proxy/README.md

HTTPS Reverse Proxy

This directory hosts the single public HTTPS entry point for apps under /opt/docker/apps.

Route config

Edit config/proxy.yaml and add routes like:

server_name: mnmsoft.hopto.org
certificate_name: mnmsoft.hopto.org

routes:
  - project_dir: /opt/docker/apps/turnir2024
    path_suffix: odzaci-open-2026
    port: 32834
    upstream_scheme: https

Fields:

• project_dir: informational only, kept in the generated config and landing page.
• path_suffix: public path after the domain. odzaci-open-2026 becomes https://mnmsoft.hopto.org/odzaci-open-2026/.
• port: port exposed on the Docker host by the target app.
• upstream_scheme: optional, defaults to http. Use https if the backend app still terminates TLS itself.
• upstream_host: optional, defaults to host.docker.internal.

Start

./scripts/render.sh
docker compose up -d

After changing routes:

./scripts/render.sh
docker compose restart proxy

TLS certificates

Issue a Let's Encrypt certificate after the proxy is reachable on public port 80:

./scripts/certbot-init.sh mnmsoft.hopto.org you@example.com

Renew manually:

./scripts/certbot-renew.sh

Typical cron entry:

0 3 * * * cd /opt/docker/apps/proxy && ./scripts/certbot-renew.sh >/var/log/proxy-certbot-renew.log 2>&1

The proxy serves certificates from a stable path:

./letsencrypt/live/current/fullchain.pem
./letsencrypt/live/current/privkey.pem

Certbot may create versioned lineages such as mnmsoft.hopto.org-0001; the helper scripts automatically repoint live/current/ to the latest real lineage after issuance or renewal.

Important behavior

This proxy strips the configured prefix before forwarding. Example:

• public request: /odzaci-open-2026/api/matches
• upstream request: /api/matches

It also sends X-Forwarded-Prefix: /odzaci-open-2026.

Apps that generate absolute URLs from / instead of respecting the forwarded prefix may still need app-level configuration changes.