An app behind a reverse proxy

Many apps have their own small web server on a port, such as 3001 or 5678. You don't open that port to the internet. Instead, your web server receives the traffic on 443 with https and passes it on to the app: a reverse proxy.

With Caddy

If the app listens on port 3001 on the server itself:

status.example.com {
	reverse_proxy 127.0.0.1:3001
}

Caddy passes on the right headers (such as X-Forwarded-For and X-Forwarded-Proto) and websockets automatically. If the app runs in Docker alongside Caddy, use the name of the container, as in Your working folder with compose.yaml, .env and Caddy.

With nginx

server {
    listen 80;
    listen [::]:80;
    server_name status.example.com;

    location / {
        proxy_pass http://127.0.0.1:3001;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

Then run sudo nginx -t, sudo systemctl reload nginx and sudo certbot --nginx -d status.example.com.

Good to know

• Have the app listen only on 127.0.0.1, not on all addresses. That way nobody can bypass your proxy.
• Many apps want to know the address they can be reached on, for example with a setting such as DOMAIN or N8N_HOST. Enter the https address there.
• Give an admin screen that isn't meant for everyone extra protection: with a password in the app itself, with two-step verification, or only through an SSH tunnel (see An SSH config: log in with a short name).
• You set extra security headers such as HSTS with header in Caddy or add_header in nginx. Only turn on HSTS once https works properly everywhere.