Skip to main content

Reverse-proxy guide

A reverse proxy lets you publish PlexSub through your own domain with HTTPS.

Common choices include Nginx Proxy Manager, Traefik, Caddy, SWAG, and Cloudflare Tunnel.

Important variables​

APP_BASE_URL=https://plexsub.yourdomain.com
PORT=5000
TRUST_PROXY_LEVEL=1
FORCE_SECURE_COOKIES=1
PLEXSUB_ALLOW_PRIVATE_TARGETS=0

APP_BASE_URL must match the actual public URL exactly.

TRUST_PROXY_LEVEL​

For a regular reverse proxy, use TRUST_PROXY_LEVEL=1. If there is no trusted proxy in front of PlexSub, use TRUST_PROXY_LEVEL=0.

Secure cookies​

When publishing over HTTPS, use FORCE_SECURE_COOKIES=1. When testing only on local HTTP, you can temporarily use FORCE_SECURE_COOKIES=0.

Your proxy should forward:

  • Host
  • X-Forwarded-For
  • X-Forwarded-Proto
  • X-Real-IP, if your proxy uses it

Nginx Proxy Manager​

  • Domain Names: your domain
  • Scheme: http
  • Forward Hostname/IP: the IP address or host name that runs PlexSub
  • Forward Port: 5000
  • Websockets Support: enabled, when available
  • SSL: a valid certificate
  • Force SSL: enabled

Cloudflare Tunnel​

Configure the tunnel to point to http://localhost:5000 or the appropriate internal service/IP.

Keep APP_BASE_URL set to the public HTTPS URL, TRUST_PROXY_LEVEL=1, and FORCE_SECURE_COOKIES=1.

Do not expose PostgreSQL​

Only publish PlexSub through the proxy. Do not expose PostgreSQL, unnecessary internal ports, or private dashboards without protection.

Validation​

  • Open the public URL.
  • Sign in.
  • Check the Customer Portal.
  • Confirm that there are no redirect loops.
  • Review logs.
  • Test from a phone outside your local network.

Common issues​

For a login loop, check APP_BASE_URL, HTTPS, cookies, proxy headers, and TRUST_PROXY_LEVEL.

For mixed content, use APP_BASE_URL=https://... and enforce HTTPS in the proxy.

Checklist​

  • The domain points to the proxy.
  • The SSL certificate is valid.
  • The proxy points to port 5000.
  • APP_BASE_URL uses HTTPS.
  • TRUST_PROXY_LEVEL=1.
  • FORCE_SECURE_COOKIES=1.
  • PostgreSQL is not exposed.