# Web server and reverse proxy

> Put nginx, Apache, Caddy or a Cloudflare Tunnel in front of FeatherPanel. What the proxy must forward, and which setups the installer writes for you.

Source: https://featherpanel.com/docs/panel/web-server/

In a Docker install the `frontendv2` container answers on host port `4831` (or the port you set) and serves the whole
panel: the Next.js pages and, through its own nginx, `/api`, `/attachments`, `/addons`, `/pma` and `/webmail` from the
backend. A reverse proxy on the host therefore needs one upstream: `http://127.0.0.1:4831`.

## What the proxy has to do

- Forward `Host`, `X-Forwarded-For`, `X-Forwarded-Proto` and `X-Real-IP`. The backend runs with
  `TRUST_PROXY_HEADERS=true` and takes the client address from these headers.
- Pass WebSocket upgrades (`Upgrade` and `Connection` headers) and keep long connections open.
- Accept large request bodies. The shipped nginx template allows 250 MB.
- Allow large response headers. Next.js sends long `Link` preload headers; nginx's default 4k/8k proxy buffers answer
  them with a 502.

## Pick a setup

| Setup | Written by the installer | Page |
|-------|--------------------------|------|
| nginx | Yes, from `.github/docker/{plaintext,ssl}/nginx.conf` | [nginx](https://featherpanel.com/docs/panel/web-server/nginx) |
| Apache | Yes, from `.github/docker/{plaintext,ssl}/apache2.conf` | [Apache](https://featherpanel.com/docs/panel/web-server/apache) |
| Caddy | No template in the repository | [Caddy](https://featherpanel.com/docs/panel/web-server/caddy) |
| Cloudflare Tunnel | Yes, `cloudflared` from Cloudflare's APT repository | [Cloudflare Tunnel](https://featherpanel.com/docs/panel/web-server/cloudflare-tunnel) |
| Direct access | Nothing to write: `http://YOUR_IP:4831` | For a home lab or tests only |

## Re-applying the installer templates

The installer's `Panel > Web Server` menu (Docker mode) has three actions:

- Reapply Nginx Config: downloads the latest template, keeps your domain, uses the SSL template when a certificate exists,
  and overwrites `/etc/nginx/sites-available/featherpanel` after taking a backup.
- Reapply Apache Config: the same for `/etc/apache2/sites-available/featherpanel.conf`.
- Patch Nginx Proxy Buffers Only: adds the larger proxy buffers to your existing site without replacing it. Use it when
  the panel returns 502 or "upstream sent too big header" after an update.