Reverse proxy and HTTPS

Auto Tournament serves the web app, the API and the live updates (WebSocket) on one port, 3069. To use a domain with HTTPS, put a reverse proxy in front of that port.

Point the domain at your machine

Create a DNS record for your domain, for example tournament.example.com, that points to the machine that runs Auto Tournament. Open ports 80 and 443 in the firewall.

Set up the reverse proxy

Use Caddy or nginx with the config below. Both forward the domain to 127.0.0.1:3069.

Set the public address

In .env, set FRONTEND_BASE_URL to the address people open in the browser:

.env

FRONTEND_BASE_URL=https://tournament.example.com

With an https:// address, login cookies are only sent over HTTPS.

Recreate the app container

docker compose up -d --force-recreate matchzy-tournament

Open Settings > Integrations & Webhooks > Webhook URL. The game servers must be able to reach this address. Change it to the new domain if it still shows the old address. Then click Retry on each server on the Servers page.

Caddy

Caddy gets a certificate for you:

Caddyfile

tournament.example.com {
    reverse_proxy 127.0.0.1:3069
}

nginx

/etc/nginx/sites-available/autotournament

server {
    listen 80;
    listen [::]:80;
    server_name tournament.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name tournament.example.com;

    ssl_certificate     /etc/letsencrypt/live/tournament.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/tournament.example.com/privkey.pem;

    client_max_body_size 0;

    location / {
        proxy_pass http://127.0.0.1:3069;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

X-Forwarded-Proto tells Auto Tournament that the page uses HTTPS. Without it, login can fail.
Upgrade and Connection let the live updates use WebSocket.
client_max_body_size 0 removes the upload limit. Demo files are large, and the nginx default of 1 MB blocks demo uploads.