The_Great_Archive/ArchiveBox
1
0
Fork 0
mirror of https://github.com/ArchiveBox/ArchiveBox.git synced 2026-09-12 19:50:57 +05:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

Keep direct HTTP local behind HTTPS ingress

Browse Source
This commit is contained in:
Nick Sweeting 2026-08-01 23:39:07 -07:00
parent d327c027ef
commit 76439088ee
3 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
archivebox/tests/test_server_security_browser.py
View File

@ -724,6 +724,7 @@ def test_unconfigured_public_host_superuser_can_reach_setup_wizard(tmp_path: Pat
archivebox_environment = compose["services"]["archivebox"]["environment"]
assert "BASE_URL" in archivebox_environment
assert "SERVER_SECURITY_MODE" in archivebox_environment
assert compose["services"]["archivebox"]["ports"] == ["${ARCHIVEBOX_PORT:-8000}:8000"]
assert "--entrypoints.websecure.http.tls=true" in compose["services"]["traefik"]["entrypoint"][-1]

3
docker-compose.yml
View File

@ -16,7 +16,7 @@ services:
archivebox:
image: ${ARCHIVEBOX_IMAGE:-archivebox/archivebox:dev}
ports:
- 8000:8000
- "${ARCHIVEBOX_PORT:-8000}:8000"
volumes:
- ./data:/data
# Override abx-dl's nested VOLUME so profiles persist across containers.
@ -82,6 +82,7 @@ services:
# .env file next to this one, then `docker compose up -d`). Both want:
# BASE_URL=https://archive.example.com
# SERVER_SECURITY_MODE=safe-subdomains-fullreplay
# ARCHIVEBOX_PORT=127.0.0.1:8000 # keep direct HTTP local; expose only the ingress publicly
### Option A — Cloudflare Tunnel (no public IP / behind NAT, e.g. home/NAS).
# Cloudflare's edge terminates TLS and resolves *.your.domain to a SINGLE tunnel;

2
docs/Docker.md
View File

@ -178,7 +178,7 @@ If you want to access your archive server with HTTPS, the bundled `docker-compos
- `COMPOSE_PROFILES=https` runs Traefik in front of ArchiveBox for HTTPS/TLS, with optional wildcard certificates via DNS-01.
- `COMPOSE_PROFILES=tunnel` runs a Cloudflare Tunnel for deployments without a public IP.
Set `BASE_URL=https://archive.example.com` in the `.env` file next to `docker-compose.yml`, then follow the inline comments in the compose file for the profile you choose. You can still bring your own reverse proxy such as Nginx or Caddy in front of `http://127.0.0.1:8000`; [`etc/nginx.conf`](https://github.com/ArchiveBox/ArchiveBox/blob/dev/etc/nginx.conf) remains a standalone example.
Set `BASE_URL=https://archive.example.com` and `ARCHIVEBOX_PORT=127.0.0.1:8000` in the `.env` file next to `docker-compose.yml`, then follow the inline comments in the compose file for the profile you choose. The localhost port binding prevents direct HTTP access from bypassing the public HTTPS ingress. You can still bring your own reverse proxy such as Nginx or Caddy in front of `http://127.0.0.1:8000`; [`etc/nginx.conf`](https://github.com/ArchiveBox/ArchiveBox/blob/dev/etc/nginx.conf) remains a standalone example.
<br/>