How to reverse proxy frankenphp

[Asociateone]

I have both my development and production environments running on a single Digital Ocean droplet, using a Frankenphp image. To ensure the correct application is served, I've implemented Caddy.

Since Caddy handled SSL certificate creation, I disabled it within the Frankenphp image by setting SERVER_NAME: :80 in the compose.yaml file. When I visited example.com, it correctly displayed the Laravel default page, which was a good sign.

However, when I attempted to log in, the styling failed to load because the CSS and JavaScript files were being served over HTTP internally. Browsers like Google Chrome don't allow this behavior.

I attempted to resolve this issue by adding a global directive to the Caddyfile of my Caddy image, as suggested in the documentation. Unfortunately, this didn't work as expected. I also consulted the Caddy config documentation, but either my implementation was incorrect, or I misunderstood the instructions.

Does anyone have an idea on how to resolve this issue?

[withinboredom]

CSS and JS urls is not a caddy issue, but something with your configuration and/or app code

[Asociateone]

I believe it is.

The initial call arrives in Caddy, which then directs it toward the correct FrankenPHP image. However, this image operates on HTTP instead of HTTPS. Turning on HTTPS with FrankenPHP seems to disrupt their ability to communicate with each other (or so it appears). As I'm quite new to this, any thoughts or insights would be greatly appreciated. 😊

[withinboredom]

Heh. It isn't. I could probably write a book about the problem you are stuck on, and we have all been stuck on some version of this problem. I don't want to spoil it for you because it's a good learning experience for how the web works... but I will give you a direction.

I recommend reading up on https://laravel.com/docs/11.x/urls and note:

The generated URL will automatically use the scheme (HTTP or HTTPS) and host from the current request being handled

So you need to figure out one of two options:

1. How to keep the original https request to your application visible to your application. (Not sure how to do this with caddy tbh)
2. Manually set the application url in your env and do not rely on the request (this is more secure but depending on your application, may not be realistic).

[Asociateone]

Thank you :)

[larsverp]

Curious to know if you managed to keep the original https request to your application visible to your application in Caddy? Since I'm also going through some struggling with this issue 🧐

[Asociateone]

I'm still not a hero in this so, I will just post below what I did:

Your compose.yaml for your Caddy Reverse proxy container

networks:
  caddy:
services:
  caddy:
    image: caddy:latest
    restart: unless-stopped
    container_name: caddy
    ports:
      - 80:80 
      - 443:443
    volumes:
      - /home/name/caddy/Caddyfile:/etc/caddy/Caddyfile
      - /home/name/caddy/site:/srv
      - /home/name/caddy/caddy_data:/data
      - /home/name/caddy/caddy_config:/config
    networks:
      - caddy
volumes:
  caddy_data:
    external: true
  caddy_config:

Your CaddyFile for your Caddy reverse proxy container

yoururl.com {
    reverse_proxy yourfrankenphpcontainername:80 // Or 8000 if you use Octane
}
dev.yoururl.com {
    reverse_proxy devyourfrankenphpcontainername:80 // Or 8000 if you use Octane
}

Your compose.yaml for running frankenphp

Ensure that you do not serve your FrankenPHP container over HTTPS, if you do the application will throw a 500 error.

services:
  frankenphp:
    container_name: yourfrankenphpcontainername
    restart: always
    build:
      context: .
    entrypoint: php artisan octane:frankenphp --max-requests=1 # remove this line if you do not use octane
    networks:
      - caddy_network # this is the network from the Caddy reverse proxy network
    volumes:
      - .:/app
    environment:
      SERVER_NAME: :80 # make sure it does not serve over HTTPS because the reverse proxy already fixes this for you
volumes:
  caddy_data:
  caddy_config:
networks:
  caddy_caddy:
    external: true

I don't need to specify internal ports for Caddy to communicate with the container, it automatically uses the container's internal ports (either 80 or 8000 for Octane).

Your Laravel application

To ensure that your application runs over HTTPS, add this to your AppServiceProvider.php:

public function boot(): void
{
    URL::forceScheme('https');
}

[dunglas]

Another (cleaner) option would be to use trusted headers:

1. Set the IP of the reverse proxy to trust using the trusted_proxies directive in the FrankenPHP Caddyfile
2. Add the IP of the reverse proxy in your Laravel or Symfony config (Laravel is using Symfony under the hood for this), and mark X-Forwarded-Proto, X-Forwarded-For and X-Forwarded-Host (they are set by default by Caddy) as trusted headers: Laravel docs / Symfony docs

Alternatively, Caddy supports the Proxy Protocol. To enable this feature:

1. Enable the proxy protocol at the reverse proxy level using the proxy_protocol option of the http transport
2. Enable the proxy_protocol listener wrapper in FrankenPHP

Using the proxy protocol is less popular but has the advantage of not requiring to configure the PHP app itself.

Both options have the advantage of also preserving the original Host and IP in addition to the scheme.

[7system7]

I have the same problem. It seems it is an impossible mission... so frustrating. I spent long hours to handle this problem this. (3rd time... it is around net 19 hours) And ZERO success. 😆 It seems, my 15+ years of experience is not enough to set up a single Symfony-MariaDB-FrankenPHP config under reverse proxy. So sad. Although, this is just further proof that I am more of a developer than a devops.

The FrankenPHP seems a very good project and idea but under reverse proxy it is real impossible to configure. I maintain 12 projects but I can run only 2 of them w/ FPHP, because they can be reached through the VPS and wired directly to the FrankenPHP container. All others should be run under reverse proxy.

Anyway, I would share my config, if a miracle happens, and there is a genius who can find my failure through them. Please do not hesitate to educate me. I would like to share the most relevant parts.
Meanwhile, I use a native Caddy-PHP-FPM solution instead this. Its configuration can takes 2 or maximum 5 minutes. 😢

---

Rant is over.

This is an old (old but not legacy, React v19, PHP 8.4.* and Symfony 7.2.*) project, and I have a CI/CD script (Gitea Actions) for releasing it. I would be soooo good to use under FrankenPHP. (And the other 12 projects)

My FrankenPHP's Caddyfile

{
	frankenphp
	email "<email-address>"
	servers {
		trusted_proxies static 0.0.0.0/0
	}
}

http://{$APP_DOMAIN} {
	root * /app/public
	encode zstd br gzip
	php_server
	vulcain

	route /.well-known/mercure {
            ...<mercure-config>
	}
}

My Symfony's .env file

###> symfony/framework-bundle ###
APP_ENV=dev
APP_SECRET=<secret>
APP_VERSION=2024.4.0
APP_DOMAIN=127.0.0.1
APP_NAME=natur-api
TRUSTED_PROXIES=127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
###< symfony/framework-bundle ###

###> doctrine/doctrine-bundle ###
DATABASE_HOST=127.0.0.1                          <--- Yeah, I know, this should be the docker container's name, (db) but that does not work too.
DATABASE_DB=natur-api
DATABASE_USER=natur-user
DATABASE_PASSWORD=<pass>
DATABASE_URL=mysql://${DATABASE_USER}:${DATABASE_PASSWORD}@${DATABASE_HOST}:7306/${DATABASE_DB}?serverVersion=11.7.2-MariaDB
###< doctrine/doctrine-bundle ###

Projects Dockerfile

FROM dunglas/frankenphp:1

COPY . /app
COPY --link bin/docker/Caddyfile /etc/caddy/Caddyfile

RUN cp $PHP_INI_DIR/php.ini-production $PHP_INI_DIR/php.ini
RUN cp bin/docker/php.ini-production $PHP_INI_DIR/conf.d/custom-php.ini
RUN install-php-extensions \
	@composer \
	pdo_mysql \
	gd \
	mbstring \
	bcmath \
	intl \
	zip \
	opcache \
	apcu \
	iconv

ENV COMPOSER_ALLOW_SUPERUSER=1
ENV APP_RUNTIME=Runtime\\FrankenPhpSymfony\\Runtime
ENV FRANKENPHP_CONFIG="worker ./public/index.php"

The Docker's compose.yaml

services:
  db:
    # @see https://hub.docker.com/_/mariadb
    image: mariadb:11.7.2
    restart: always
    healthcheck:
      test: [ "CMD", "healthcheck.sh", "--connect", "--innodb_initialized" ]
      start_period: 10s
      interval: 10s
      timeout: 5s
      retries: 3
    container_name: '${APP_NAME}-db'
    environment:
      - MARIADB_ROOT_PASSWORD=${DATABASE_PASSWORD:-!ChangeMe!}
      - MARIADB_DATABASE=${DATABASE_DB:-app}
      - MARIADB_USER=${DATABASE_USER:-app}
      - MARIADB_PASSWORD=${DATABASE_PASSWORD:-!ChangeMe!}
    ports:
      - "7306:3306"
    volumes:
      - database:/var/lib/mysql:rw
    networks:
      - natur_api_network
  api:
    # @see https://source.splendidbear.org/NaturAgro/api
    # @see https://hub.docker.com/r/dunglas/frankenphp
    image: dunglas/frankenphp:1-alpine
    build: .
    restart: always
    container_name: '${APP_NAME}-app'
    environment:
      - APP_DOMAIN=${APP_DOMAIN}
      - MERCURE_PUBLISHER_JWT_KEY={$MERCURE_PUBLISHER_JWT_KEY}
      - MERCURE_SUBSCRIBER_JWT_KEY={$MERCURE_SUBSCRIBER_JWT_KEY}
    ports:
      - "7080:80"
      - "7443:443"
      - "7443:443/udp"
    volumes:
      - ./:/app
      - /var/storage/storage:/app/public/storage
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      db:
        condition: service_healthy
    networks:
      - natur_api_network
volumes:
  caddy_data:
  caddy_config:
  database:
networks:
  natur_api_network:

This is the host's Caddyfile. Yes, it is just developer environment. The commented sections have been worked as expected for 10 years.
And yes, I have the /etc/hosts config w/ 127.0.0.1 natur-exp.local

natur-exp.local {
	# route {
	# 	root * /var/www/natur-api/public
        #
	#         encode zstd gzip
	#         php_fastcgi unix//run/php-fpm/php-fpm.sock
	#         file_server
	# }

	reverse_proxy localhost:7080

	log {
	       output file /var/log/caddy/natur-api.access.log {
		        roll_size 3MiB
	                roll_keep 5
	                roll_keep_for 48h
	       }
	       format console
	}
}

[7system7]

5 minutes later after this post, I made the miracle. This is the magic:

My FrankenPHP's Caddyfile

...
	servers {
		trusted_proxies static 0.0.0.0/0
	}
}

 - http://{$APP_DOMAIN} {                                              <--- Magic #1
 + {$APP_DOMAIN} {
	root * /app/public
	encode zstd br gzip
	php_server
	vulcain
...

.env file

...
APP_ENV=dev
APP_DEBUG=1
APP_SECRET=53a5c55b59585104026e98ae502bff4a
APP_VERSION=2024.4.0
 - APP_DOMAIN=127.0.0.1                                              <--- Magic #2
 + APP_DOMAIN=:80 
APP_NAME=natur-api
TRUSTED_PROXIES=127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
...

---

Then voila! Currently, the second problem is that, the MariaDB cannot reachable from the FrankenPHP's container. From outside it works flawlessly.

Even if I change the related .env variable to this:

DATABASE_URL=mysql://${APP_DB_USER}:${APP_DB_PASSWORD}@db:7306/${APP_DB_DB}?serverVersion=11.7.2-MariaDB

The theory is that db is an alias in docker containers that are on the same network. But somehow this not working too. Meanwhile the config seems OK.

$ docker inspect natur-api-db
...
            "Networks": {
                "natur-api_natur_api_network": {
                    "IPAMConfig": null,
                    "Links": null,
                    "Aliases": [
                        "natur-api-db",
                        "db"
                    ],

[7system7]

OK. So, another reason to never start a project w/ the MariaDB/MySQL. Guys! Please, do not be as dumb as me 5 years ago... use PostgreSQL instead!

---

In MariaDB's container you cannot easily change the port only w/ docker config

       ports:
      - "7306:3306"

So, you need this .env var too

    environment:
      - MARIADB_TCP_PORT=7306

---

After 1,5 days I have a working environment.

[Elemtro]

I actually debugged this for 12 hours straight and IMO read whole internet in order to find a solution. Your actually didn't help here and I wnat to ask a question or request to help. I have proxy nginx that proxy pass to docker container localhost:8080, what should I do here?
`{
servers {
trusted_proxies static 0.0.0.0/0
}
{$CADDY_GLOBAL_OPTIONS}

frankenphp {
	{$FRANKENPHP_CONFIG}

	worker {
		file ./public/index.php
		env APP_RUNTIME Runtime\FrankenPhpSymfony\Runtime
		{$FRANKENPHP_WORKER_CONFIG}
	}
}

}

{$CADDY_EXTRA_CONFIG}

poland.1.dn.ua {
log {
{$CADDY_SERVER_LOG_OPTIONS}
# Redact the authorization query parameter that can be set by Mercure
format filter {
request>uri query {
replace authorization REDACTED
}
}
}

root /app/public
encode zstd br gzip

mercure {
	# Publisher JWT key
	publisher_jwt {env.MERCURE_PUBLISHER_JWT_KEY} {env.MERCURE_PUBLISHER_JWT_ALG}
	# Subscriber JWT key
	subscriber_jwt {env.MERCURE_SUBSCRIBER_JWT_KEY} {env.MERCURE_SUBSCRIBER_JWT_ALG}
	# Allow anonymous subscribers (double-check that it's what you want)
	anonymous
	# Enable the subscription API (double-check that it's what you want)
	subscriptions
	# Extra directives
	{$MERCURE_EXTRA_DIRECTIVES}
}

vulcain


{$CADDY_SERVER_EXTRA_DIRECTIVES}

# Disable Topics tracking if not enabled explicitly: https://github.com/jkarlin/topics
header ?Permissions-Policy "browsing-topics=()"

@phpRoute {
	not path /.well-known/mercure*
	not file {path}
}
rewrite @phpRoute index.php

@frontController path index.php
php @frontController

file_server {
	hide *.php
}

}
And here is nginx config:server {

if ($host = poland.1.dn.ua) {

    return 301 https://$host$request_uri;

} # managed by Certbot



if ($host = ftp.poland.1.dn.ua) {

    return 301 https://$host$request_uri;

} # managed by Certbot



listen 80;

server_name poland.1.dn.ua ftp.poland.1.dn.ua;  # Handle both domains

return 301 https://$host$request_uri;

}

HTTPS server for poland.1.dn.ua

server {

listen 443 ssl;

server_name poland.1.dn.ua;

ssl_certificate /etc/letsencrypt/live/ftp.poland.1.dn.ua/fullchain.pem; # managed by Certbot

ssl_certificate_key /etc/letsencrypt/live/ftp.poland.1.dn.ua/privkey.pem; # managed by Certbot



location / {

    proxy_pass http://localhost:8080;  # Change this to your C# app's port

    proxy_set_header Host $host;

    proxy_set_header X-Real-IP $remote_addr;

    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    proxy_set_header X-Forwarded-Proto $scheme;

}


access_log off;

error_log /var/log/nginx/error.log error;

}

HTTPS server for ftp.poland.1.dn.ua

server {

listen 443 ssl;

server_name ftp.poland.1.dn.ua;

ssl_certificate /etc/letsencrypt/live/ftp.poland.1.dn.ua/fullchain.pem; # managed by Certbot

ssl_certificate_key /etc/letsencrypt/live/ftp.poland.1.dn.ua/privkey.pem; # managed by Certbot



location / {

    proxy_pass http://localhost:8081;  # Change this to your other Docker container's port

    proxy_set_header Host $host;

    proxy_set_header X-Real-IP $remote_addr;

    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    proxy_set_header X-Forwarded-Proto $scheme;

}


access_log off;

error_log /var/log/nginx/error.log error;

} `

[zuhrrl]

I was stressed for like 6 hours because of the Caddyfile setup. Uploading files in my Filament app kept failing with a 401 error, even though it works fine in my local development. So, here’s my Caddyfile setup and a working Docker Compose for anyone who wants to set up Apache2 + FrankenPHP + Filament Laravel.

Caddyfile

{
    auto_https prefer_wildcard
    order php_server before respond
}

:80 {
    root * /app/public
    encode zstd gzip
    php_server
    file_server

    try_files {path} /index.php

    @php {
        path_regexp php ^/index\.php$
    }
    handle @php {
        php_server {
            env HTTPS on
            env HTTP_X_FORWARDED_PROTO on
            env TRUSTED_PROXIES 127.0.0.1,172.16.0.0/12
        }
    }

    header {
        X-Frame-Options DENY
        X-Content-Type-Options nosniff
        Referrer-Policy no-referrer-when-downgrade
    }
}

**compose.yaml**

`servicename:
    restart: always
    container_name: backend-container-name
    image: dunglas/frankenphp
    ports:
      - "1003:80"
    env_file:
      - .env
    command: sh -c "frankenphp run"
    volumes:
      - .:/app
      - ./Caddyfile:/etc/caddy/Caddyfile
    networks:
      - custom-network

then run docker compose up and I think now is working, Thanks for this discussion!

[henderkes]

I was stressed for like 6 hours because of the Caddyfile setup. Uploading files in my Filament app kept failing with a 401 error, even though it works fine in my local development. So, here’s my Caddyfile setup and a working Docker Compose for anyone who wants to set up Apache2 + FrankenPHP + Filament Laravel.

I think you can minify your Caddyfile a little. Since you're only using http, you don't need a prefer_wildcard option. php_server is automatically ordered before respond.

{
        servers {
                trusted_proxies static 217.160.208.92
        }
}

:80
root * /app/public
encode zstd gzip

try_files {path} /index.php
php_server

header {
    X-Frame-Options DENY
    X-Content-Type-Options nosniff
    Referrer-Policy no-referrer-when-downgrade
}