Skip to main content

Choose an ingress method

Use either direct Caddy HTTPS or Cloudflare Tunnel. Do not run two services competing for host ports 80/443. Backend services remain internal in both arrangements.

Direct Caddy HTTPS​

Point your app and API DNS hostnames to the server, make inbound TCP 80 and TCP/UDP 443 available, and stop competing web-server listeners. The installer checks these conditions and writes the following routing pattern:

app.yourdomain.com {
    reverse_proxy web:4001
}
api.yourdomain.com {
    @reverb path /app/*
    reverse_proxy @reverb ws:8083
    reverse_proxy api:4000
}

Manual installations must save this as Caddyfile beside Compose, substituting their own domains. Keep VITE_REVERB_HOST=api.yourdomain.com for this routing pattern. Alternatively, create a separate ws.yourdomain.com site pointing to ws:8083, update DNS and both backend/browser Reverb settings accordingly.

Caddy manages certificates in its persistent volumes. This does not require the NuSaaS console, NuSaaS DNS access or a NuSaaS-managed tunnel.

docker compose logs --since=10m proxy
curl -f https://api.yourdomain.com/api/health

Certificate issuance can fail because DNS has not propagated, ports are blocked or another server owns the hostname/listener. WSL users must check Windows port ownership as well. Skipping an installer DNS check does not make certificates work.

If placing another proxy in front of the application, explicitly configure trusted proxies, TLS termination and WebSocket forwarding. Do not cache authenticated ERP API responses or put interactive browser challenges in front of authenticated provider webhooks.