Reverse proxy & TLS (nginx / Apache)

Chomper's docker-compose.yml ships the app, not a reverse proxy — a fresh install binds directly to 127.0.0.1:3001 (dashboard) and 127.0.0.1:3000 (event ingestion) on the host, with no domain and no TLS. Putting a real domain and certificate in front of that is up to you. This page has working nginx and Apache examples, with both Let's Encrypt and Cloudflare certificates.

What to expose

Two headers every config below sets

chomper-ui has no fixed "public URL" setting — it works out its own origin from the request it receives. Two headers matter:

• Host (or X-Forwarded-Host) and X-Forwarded-Proto — without these, redirects (Google Sign-In, login) can resolve to the container's internal address instead of your real domain.
• X-Forwarded-For — used by Settings → Security's IP allowlist to see the real visitor IP instead of the proxy's.

Once TLS terminates at the proxy, also set COOKIE_SECURE=true in chomper-ui's environment and restart it — otherwise the session cookie won't be marked Secure.

nginx — Let's Encrypt (certbot)

Point DNS at the box, then get a certificate — certbot's own instructions cover every OS/webserver combination if yours differs from the example below:

sudo apt install -y certbot python3-certbot-nginxsudo certbot certonly --nginx -d app.example.com -d ingest.example.com

Dashboard:

server {    listen 80;    server_name app.example.com;    return 301 https://$host$request_uri;} server {    listen 443 ssl;    server_name app.example.com;     ssl_certificate     /etc/letsencrypt/live/app.example.com/fullchain.pem;    ssl_certificate_key /etc/letsencrypt/live/app.example.com/privkey.pem;     location / {        proxy_pass http://127.0.0.1:3001;        proxy_set_header Host $host;        proxy_set_header X-Forwarded-Proto $scheme;        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;    }}

Event ingestion, same pattern on its own subdomain:

server {    listen 80;    server_name ingest.example.com;    return 301 https://$host$request_uri;} server {    listen 443 ssl;    server_name ingest.example.com;     ssl_certificate     /etc/letsencrypt/live/ingest.example.com/fullchain.pem;    ssl_certificate_key /etc/letsencrypt/live/ingest.example.com/privkey.pem;     location /api/v1/events {        proxy_pass http://127.0.0.1:3000;        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;    }}

certbot's nginx plugin (or a cron'd certbot renew) handles renewal — nothing Chomper-specific there.

nginx — Cloudflare (proxied / orange-cloud)

If the domain's DNS is proxied through Cloudflare, terminate TLS at nginx with a Cloudflare Origin CA certificate (Cloudflare dashboard → SSL/TLS → Origin Server → Create Certificate — see Cloudflare's own Origin CA guide) instead of Let's Encrypt, and set the zone's SSL/TLS mode to Full (strict) (Full (strict) docs) so Cloudflare only trusts a real certificate at the origin:

server {    listen 443 ssl;    server_name app.example.com;     ssl_certificate     /etc/nginx/ssl/app.example.com.pem;    ssl_certificate_key /etc/nginx/ssl/app.example.com.key;     location / {        proxy_pass http://127.0.0.1:3001;        proxy_set_header Host $host;        proxy_set_header X-Forwarded-Proto $scheme;        # Cloudflare's edge IP is all $proxy_add_x_forwarded_for would see        # here — use its own header for the real visitor IP instead.        proxy_set_header X-Forwarded-For $http_cf_connecting_ip;    }}

The ingestion vhost follows the same pattern, on its own subdomain, same as the Let's Encrypt example above.

Apache

Enable the modules once:

sudo a2enmod proxy proxy_http ssl headers

Let's Encrypt (via certbot --apache):

<VirtualHost *:80>    ServerName app.example.com    Redirect permanent / https://app.example.com/</VirtualHost> <VirtualHost *:443>    ServerName app.example.com    SSLEngine on    SSLCertificateFile      /etc/letsencrypt/live/app.example.com/fullchain.pem    SSLCertificateKeyFile   /etc/letsencrypt/live/app.example.com/privkey.pem     ProxyPreserveHost On    RequestHeader set X-Forwarded-Proto "https"    ProxyPass        / http://127.0.0.1:3001/    ProxyPassReverse / http://127.0.0.1:3001/</VirtualHost>

Cloudflare Origin CA instead of Let's Encrypt — the same block, just point SSLCertificateFile/SSLCertificateKeyFile at the Origin CA certificate/key, and forward Cloudflare's own client-IP header instead of Apache's default:

RequestHeader set X-Forwarded-For %{HTTP:CF-Connecting-IP}e

Event ingestion is the same ProxyPass/ProxyPassReverse pair pointed at http://127.0.0.1:3000/api/v1/events, on its own vhost.

One caveat with the API key IP allowlist

Settings → Security's per-key IP allowlist on the ingestion API reads the raw connection address, not X-Forwarded-For — by design, since no shipped topology puts a proxy in front of it. Once you add one, every event arrives from the proxy's own IP instead of the real sender's, and an allowlist configured for actual senders will start rejecting everything. If you rely on that allowlist, either send events directly to port 3000 (bypassing the proxy) from allowlisted systems, or don't combine it with a reverse proxy.