Behind a reverse proxy

If a web server (a reverse proxy) already uses ports 80 and 443 on your server, you put Bekci behind it: the proxy provides HTTPS and forwards requests to Bekci. If you use Coolify, follow the Coolify guide instead of this page.

Whichever proxy you use, it must do the following for Bekci to work properly:

1. Run Bekci so it only listens locally#

If the proxy is on the same server, publish Bekci's port on 127.0.0.1 only; that way nobody can reach Bekci from outside by going around the proxy. With Docker Compose:

name: bekci
services:
  bekci:
    image: kadirsungurlu/bekci:latest
    restart: unless-stopped
    stop_grace_period: 30s
    ports:
      - "127.0.0.1:8080:8080"   # reachable from this server only
    environment:
      BASE_URL: https://bekci.example.com
      TZ: Europe/Istanbul
    volumes:
      - bekci-data:/data
volumes:
  bekci-data:

cd /opt/bekci
docker compose up -d

BASE_URL must be the HTTPS address the panel will be opened at. (If you use Traefik with Docker labels, use the file from the Traefik tab below instead.)

2. Configure the proxy#

Pick the tab for your proxy. Each tab shows where the file goes, its full content and how to apply it.

nano /etc/nginx/sites-available/bekci

server {
    listen 80;
    listen [::]:80;
    server_name bekci.example.com;

    # Large files for backup restores and Uptime Kuma imports
    client_max_body_size 200m;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Connection "";

        # Live updates (SSE): pass through unbuffered, don't cut the long connection
        proxy_buffering off;
        proxy_cache off;
        proxy_read_timeout 1h;
    }
}

ln -s /etc/nginx/sites-available/bekci /etc/nginx/sites-enabled/bekci
nginx -t
systemctl reload nginx

name: bekci
services:
  bekci:
    image: kadirsungurlu/bekci:latest
    restart: unless-stopped
    stop_grace_period: 30s
    environment:
      BASE_URL: https://bekci.example.com
      TZ: Europe/Istanbul
    volumes:
      - bekci-data:/data
    networks:
      - proxy
    labels:
      - traefik.enable=true
      - traefik.http.routers.bekci.rule=Host(`bekci.example.com`)
      - traefik.http.routers.bekci.entrypoints=websecure
      - traefik.http.routers.bekci.tls.certresolver=letsencrypt
      - traefik.http.services.bekci.loadbalancer.server.port=8080
networks:
  proxy:
    external: true
volumes:
  bekci-data:

cd /opt/bekci
docker compose up -d

a2enmod proxy proxy_http headers

nano /etc/apache2/sites-available/bekci.conf

<VirtualHost *:80>
    ServerName bekci.example.com

    ProxyPreserveHost On
    ProxyRequests Off
    RequestHeader set X-Forwarded-Proto expr=%{REQUEST_SCHEME}

    # Live updates (SSE): pass through immediately, don't cut the long connection
    ProxyPass        / http://127.0.0.1:8080/ flushpackets=on timeout=3600
    ProxyPassReverse / http://127.0.0.1:8080/
</VirtualHost>

a2ensite bekci
apachectl configtest
systemctl reload apache2

nano /etc/caddy/Caddyfile

bekci.example.com {
	encode zstd gzip
	reverse_proxy 127.0.0.1:8080 {
		# Live updates (SSE): pass through without buffering
		flush_interval -1
	}
}

caddy validate --config /etc/caddy/Caddyfile
systemctl reload caddy

3. Verify#

1. Open https://bekci.example.com in your browser and sign in (if it's the first time, create your admin account on the Welcome screen).
2. Test live updates: add a monitor with a short check interval (e.g. 20 seconds) and stay on the monitor list. After every check, the monitor's status bars and response time should update without reloading the page.

Trusted proxy (TRUSTED_PROXY)#

Bekci only believes the client address in the X-Forwarded-For header if the connection delivering the request comes from a trusted address. By default all private (10.x, 172.16–31.x, 192.168.x) and local (127.x) addresses are trusted; if the proxy runs on the same server or in the same Docker network, no setting is needed.

To be stricter, list the trusted networks in the TRUSTED_PROXY environment variable, separated by commas, e.g. TRUSTED_PROXY=172.17.0.1/32. When it's set, only headers from these networks are trusted.

Common problems#

Live updates don't arrive, “Offline” notice#

The proxy buffers the /api/events response or cuts the connection early. Check these lines in the configurations above: proxy_buffering off and proxy_read_timeout for Nginx, flushpackets=on for Apache, flush_interval -1 for Caddy. If there's another layer in between, such as Cloudflare, it mustn't buffer the connection either.

502 Bad Gateway#

The proxy can't reach Bekci. Is Bekci running (docker compose ps), is the port right (curl http://127.0.0.1:8080/healthz)? With Traefik, Bekci and Traefik must be on the same Docker network.

“413 Request Entity Too Large” when importing#

The proxy's request body limit is too low. In Nginx add client_max_body_size 200m;.

I sign in but get signed out right away, or an endless redirect#

The X-Forwarded-Proto header isn't passed or is wrong. If the proxy terminates HTTPS, the header must be https. If you use Cloudflare, set the SSL/TLS mode to Full (strict); Flexible mode causes a redirect loop.

The address in notifications and agent commands is wrong#

BASE_URL isn't set or is wrong. Set it to the https:// address the panel is opened at and recreate the container (docker compose up -d).