Apps behind the proxy

Every public app is reached through ZedCloud’s Caddy proxy, over plain http on the workspace’s private network. The app sees the proxy’s private address (10.x, 172.16-31.x or 192.168.x) as the peer, and the visitor’s real address in X-Forwarded-For, with X-Forwarded-Proto: https and the original Host.

Many apps refuse that unless they are told to trust the proxy. The symptom is a 400 Bad Request, a redirect loop, or links that point at http://.

Home Assistant

Add to configuration.yaml (in the app’s config volume) and restart the app:

http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16

Both keys are needed: trusted_proxies alone does not make Home Assistant read the forwarded address. If it still answers 400, its log names the address it rejected (“A request from a reverse proxy was received from …”): add that address.

Other frameworks

Set the framework’s “trust the proxy” option to the same private ranges: Django SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https"), Rails config.action_dispatch.trusted_proxies, Express app.set("trust proxy", true), n8n N8N_PROXY_HOPS=1.

Big images take a while

The first deploy of a large image (Immich, Home Assistant) can spend many minutes pulling it; the node shows creating: pulling <image> meanwhile. A pull gives up after 45 minutes, and the node then says so.