How to enable HTTPS / add SSL

[rayearth2162-ship-it]

Hi there

I'm installling Lychee via Docker Compose method, but trying to find out how I can enable HTTPS access.

I'm using SSL using NameCheap SSL Proxy (https://www.namecheap.com/support/knowledgebase/article.aspx/10743/2293/how-webbased-ssl-automation-works/) partly because I don't really know how to install SSL certificate within the webserver inside a docker.

However, when I access the https URL it basically says webserver doesn't support HTTPS, which I assume is because the webserver within the docker doesn't have the relevant SSL.

Google then points to add Nginx reverse proxy, which I then added into the Docker Compose. I changed the YML lychee internal app back to "http" and port "8000", and set up Nginx to forward to http://192.168.1.225:8000 (internal IP for the server). This worked, but then the image appeared blurred / cannot be accessed.

I assume this is partly because the http / https between the reverse proxy is not set up properly.

Also I have an issue with retaining "localhost" in the APP_URL. If I leave it as "localhost" then the website doesn't display properly as it tries to access photos on the client computer in HTML (when it is should be pointing to the server address). I can change to the internal server IP (ie 192.168.1.225) then things will work.

How do people enable HTTPS for Docker installations?

Is the localhost APP_URL pointer broken or am I doing something wrong?

[darekwojciechowski]

Your reverse-proxy approach is the right one. Terminate TLS at the proxy and talk plain HTTP to the container.

The blurred images and the "localhost" problem are the same root cause: Lychee (Laravel) builds image URLs from APP_URL and from the forwarded request headers, and right now they don't match the https address you're browsing.

What happens: the small preview loads, but the full-size image URL is generated as http:// (or as localhost), so the browser either blocks it as mixed content or can't resolve it. It stays blurry.

Fix, three parts:

1. Set APP_URL to your real public https address (not localhost), in the container env / .env:

   APP_URL=https://photos.yourdomain.com
   

2. Tell the proxy to forward the original scheme and host so Laravel knows the request was https. In nginx:

   proxy_set_header Host $host;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_set_header X-Forwarded-Host $host;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

3. Make Laravel trust the proxy so it honors X-Forwarded-Proto. Set the trusted proxies env (Lychee supports this):

   TRUSTED_PROXIES=*
   

   Use the specific proxy container/IP instead of * if you want to be strict.

After that, clear Lychee's cache/config so the new APP_URL takes effect, reload, and the full-size images should serve over https without the blur.

Note on the NameCheap "SSL Proxy": that only works well if it also forwards these headers. If it doesn't let you set X-Forwarded-Proto, run your own nginx/Caddy in front instead. Caddy is the least effort since it doesautomatic HTTPS certs for you.

[ildyria]

To add to this beautiful answer, we also have the APP_FORCE_HTTPS in .env if you want to force the https (if it is not recognized due to missing forwarded-proto and missing TRUSTED_PROXIES)

[darekwojciechowski]

Thanks @ildyria. APP_FORCE_HTTPS covers the case my answer missed: when the proxy doesn't send X-Forwarded-Proto and TRUSTED_PROXIES isn't set, Lychee has no way to know the original request was https.