ES
DocsConfigurationReverse proxy & TLS

Reverse proxy & TLS

Serve the panel behind nginx, Traefik, Caddy or a Cloudflare Tunnel — with the two flags that keep sessions and rate limiting correct.

Why a proxy

Plain HTTP keeps working for a homelab LAN — TLS-specific hardening is opt-in, not forced. But if the panel is reachable from the internet, serve it behind a reverse proxy with TLS (Caddy, Traefik, nginx) or a Cloudflare Tunnel, and never expose the panel port directly.

TRUST_PROXY

Behind a proxy, set TRUST_PROXY so Express trusts X-Forwarded-*, sees the real client IP, and login rate limiting works correctly. Accepted values:

  • A hop count: 1, 2, …
  • One of loopback / linklocal / uniquelocal.
  • An IP/CIDR list: 10.0.0.0/8 or 127.0.0.1, 192.168.1.0/24.

An unrecognised value leaves it off and logs a warning at startup — vuzon never guesses about who to trust.

With TLS termination, also set COOKIE_SECURE=1 so the vuzon_session cookie is marked Secure and never travels over plain HTTP.

.env
# Behind a TLS-terminating reverse proxy, one hop away
TRUST_PROXY=1
COOKIE_SECURE=1

What vuzon already does

Every API response ships a strict CSP, nosniff, Referrer-Policy and Cache-Control: no-store. Cloudflare’s error text is logged server-side and never returned to the browser; upstream 401/403 are normalised to 502 so they can’t be mistaken for your own session expiring.

PreviousEnvironment variablesNextBackups