O96u
ff20f97522
Add slider captcha for web login, VitePress documentation on GitHub Pages, and fixes for gallery delete refresh, pagination jump, and copy-format persistence.
84 lines
2.6 KiB
Markdown
84 lines
2.6 KiB
Markdown
# Reverse proxy
|
|
|
|
In production, terminate HTTPS with Nginx, Caddy, NPM (Nginx Proxy Manager), or your NAS proxy and forward to PicHost on port **6892**.
|
|
|
|
## Basics
|
|
|
|
- Upstream: `http://127.0.0.1:6892` (or host IP)
|
|
- Forward: `Host`, `X-Forwarded-Proto` (and `X-Forwarded-For` as needed)
|
|
- Body size: Nginx `client_max_body_size 12m` or larger
|
|
- Use **HTTPS** on the public edge
|
|
|
|
## Single domain (Nginx)
|
|
|
|
Admin, API, and images on one hostname:
|
|
|
|
```nginx
|
|
server {
|
|
server_name pic.example.com;
|
|
location / {
|
|
proxy_pass http://127.0.0.1:6892;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
client_max_body_size 12m;
|
|
}
|
|
}
|
|
```
|
|
|
|
Optional:
|
|
|
|
```env
|
|
IMAGE_BASE_URL=https://pic.example.com
|
|
```
|
|
|
|
Without `IMAGE_BASE_URL`, PicHost infers the public URL from forwarded headers.
|
|
|
|
## Dual domains
|
|
|
|
Both hostnames can fully proxy to the same port; isolation is enforced in PicHost middleware.
|
|
|
|
See [Dual-domain separation](./domain-separation.md).
|
|
|
|
## Cloudflare orange cloud
|
|
|
|
Run PicHost on **your server / Docker** (port `6892`). On Cloudflare:
|
|
|
|
| Practice | Notes |
|
|
| -------- | ----- |
|
|
| **Proxied DNS** | Both admin and image hostnames → origin proxy to `6892`, SSL **Full (strict)** |
|
|
| Preferred edge IPs | Compatible; Host remains your real domain |
|
|
| **R2** | Object storage backend in **Storage**; not the same as hosting the app on Pages |
|
|
| Origin firewall | Allow only [Cloudflare IPs](https://www.cloudflare.com/ips/); do not expose `6892` publicly |
|
|
|
|
**Avoid:**
|
|
|
|
- **Cloudflare Pages** (`*.pages.dev`) or **Workers** (`*.workers.dev`) as a **full-site reverse proxy** to PicHost — extra hostnames can bypass dual-domain isolation ([Security notes](./domain-separation.md#security-notes))
|
|
- “Create Worker” from Git on this repo — `node-server` preset is not Workers-ready
|
|
|
|
## Origin hardening (dual-domain)
|
|
|
|
PicHost middleware does **not** reject unlisted Host values. Complement with:
|
|
|
|
1. **`server_name` allowlist** — site + image hosts only; `default_server` blocks bare IP and unknown Host
|
|
2. **Do not expose 6892 on the public Internet** — only local reverse proxy; public 80/443 only
|
|
3. **Orange cloud** — origin firewall limited to Cloudflare IP ranges
|
|
|
|
## Caddy
|
|
|
|
```caddy
|
|
pic.example.com {
|
|
reverse_proxy 127.0.0.1:6892
|
|
}
|
|
```
|
|
|
|
Add a second site block for the second hostname with the same upstream.
|
|
|
|
## Caching
|
|
|
|
Image 404/403 and domain-isolation 404 responses are **no-cache** to avoid sticky CDN errors. Be careful caching API paths behind a CDN.
|
|
|
|
## See also
|
|
|
|
- [Environment variables](./configuration.md)
|
|
- [Quick start](./getting-started.md)
|