Setup behind a reverse proxy

These examples assume you have an instance of Vikunja running on your server listening on port 3456. If you’ve changed this setting, you need to update the server configurations accordingly.

Whichever proxy you use, see Client IP addresses below so that Vikunja logs and rate limits the real client instead of the proxy.

NGINX#

You may need to adjust server_name and root accordingly.

server {
    listen       80;
    server_name  localhost;

    location / {
        proxy_pass http://localhost:3456;
        client_max_body_size 20M;
    }
}

NGINX Proxy Manager (NPM)#

Following the Docker Walkthrough guide, you should be able to get Vikunja to work via HTTP connection to your server IP.

From there, all you have to do is adjust the following things:

In docker-compose.yml#

1. Change VIKUNJA_SERVICE_PUBLICURL: to your desired domain with https:// and /.
2. Expose your desired port on host under ports:.

example:

  vikunja:
    image: vikunja/vikunja
    environment:
      VIKUNJA_SERVICE_PUBLICURL: https://vikunja.example.com/ # change vikunja.example.com to your desired domain/subdomain.
      VIKUNJA_DATABASE_HOST: db
      VIKUNJA_DATABASE_PASSWORD: secret
      VIKUNJA_DATABASE_TYPE: postgres
      VIKUNJA_DATABASE_USER: vikunja
      VIKUNJA_DATABASE_DATABASE: vikunja
      VIKUNJA_SERVICE_SECRET: <your-random-secret>
    ports:
      - 3456:3456 # Change 3456 on the left to the port of your choice.
    volumes: 
      - ./files:/app/vikunja/files
    depends_on:
      - db
    restart: unless-stopped

In your DNS provider#

Add an A record that points to your server IP.

You are of course free to change them to whatever domain/subdomain you desire and modify the docker-compose.yml accordingly.

(Tested on Cloudflare DNS. Settings are different for different DNS provider, in this case the end result should be vikunja.your-domain.com)

In Nginx Proxy Manager#

Add a Proxy Host as you normally would, and you don’t have to add anything extra in Advanced.

Under Details:

Domain Names:
    vikunja.your-domain.com
Scheme:
    http
Forward Hostname/IP:
    your-server-ip
Forward Port:
    3456
Cached Assets:
    Optional.
Block Common Exploits:
    Toggled.
Websockets Support:
    Toggled.

Under SSL:

SSL Certificate:
    However you prefer.
Force SSL:
    Toggled.
HTTP/2 Support:
    Toggled.
HSTS Enabled:
    Toggled.
HSTS Subdomains:
    Toggled.
Use a DNS Challenge:
    Not toggled.
Email Address for Let's Encrypt:
    your-email@email.com

Your Vikunja service should now work and your HTTPS frontend should be able to reach the API after docker-compose.

Apache#

Put the following config in /etc/apache2/sites-available/vikunja.conf:

<VirtualHost *:80>
    ServerName localhost

    <Proxy *>
      Require all granted
    </Proxy>
    ProxyPass / http://localhost:3456/
    ProxyPassReverse / http://localhost:3456/
</VirtualHost>

Note: The apache modules proxy, proxy_http and rewrite must be enabled for this.

Caddy#

Adjust the following Caddyfile to get Vikunja up and running:

vikunja.example.com {
    reverse_proxy 127.0.0.1:3456
}

Client IP addresses#

By default, Vikunja uses the TCP remote address of the incoming connection to identify a client. Behind a reverse proxy that address is the proxy itself, so every request is logged and rate limited as if it came from the proxy and the real client address is discarded.

To make Vikunja read the client address from the X-Forwarded-For header your proxy already sets, set the extraction method and list the addresses your proxy connects from:

service:
    ipextractionmethod: xff
    trustedproxies: 127.0.0.1/32,::1/128

The same via environment variables:

export VIKUNJA_SERVICE_IPEXTRACTIONMETHOD=xff
export VIKUNJA_SERVICE_TRUSTEDPROXIES=127.0.0.1/32,::1/128

X-Forwarded-For is only trusted when the request arrives from an address listed in trustedproxies, so a client that reaches Vikunja directly cannot forge it. See the service options for the full description, including the realip method.

This affects everything that acts on the client address, including the ratelimit options and Fail2Ban.