how to use reverse proxy? #3022

audricd · 2025-09-20T18:23:00Z

audricd
Sep 20, 2025

Hello,

This is my docker compose:

services:
  server:
    image: ghcr.io/bluewave-labs/checkmate-backend-mono:latest
    pull_policy: always
    restart: always
    ports:
      - "52345:52345"
    environment:
      - UPTIME_APP_API_BASE_URL=http://${HOST}:52345/api/v1
      - UPTIME_APP_CLIENT_HOST=http://${HOST}
      - DB_CONNECTION_STRING=mongodb://mongodb:27017/uptime_db
      - CLIENT_HOST=http://${HOST}
      - JWT_SECRET=${JWT}
    depends_on:
      - mongodb
  mongodb:
    image: ghcr.io/bluewave-labs/checkmate-mongo:latest
    restart: always
    command: ["mongod", "--quiet", "--bind_ip_all"]
    volumes:
      - ./mongo/data:/data/db
    healthcheck:
      test: ["CMD", "mongosh", "--eval", "db.adminCommand('ping')", "--quiet"]
      interval: 5s
      timeout: 30s
      start_period: 0s
      start_interval: 1s
      retries: 30

Its stock but just with the variables.
when I put 192.168.236.113 as HOST, the actual server ip (debian lxc, if that matters), i can access

I am doing a reverse proxy to it

that doesnt work

should i put the fqdn on the HOST variable, do a reverse proxy rewrite, or...?

lh01-lft · 2025-09-22T13:04:40Z

lh01-lft
Sep 22, 2025

Same here! would love to use the solution on a secure way :D

0 replies

YouKyi · 2025-09-24T11:19:47Z

YouKyi
Sep 24, 2025

Same here.

0 replies

YouKyi · 2025-10-01T14:10:28Z

YouKyi
Oct 1, 2025

I thnik i find the issue, not the solution.
I use NPMPlus and monobackend image for checkamte.
When i set my domain name in variable like :
" - UPTIME_APP_API_BASE_URL=https://sup.domain.example/api/v1
- UPTIME_APP_CLIENT_HOST=https://sup.domain.example
- CLIENT_HOST=https://sup.domain.example"
Lorsque j'accède au panel via le nom de domaine "sup.domain.example", et que je fais "register here", dans les logs de la console web j'ai :

fetch("http://localhost:52345/api/v1/health", {
  "headers": {
    "accept": "application/json, text/plain, */*",
    "accept-language": "en",
    "authorization": "Bearer"
  },
  "referrer": "",
  "body": null,
  "method": "GET",
  "mode": "cors",
  "credentials": "include"
});

Donc ca veut me renvoyer vers localhost, forcèment ca ne marche pas, forcèement ne c'est pas la même machine.

Et si j'accède à checkamte via l'ip en brut donc par exemple 1.1.1.1:523445 au lieu de sup.domain.example, et que je clique encore une fois sur "register here", j'ai ça dans les logs de la console web.

fetch("https://sup.domain.example/api/v1/auth/users/superadmin", {
  "headers": {
    "accept": "application/json, text/plain, */*",
    "accept-language": "en",
    "authorization": "Bearer",
    "sec-ch-ua": "\"Chromium\";v=\"140\", \"Not=A?Brand\";v=\"24\", \"Brave\";v=\"140\"",
    "sec-ch-ua-mobile": "?0",
    "sec-ch-ua-platform": "\"macOS\""
  },
  "referrer": "http://1.1.1.1:52345/",
  "body": null,
  "method": "GET",
  "mode": "cors",
  "credentials": "include"
});

Là ca me renvoie vers sup.domain.example ?

Quel est le soucis ? Je ne comprend pas le comportement de checkmate là.
Evidemment, aucune modification, voici le docker compose

services:
  server:
    image: ghcr.io/bluewave-labs/checkmate-backend-mono:latest
    networks:
      - proxy
      - checkamte-net
    pull_policy: always
    restart: always
    ports:
      - "52345:52345"
    environment:
      - LOG_LEVEL=DEBUG
      - NODE_ENV=production
      - UPTIME_APP_API_BASE_URL=https://sup.domain.example/api/v1
      - UPTIME_APP_CLIENT_HOST=https://sup.domain.example
      - CLIENT_HOST=https://sup.domain.example
      - DB_CONNECTION_STRING=mongodb://mongodb:27017/uptime_db
      - JWT_SECRET=3fdff81025ac26cfa4ddcd866ebee7b7abbca83e08961b886ce3775964ef251f3e23ba9ef8ebd7a8de288b7d2daa0a22bc4f3e9e091cc0332afdee3471e28651
    depends_on:
      - mongodb


  mongodb:
    image: ghcr.io/bluewave-labs/checkmate-mongo:latest
    networks:
      - checkamte-net
    restart: always
    command: ["mongod", "--quiet", "--bind_ip_all"]
    volumes:
      - data-volume:/data/db
    healthcheck:
      test: ["CMD", "mongosh", "--eval", "db.adminCommand('ping')", "--quiet"]
      interval: 5s
      timeout: 30s
      start_period: 0s
      start_interval: 1s
      retries: 30
networks:
  proxy:
    external: true
  checkamte-net:
    driver: bridge

volumes:
  data-volume:

0 replies

keonramses · 2025-10-03T07:06:53Z

keonramses
Oct 3, 2025

Here's my working config, I hope it helps you.


services:
  server:
    image: ghcr.io/bluewave-labs/checkmate-backend-mono:latest
    container_name: checkmate
    restart: always
    ports:
      - 52345:52345
    environment:
      - UPTIME_APP_API_BASE_URL=https://checkmate.${DOMAIN}/api/v1
      - UPTIME_APP_CLIENT_HOST=https://checkmate.${DOMAIN}
      - DB_CONNECTION_STRING=mongodb://mongodb:27017/uptime_db
      - CLIENT_HOST=https://checkmate.${DOMAIN}
      - JWT_SECRET=${CHECKMATE_SECRET}
    depends_on:
      - mongodb
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - homelab
    labels:
      - traefik.enable=true
      - traefik.http.routers.checkmate.rule=Host(`checkmate.${DOMAIN}`)
      - traefik.http.routers.checkmate.entrypoints=websecure
      - traefik.http.routers.checkmate.tls.certresolver=cloudflare
      - traefik.http.services.checkmate.loadbalancer.server.port=52345 
     # CORS middleware
      - traefik.http.middlewares.checkmate-cors.headers.accessControlAllowOriginList=https://check.${DOMAIN},http://10.0.0.112:52345
      - traefik.http.middlewares.checkmate-cors.headers.accessControlAllowMethods=GET,POST,PUT,PATCH,DELETE,OPTIONS
      - traefik.http.middlewares.checkmate-cors.headers.accessControlAllowHeaders=*
      - traefik.http.middlewares.checkmate-cors.headers.accessControlAllowCredentials=true
      - traefik.http.middlewares.checkmate-cors.headers.addVaryHeader=true
      - traefik.http.routers.checkmate.middlewares=checkmate-cors@docker
  mongodb:
    image: ghcr.io/bluewave-labs/checkmate-mongo:latest
    container_name: checkmate_db
    restart: always
    command:
      - mongod
      - --quiet
      - --bind_ip_all
    volumes:
      - ${DOCKER_DATA_DIR}/checkmate/mongo/data:/data/db
    healthcheck:
      test:
        - CMD
        - mongosh
        - --eval
        - db.adminCommand('ping')
        - --quiet
      interval: 5s
      timeout: 30s
      start_period: 0s
      start_interval: 1s
      retries: 30
    networks:
      - homelab
networks:
  homelab:
    external: true

0 replies

audricd · 2025-10-03T07:56:13Z

audricd
Oct 3, 2025
Author

Id love to see that for nginx proxy manager. Here, and of course, somewhere in the documentation 🙄

0 replies

lh01-lft · 2025-10-10T10:01:00Z

lh01-lft
Oct 10, 2025

Here's my working config, I hope it helps you.


services:
  server:
    image: ghcr.io/bluewave-labs/checkmate-backend-mono:latest
    container_name: checkmate
    restart: always
    ports:
      - 52345:52345
    environment:
      - UPTIME_APP_API_BASE_URL=https://checkmate.${DOMAIN}/api/v1
      - UPTIME_APP_CLIENT_HOST=https://checkmate.${DOMAIN}
      - DB_CONNECTION_STRING=mongodb://mongodb:27017/uptime_db
      - CLIENT_HOST=https://checkmate.${DOMAIN}
      - JWT_SECRET=${CHECKMATE_SECRET}
    depends_on:
      - mongodb
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - homelab
    labels:
      - traefik.enable=true
      - traefik.http.routers.checkmate.rule=Host(`checkmate.${DOMAIN}`)
      - traefik.http.routers.checkmate.entrypoints=websecure
      - traefik.http.routers.checkmate.tls.certresolver=cloudflare
      - traefik.http.services.checkmate.loadbalancer.server.port=52345 
     # CORS middleware
      - traefik.http.middlewares.checkmate-cors.headers.accessControlAllowOriginList=https://check.${DOMAIN},http://10.0.0.112:52345
      - traefik.http.middlewares.checkmate-cors.headers.accessControlAllowMethods=GET,POST,PUT,PATCH,DELETE,OPTIONS
      - traefik.http.middlewares.checkmate-cors.headers.accessControlAllowHeaders=*
      - traefik.http.middlewares.checkmate-cors.headers.accessControlAllowCredentials=true
      - traefik.http.middlewares.checkmate-cors.headers.addVaryHeader=true
      - traefik.http.routers.checkmate.middlewares=checkmate-cors@docker
  mongodb:
    image: ghcr.io/bluewave-labs/checkmate-mongo:latest
    container_name: checkmate_db
    restart: always
    command:
      - mongod
      - --quiet
      - --bind_ip_all
    volumes:
      - ${DOCKER_DATA_DIR}/checkmate/mongo/data:/data/db
    healthcheck:
      test:
        - CMD
        - mongosh
        - --eval
        - db.adminCommand('ping')
        - --quiet
      interval: 5s
      timeout: 30s
      start_period: 0s
      start_interval: 1s
      retries: 30
    networks:
      - homelab
networks:
  homelab:
    external: true

Thanks for sharing, but I would highly appreciate staying with nginx manager.

This is for Traefik right?

0 replies

audricd · 2025-10-10T10:20:31Z

audricd
Oct 10, 2025
Author

This is for Traefik right?

yes

0 replies

YouKyi · 2025-10-10T10:24:20Z

YouKyi
Oct 10, 2025

I will test witn NPMPlus your dockerfile,
Have a nice day.

I was so tired , i didn't see i write in english and french both lol

0 replies

lh01-lft · 2025-10-10T10:48:16Z

lh01-lft
Oct 10, 2025

I now did a little bit Debugging.

I set the following in the "Advanced" Configuration Tab in NPM(plus):

proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme;

then the Server will Feedback:

ValidationError: The Express 'trust proxy' setting is true, which allows anyone to trivially bypass IP-based rate limiting. See https://express-rate-limit.github.io/ERR_ERL_PERMISSIVE_TRUST_PROXY/ for more information. at Object.trustProxy (file:///app/server/node_modules/express-rate-limit/dist/index.mjs:317:13) at wrappedValidations.<computed> [as trustProxy] (file:///app/server/node_modules/express-rate-limit/dist/index.mjs:577:22) at Object.keyGenerator (file:///app/server/node_modules/express-rate-limit/dist/index.mjs:678:20) at file:///app/server/node_modules/express-rate-limit/dist/index.mjs:737:32 at process.processTicksAndRejections (node:internal/process/task_queues:95:5) at async file:///app/server/node_modules/express-rate-limit/dist/index.mjs:718:5 { code: 'ERR_ERL_PERMISSIVE_TRUST_PROXY', help: 'https://express-rate-limit.github.io/ERR_ERL_PERMISSIVE_TRUST_PROXY/' }

which if you open the Documentation (https://express-rate-limit.github.io/ERR_ERL_PERMISSIVE_TRUST_PROXY), you will have to insert into app.js (in the docker container at: /app/server/src/app.js):

app.set('trust proxy', 1);

to Make changes work you will have to mount that file as "ro" in the volumes in the compose file:

for example:

volumes: - ./server/app.js:/app/server/src/app.js:ro

But with that set to true, the IP, or whatever - it still gets Stuck but won't give you any errors.

I didn't try the "KeyGenerator" yet:

https://express-rate-limit.mintlify.app/reference/error-codes#err-erl-forwarded-header

But this could be the right direction for our issues.

At least for me - I get only Status 200 in Browser Console, but am greeted with a blank white-Screen (using selfsigned certs btw):

0 replies

audricd · 2025-10-29T09:08:43Z

audricd
Oct 29, 2025
Author

not sure why missing documentation is turned from issue to discussion
#1734 (comment)
this is a recurring problem, and since the feedback on multiple topics from different users; im obviously not "the only idiot who can set this program up", behind a reverse proxy.

can the devs PLEASE add missing and needed documentation?

0 replies

Uh oh!

how to use reverse proxy? #3022

Uh oh!

Replies: 10 comments

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

audricd Oct 3, 2025 Author

Uh oh!

Uh oh!

Uh oh!

audricd Oct 10, 2025 Author

Uh oh!

Uh oh!

Uh oh!

audricd Oct 29, 2025 Author

audricd
Oct 3, 2025
Author

audricd
Oct 10, 2025
Author

audricd
Oct 29, 2025
Author