Reverse proxy and TLS

self-hostingtls

The server listens on port 8080 and speaks plain HTTP. It expects to sit behind whatever proxy you already run, and it needs no DocuCommit-specific configuration to do so: a standard proxy_pass to 127.0.0.1:8080 is the whole integration.

nginx

server {
    listen 443 ssl;
    server_name docs.example.com;

    ssl_certificate     /etc/ssl/certs/docs.example.com.pem;
    ssl_certificate_key /etc/ssl/private/docs.example.com.key;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Add a second server block on port 80 that redirects to HTTPS. The server does not do that for you — see the note at the end of this page.

Caddy

Caddy gets and renews the certificate itself, so the whole file is three lines:

docs.example.com {
    reverse_proxy 127.0.0.1:8080
}

Everything else

Traefik — a router on the container with a service pointing at port 8080, and your usual certificate resolver.
Cloudflare Tunnel — one ingress rule mapping the hostname to http://127.0.0.1:8080.
Cloud load balancer (AWS ALB and equivalents) — a target group on port 8080 with the certificate on the listener. Point the health check at /health, which is exempt from the licence gate and answers even when the licence is not yet valid.

Direct TLS without a proxy

If you would rather not run a proxy at all, the server can serve HTTPS itself. Bring your own PKCS12 keystore — from your CA, from Let’s Encrypt, or self-signed for testing.

Generate a self-signed keystore for a test deployment:

keytool -genkeypair \
    -alias docucommit \
    -keyalg RSA -keysize 2048 -validity 365 \
    -storetype PKCS12 \
    -keystore /opt/docucommit/keystore.p12 \
    -storepass "<choose-a-password>" \
    -dname "CN=docs.example.com, OU=IT, O=Your Org, L=City, C=SE"

Then set these in .env:

SERVER_PORT=8443
SERVER_SSL_ENABLED=true
SERVER_SSL_KEY_STORE=/opt/docucommit/keystore.p12
SERVER_SSL_KEY_STORE_PASSWORD=<the password you chose>
SERVER_SSL_KEY_STORE_TYPE=PKCS12
SERVER_SSL_KEY_ALIAS=docucommit

Port 8443 is a convention, not a requirement — SERVER_PORT accepts anything. In Docker, map the published port to match. The keystore has to be readable inside the container, so mount it in like any other file.

Each variable is listed in the configuration reference.

Two things to know

There is no built-in HTTP to HTTPS redirect. A request that arrives over plain HTTP is served over plain HTTP. If you want the redirect, do it in the proxy — which is another reason to terminate TLS there rather than on the server.

HSTS is only sent when SERVER_SSL_ENABLED=true. With direct TLS on, every response carries Strict-Transport-Security: max-age=31536000; includeSubDomains. With it off, the header is not sent at all, deliberately: a server behind a proxy has no reliable way to know the public scheme, and an HSTS header pinned to the wrong one locks browsers out of the site. When you terminate TLS in a proxy, set HSTS in the proxy.