Reverse Proxy

With Nginx Proxy Manager (NPM) on the same Docker host, NPM runs in its own container, so it reaches Healdan over a shared Docker network rather than a port on the host.

1. Find NPM’s network. Run docker network ls. If NPM was started from a folder named npm, the network is npm_default. To confirm, run docker inspect <npm-container> --format '{{json .NetworkSettings.Networks}}'.

2. Edit .env and restart. Set these, then run docker compose up -d:

   .env

   COMPOSE_FILE=compose.yaml:compose.proxy.yaml
   PROXY_NETWORK=npm_default
   LOGICALDOC_PUBLIC_URL=https://docs.example.org

   The app no longer publishes a port on the host. NPM reaches it on that network as logicaldoc:8080.

3. Add a proxy host in NPM (Hosts → Proxy Hosts → Add Proxy Host):

   • Details: Domain Names docs.example.org, Scheme http, Forward Hostname logicaldoc, Forward Port 8080. Turn on Block Common Exploits and Websockets Support.

   • SSL: request a new Let’s Encrypt certificate, and turn on Force SSL and HTTP/2 Support.

   • Advanced, under Custom Nginx Configuration, so large uploads and long conversions aren’t cut off:

     client_max_body_size 0;
     proxy_request_buffering off;
     proxy_read_timeout 300s;
     proxy_send_timeout 300s;

4. Save, then open https://docs.example.org.

With NPM on another machine there’s no Docker network to share, so you don’t use the proxy overlay. Instead the app publishes its port on the Healdan host’s LAN address, and NPM forwards to that address. The examples use 192.168.1.20 for the Healdan host and 192.168.1.10 for NPM’s machine.

1. Give the Healdan host a fixed address, for example with a DHCP reservation on your router. NPM forwards to that address, and the app won’t start if the host loses it.

2. Edit .env and restart. Leave compose.proxy.yaml out of COMPOSE_FILE, and set:

   .env

   LOGICALDOC_BIND=192.168.1.20
   LOGICALDOC_PUBLIC_URL=https://docs.example.org

   Then run docker compose up -d. The app listens on 192.168.1.20:8080, or on LOGICALDOC_PORT if you set it. LOGICALDOC_BIND=0.0.0.0 works too, but it publishes the port on every network the host is on.

3. Check that NPM’s machine can reach it. On NPM’s machine, run:

   curl -sI http://192.168.1.20:8080/

   Any HTTP/1.1 status line means it can. A timeout or Connection refused means it can’t: check the address, the port, and any firewall between the two machines.

4. Add a proxy host in NPM as in the same-host steps, but on the Details tab set Forward Hostname / IP 192.168.1.20 and Forward Port 8080 (or your LOGICALDOC_PORT). Everything else is the same: Block Common Exploits, Websockets Support, the SSL tab and the Advanced snippet.

5. Save, then open https://docs.example.org.

6. Let only NPM’s machine reach the port. Until you do, anything on your LAN can bypass NPM and talk plain HTTP to 192.168.1.20:8080, and hand Healdan a false client IP.

   • Docker’s published ports bypass ufw, so a ufw rule won’t stop them. Add a rule to Docker’s DOCKER-USER chain on the Healdan host instead. With eth0 as its LAN interface (ip -br addr lists them):

     sudo iptables -I DOCKER-USER -i eth0 -p tcp -m conntrack --ctorigdstport 8080 --ctdir ORIGINAL ! -s 192.168.1.10 -j DROP

     Put your LOGICALDOC_PORT in place of 8080 if you changed it. The rule only affects connections that arrive on eth0 for that port, so the app’s own outgoing traffic is unaffected.

   • The rule is gone after a reboot unless you save it, for example with the iptables-persistent package on Debian and Ubuntu.

   • If your router or firewall sits between the Healdan host and the rest of your LAN, you can allow only NPM’s address there instead.

The network between them:

• NPM and the app talk plain HTTP, so passwords and documents cross that network unencrypted. That’s fine on a network you trust. Otherwise connect the two machines over a VPN such as WireGuard or Tailscale, and use the Healdan host’s VPN address for LOGICALDOC_BIND and the Forward Hostname.
• Tomcat trusts forwarded headers only from 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10 (which includes Tailscale’s addresses), loopback, link-local and private IPv6 addresses.
  • If NPM reaches the Healdan host from a public address, Healdan sees plain HTTP, and it records NPM’s address as every user’s IP. With brute-force prevention on, one person’s failed sign-ins then block everyone.
  • Use a VPN rather than publishing port 8080 to the internet.

The WebSocket and 413 rows of the same-host table apply here too.

Run Caddy on the same host. It handles WebSockets and forwarded headers itself:

docs.example.org {
    reverse_proxy 127.0.0.1:8080
}

Run nginx on the same host:

# In the http block:
map $http_upgrade $connection_upgrade { default upgrade; '' close; }

server {
    listen 443 ssl;
    http2 on;
    server_name docs.example.org;
    # ssl_certificate / ssl_certificate_key ...

    client_max_body_size 0;
    proxy_request_buffering off;
    proxy_read_timeout 300s;
    proxy_send_timeout 300s;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}