Prepare reverse proxy deployment

Dockerfile

@@ -22,6 +22,7 @@ WORKDIR /app
 ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1
 ENV PORT=3000
+ENV HOSTNAME=0.0.0.0
 
 RUN apk add --no-cache dumb-init
 

README.md

@@ -32,6 +32,36 @@ [email protected]
 
 Optional values are documented in `.env.example` for Redis rate limiting, email, file storage, hCaptcha, and webhook worker auth.
 
+## Reverse Proxy
+
+Run the app behind your reverse proxy with HTTP upstream, then terminate TLS at the proxy.
+
+For Nginx Proxy Manager or openresty outside this Compose network:
+
+- Scheme: `http`
+- Forward hostname/IP: the Docker host running this stack
+- Forward port: `${APP_PORT}`; default `3080`
+- Public URL: set `AUTH_URL` to the final external URL, for example `https://forms.internal.vyntehome.com`
+
+If openresty is attached to the same Docker network as this stack, proxy to `http://app:3000` instead of the host-published port.
+
+Minimal openresty location:
+
+```nginx
+location / {
+  proxy_pass http://127.0.0.1:3080;
+  proxy_http_version 1.1;
+  proxy_set_header Host $host;
+  proxy_set_header X-Forwarded-Host $host;
+  proxy_set_header X-Forwarded-Proto $scheme;
+  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  proxy_set_header Upgrade $http_upgrade;
+  proxy_set_header Connection "upgrade";
+}
+```
+
+`502 Bad Gateway` means openresty cannot reach the upstream. First verify the app from the proxy host with `curl http://127.0.0.1:3080/signin` or `curl http://<docker-host-ip>:3080/signin`.
+
 ## Authentik Setup
 
 Create an OAuth2/OpenID provider in Authentik:

docker-compose.yml

@@ -10,6 +10,7 @@ services:
     environment:
       NODE_ENV: production
       PORT: 3000
+      HOSTNAME: 0.0.0.0
       DATABASE_URL: postgresql://formbuilder:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}@postgres:5432/formbuilder
       AUTH_SECRET: ${AUTH_SECRET:?set AUTH_SECRET}
       AUTH_URL: ${AUTH_URL:?set AUTH_URL}