Sign inSign up

zachbg/ssl-proxy

By zachbg

•Updated 6 months ago

Automatic HTTPS reverse proxy powered by Caddy 2 - zero-config TLS

Image
1

10K+

zachbg/ssl-proxy repository overview

⁠ssl-proxy

One-command HTTPS for any HTTP service — automatic Let's Encrypt, zero config.

Docker Image Docker Pulls

⁠Why?

Adding HTTPS to a service should be one line, not a wall of config. This image:

  • Two env vars — DOMAIN + UPSTREAM, that's it
  • Auto-renewing certs — Let's Encrypt, zero maintenance
  • Security headers — HSTS, X-Frame-Options, etc. built-in
  • HTTP → HTTPS redirect — automatic
  • Compression — gzip + zstd enabled
  • Tiny — Caddy-based, ~40MB

⁠Quick Start

docker run -d \
  -p 80:80 -p 443:443 \
  -e DOMAIN=app.example.com \
  -e UPSTREAM=host.docker.internal:3000 \
  -v ssl-data:/data \
  zachbg/ssl-proxy

That's it. Your app at port 3000 now has HTTPS.

⁠Docker Compose

services:
  ssl:
    image: zachbg/ssl-proxy
    ports:
      - "80:80"
      - "443:443"
    environment:
      - DOMAIN=app.example.com
      - UPSTREAM=app:3000
      - [email protected]  # Optional: for Let's Encrypt notifications
    volumes:
      - ssl-data:/data

  app:
    image: your-app
    # No ports needed — ssl-proxy handles it

volumes:
  ssl-data:

⁠Environment Variables

VariableDefaultRequiredDescription
DOMAINYesYour domain name
UPSTREAMYesBackend address (host:port)
EMAILNoEmail for Let's Encrypt
HTTPS_PORT443NoHTTPS listen port
HTTP_PORT80NoHTTP listen port (redirect)

⁠Examples

⁠Node.js App
docker run -d --name app node-app
docker run -d -p 80:80 -p 443:443 \
  -e DOMAIN=myapp.com \
  -e UPSTREAM=app:3000 \
  --link app \
  -v ssl-data:/data \
  zachbg/ssl-proxy
⁠Multiple Services (use one per service)
services:
  ssl-api:
    image: zachbg/ssl-proxy
    ports: ["443:443", "80:80"]
    environment:
      DOMAIN: api.example.com
      UPSTREAM: api:8080
    volumes: [ssl-data:/data]

  api:
    image: my-api

volumes:
  ssl-data:
⁠Local Development (self-signed)
docker run -d -p 443:443 \
  -e DOMAIN=localhost \
  -e UPSTREAM=host.docker.internal:3000 \
  zachbg/ssl-proxy

⁠Security Headers (included automatically)

  • Strict-Transport-Security — HSTS with preload
  • X-Content-Type-Options: nosniff
  • X-Frame-Options: DENY
  • Referrer-Policy: strict-origin-when-cross-origin
  • Server header removed

⁠License

MIT

Tag summary

Content type

Image

Digest

sha256:2de66cbb1…

Size

22.7 MB

Last updated

6 months ago

docker pull zachbg/ssl-proxy