Reverse proxy and HTTPS

LatestArr serves plain HTTP on port 3000 and expects TLS to be handled in front of it. If you’re exposing it beyond your own network, put it behind a reverse proxy.

Two settings to get right

1. TRUST_PROXY=true, so LatestArr believes the proxy’s X-Forwarded-For and X-Forwarded-Proto headers. That’s what makes login rate limiting use the real client IP, and what lets the session cookie be marked Secure.
2. WEB_ORIGIN set to the public https:// URL, e.g. https://newsletter.example.com.

Your proxy must forward those two headers. Caddy and Traefik do by default; Nginx needs them set explicitly.

Examples

These are minimal starting points. The Caddy example comes from the project’s own docs; the Traefik and Nginx ones are standard configurations that haven’t been tested by the project. Corrections welcome.

newsletter.example.com {
    reverse_proxy localhost:3000
}

services:
  latestarr:
    # ...existing settings...
    labels:
      - traefik.enable=true
      - traefik.http.routers.latestarr.rule=Host(`newsletter.example.com`)
      - traefik.http.routers.latestarr.entrypoints=websecure
      - traefik.http.routers.latestarr.tls.certresolver=letsencrypt
      - traefik.http.services.latestarr.loadbalancer.server.port=3000

server {
    listen 443 ssl;
    server_name newsletter.example.com;
 
    ssl_certificate     /etc/ssl/certs/newsletter.example.com.pem;
    ssl_certificate_key /etc/ssl/private/newsletter.example.com.key;
 
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Then in .env:

TRUST_PROXY=true
WEB_ORIGIN=https://newsletter.example.com

Restart with docker compose up -d for the change to take effect.