Prepare reverse proxy deployment

README.md

@@ -32,6 +32,36 @@ [email protected]
 
 Optional values are documented in `.env.example` for Redis rate limiting, email, file storage, hCaptcha, and webhook worker auth.
 
+## Reverse Proxy
+
+Run the app behind your reverse proxy with HTTP upstream, then terminate TLS at the proxy.
+
+For Nginx Proxy Manager or openresty outside this Compose network:
+
+- Scheme: `http`
+- Forward hostname/IP: the Docker host running this stack
+- Forward port: `${APP_PORT}`; default `3080`
+- Public URL: set `AUTH_URL` to the final external URL, for example `https://forms.internal.vyntehome.com`
+
+If openresty is attached to the same Docker network as this stack, proxy to `http://app:3000` instead of the host-published port.
+
+Minimal openresty location:
+
+```nginx
+location / {
+  proxy_pass http://127.0.0.1:3080;
+  proxy_http_version 1.1;
+  proxy_set_header Host $host;
+  proxy_set_header X-Forwarded-Host $host;
+  proxy_set_header X-Forwarded-Proto $scheme;
+  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  proxy_set_header Upgrade $http_upgrade;
+  proxy_set_header Connection "upgrade";
+}
+```
+
+`502 Bad Gateway` means openresty cannot reach the upstream. First verify the app from the proxy host with `curl http://127.0.0.1:3080/signin` or `curl http://<docker-host-ip>:3080/signin`.
+
 ## Authentik Setup
 
 Create an OAuth2/OpenID provider in Authentik: