik (requires authentik-server.conf in the server block)
        #include /config/nginx/authentik-location.conf;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app stillwater;
        set $upstream_port 1973;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

        # longer timeout for scanner and bulk operations
        proxy_read_timeout 600s;
    }
}

Subfolder

Serve Stillwater at https://example.com/stillwater/.

Set SW_BASE_PATH=/stillwater on the Stillwater container:

environment:
  - SW_BASE_PATH=/stillwater

## Version 2026/02/20
# Make sure that your stillwater container is named stillwater
# Make sure that the SW_BASE_PATH environment variable is set to /stillwater on the stillwater container

location /stillwater {
    return 301 $scheme://$host/stillwater/;
}

location ^~ /stillwater/ {
    # enable the next two lines for http auth
    #auth_basic "Restricted";
    #auth_basic_user_file /config/nginx/.htpasswd;

    # enable for ldap auth (requires ldap-server.conf in the server block)
    #include /config/nginx/ldap-location.conf;

    # enable for Authelia (requires authelia-server.conf in the server block)
    #include /config/nginx/authelia-location.conf;

    # enable for Authentik (requires authentik-server.conf in the server block)
    #include /config/nginx/authentik-location.conf;

    include /config/nginx/proxy.conf;
    include /config/nginx/resolver.conf;
    set $upstream_app stillwater;
    set $upstream_port 1973;
    set $upstream_proto http;
    proxy_pass $upstream_proto://$upstream_app:$upstream_port;

    client_max_body_size 25m;

    # longer timeout for scanner and bulk operations
    proxy_read_timeout 600s;
}

Notes

• client_max_body_size 25m is needed for image uploads
• proxy_read_timeout 600s prevents timeouts during library scans and bulk metadata fetches
• The sample configs include commented-out blocks for LDAP, Authelia, Authentik, and Tinyauth authentication