HTTPS proxy?

[n9yty]

I was surprised there was no HTTPS proxy in the docker-compose.yml file.

I just borrowed a bit from the ztncui one I had running to get it set up and thought I'd offer it here.

version: "3.1"
services:
  postgres:
    image: postgres:15.2-alpine
    container_name: postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: ztnet
    volumes:
      - postgres-data:/var/lib/postgresql/data
    networks:
      - app-network

  zerotier:
    image: zyclonite/zerotier:1.12.2
    hostname: zerotier
    container_name: zerotier
    restart: unless-stopped
    volumes:
      - zerotier:/var/lib/zerotier-one
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    networks:
      - app-network
    ports:
      - "9993:9993/udp"
    environment:
      - ZT_OVERRIDE_LOCAL_CONF=true
      - ZT_ALLOW_MANAGEMENT_FROM=172.31.255.0/29

  ztnet:
    image: sinamics/ztnet:latest
    container_name: ztnet
    working_dir: /app
    volumes:
      - zerotier:/var/lib/zerotier-one
    restart: unless-stopped
      # ports:
      #  - 3000:3000 # Removed these when using the https proxy
      #  - 127.0.0.1:3000:3000  # <--- Use / Uncomment this line to restrict access to localhost only
    environment:
      POSTGRES_HOST: postgres
      POSTGRES_PORT: 5432
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: ztnet
      NEXTAUTH_URL: "https://{YOUR_PUBLIC_HOST_NAME}" # !! Important !! Set the NEXTAUTH_URL environment variable to the canonical URL or IP of your site with port 3000 (if using without proxy) i.e. http://{YOUR_PUBLIC_HOST_NAME}:3000
      NEXTAUTH_SECRET: "random_secret"
    networks:
      - app-network
    expose:
      - "3000"
    links:
      - postgres
    depends_on:
      - postgres
      - zerotier

  https-proxy:
    image: caddy:latest
    container_name: ztnet-https-proxy
    restart: unless-stopped
    depends_on:
      - ztnet
    command: caddy reverse-proxy --from {YOUR-PUBLIC-HOST-NAME} --to ztnet:3000
    volumes:
      - caddy_data:/data
    networks:
      - app-network
    links:
      - ztnet
    ports:
      - "80:80"
      - "443:443"

volumes:
  zerotier:
  postgres-data:
  caddy_data:

networks:
  app-network:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 172.31.255.0/29

[sinamics]

it haas been on my mind for a while to add proxy configuration, but never got there. ⏲️
thank you for sharing, i will test it out and update the docs.

I never used Caddy, only nginx and traefik, but i guess is just another tool in the reverse proxy arsenal.

[n9yty]

Caddy was attractive because you basically configure almost nothing, it handles it all to set up and maintain your certificates and such. It is written in Go so perhaps there might be performance cases where nginx would do better, but for this type of application I think it would be fine. I guess it depends on how far out the installation scales. But that is part of the beauty of a docker configuration, you can swap out the pieces to find something that works for you. Very unix-like with pluggable pieces to do a larger job. :)

BTW: This is an incredible thing you have built and made available. I didn't see it mentioned, but is there a preferred way to make a small donation to show appreciation?

[wmd1942]

There is a sponsoring button on the front page of ztnet.

[n9yty]

Thanks for pointing that out!

[Nils-Othmer-001]

I was surprised there was no HTTPS proxy in the docker-compose.yml file.

I just borrowed a bit from the ztncui one I had running to get it set up and thought I'd offer it here.

version: "3.1"
services:
  postgres:
    image: postgres:15.2-alpine
    container_name: postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: ztnet
    volumes:
      - postgres-data:/var/lib/postgresql/data
    networks:
      - app-network

  zerotier:
    image: zyclonite/zerotier:1.12.2
    hostname: zerotier
    container_name: zerotier
    restart: unless-stopped
    volumes:
      - zerotier:/var/lib/zerotier-one
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    networks:
      - app-network
    ports:
      - "9993:9993/udp"
    environment:
      - ZT_OVERRIDE_LOCAL_CONF=true
      - ZT_ALLOW_MANAGEMENT_FROM=172.31.255.0/29

  ztnet:
    image: sinamics/ztnet:latest
    container_name: ztnet
    working_dir: /app
    volumes:
      - zerotier:/var/lib/zerotier-one
    restart: unless-stopped
      # ports:
      #  - 3000:3000 # Removed these when using the https proxy
      #  - 127.0.0.1:3000:3000  # <--- Use / Uncomment this line to restrict access to localhost only
    environment:
      POSTGRES_HOST: postgres
      POSTGRES_PORT: 5432
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: ztnet
      NEXTAUTH_URL: "https://{YOUR_PUBLIC_HOST_NAME}" # !! Important !! Set the NEXTAUTH_URL environment variable to the canonical URL or IP of your site with port 3000 (if using without proxy) i.e. http://{YOUR_PUBLIC_HOST_NAME}:3000
      NEXTAUTH_SECRET: "random_secret"
    networks:
      - app-network
    expose:
      - "3000"
    links:
      - postgres
    depends_on:
      - postgres
      - zerotier

  https-proxy:
    image: caddy:latest
    container_name: ztnet-https-proxy
    restart: unless-stopped
    depends_on:
      - ztnet
    command: caddy reverse-proxy --from {YOUR-PUBLIC-HOST-NAME} --to ztnet:3000
    volumes:
      - caddy_data:/data
    networks:
      - app-network
    links:
      - ztnet
    ports:
      - "80:80"
      - "443:443"

volumes:
  zerotier:
  postgres-data:
  caddy_data:

networks:
  app-network:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 172.31.255.0/29

If you would'nt mind helping - when i use your https docker-compose file modification - i get the ZTNET landingpage but now the backend seems to have some sort of problem, as i can create a new user and fill in the login information fields, but the logging in circle just keeps spinning: (i've set the public hostname in the compose file just redacted / replaced it below for security reasons)

[next-auth][error][CLIENT_FETCH_ERROR]
ztnet | https://next-auth.js.org/errors#client_fetch_error fetch failed {
ztnet | error: {
ztnet | message: 'fetch failed',
ztnet | stack: 'TypeError: fetch failed\n' +
ztnet | ' at node:internal/deps/undici/undici:12618:11\n' +
ztnet | ' at process.processTicksAndRejections (node:internal/process/task_queues:95:5)',
ztnet | name: 'TypeError'
ztnet | },
ztnet | url: 'https://{PUBLIC HOSTNAME}/api/auth/session',
ztnet | message: 'fetch failed'

[Nils-Othmer-001]

nvm. Was tring to build from source code - using the compose file in normal installer worked