Skip to main content
One setting decides whether a public deployment is safe: AUTH_COOKIE_SECURE must be true on any instance reachable over TLS, so the session cookie is never sent over plain HTTP.

​
Put asobeast behind TLS

asobeast does not terminate TLS. Put a reverse proxy in front of port 3000 and let it handle certificates. Caddy is the shortest path, because it obtains and renews certificates on its own.
nginx and Traefik work the same way. Whichever you use, the proxy must forward the Host header and the request path unchanged, because the web app serves the admin surfaces at identical paths. Then set the API variables that assume TLS.

​
Set TRUST_PROXY correctly

TRUST_PROXY defaults to false and controls one thing: whether the API believes X-Forwarded-For.
Setting TRUST_PROXY=true on a directly exposed instance lets any caller forge X-Forwarded-For and spread login attempts across fabricated addresses, which defeats the auth rate limiter. Enable it only behind a proxy that overwrites the header.
Leaving it false behind a proxy is safe but blunt: every client shares the proxy’s address for rate limiting purposes, which is fine for a single operator instance.

​
Set WEB_PUBLIC_URL

WEB_PUBLIC_URL is used for exactly one thing: building absolute deep links inside alert payloads. Set it to the origin a person would type. Unset, the link field is null rather than a localhost guess that would not open for anyone. See Send alerts.

​
What does Compose expose?

Only port 3000, published by the web container. The API, PostgreSQL and Redis stay on Docker networks, and the backend network is marked internal. That means the reverse proxy needs to reach port 3000 and nothing else. See Self host with Docker Compose.

​
Checklist before going public

1

Terminate TLS in front of port 3000

Confirm the site loads over HTTPS with a valid certificate.
2

Set AUTH_COOKIE_SECURE=true

Then restart the API and sign in again.
3

Set TRUST_PROXY to match reality

true only if your proxy overwrites X-Forwarded-For.
4

Generate AUTH_SECRET properly

openssl rand -hex 32. Never a memorable string, never reused from development.
5

Leave registration closed

AUTH_ALLOW_REGISTRATION=false once the owner account exists.
6

Schedule and test backups

A backup that has never been restored is not a backup. See Back up PostgreSQL.

Authentication and accounts

Sessions, registration and the guards.

The queue dashboard and the OpenAPI surface

Why those routes answer 404.
Last modified on July 31, 2026