nginx
Static reverse proxy via a generated nginx.conf — HTTP on :80 when you bring your own TLS edge.
nginx is the classic static reverse proxy — a generated nginx.conf forwards to
app:6530 on the compose network. Right choice when TLS already terminates elsewhere
(Cloudflare, ALB, another edge) or you want a hand-edited config.
Quick start
Pin the proxy
images: {
proxy: "nginx:1.31-alpine",
},create-oke offers nginx in Add a reverse proxy…? (or --proxy nginx).
Include the proxy layer
docker compose -f docker-compose.yml up -dGenerated nginx.conf: upstream oke_app { server app:6530; } with
proxy_pass http://oke_app on :80. The app host port (6530) is unpublished —
traffic enters through the proxy.
Put TLS in front (optional)
Point Cloudflare / an ALB / another terminator at host :80, or switch the pin to
Caddy / Traefik when you want ACME inside Compose.
Required env
| Variable | Required? | Meaning |
|---|---|---|
OKE_PROXY_HOST | Optional | Documented for the proxy role; nginx listens on any Host (_) |
allowedHosts (config) | Production | Must include the public hostname — see Security |
Data and backup
| Volume / bind | Path | What it stores |
|---|---|---|
| Bind mount | ./nginx.conf → /etc/nginx/nginx.conf:ro | Generated site config |
Backup means: the nginx.conf is regenerated by oke docker. Keep overrides in
compose.override.yml or a replaced file if you customize routing.
Production note
nginx here is HTTP-only on port 80 — no ACME, no Docker service discovery. For
automatic HTTPS use Caddy. For --scale app=N use
Traefik.
Consequence: OKE_PROXY_URL is http://… for this recipe (Caddy / Traefik use
https://…).
Troubleshooting
You still have 6530:6530 on app. Confirm images.proxy is set and
oke docker regenerated compose so the app host bind was omitted.
The upstream is app:6530 on the oke network. Confirm the app service is healthy
and shares that network. Override nginx.conf only after checking the generated
upstream block.
Learn more
- Caddy — automatic HTTPS alternative
- Traefik — multi-replica discovery via Docker labels
- Security —
allowedHosts