Reverse proxy and HTTPS

If Ingle is reachable from anywhere but your own machine, put it behind a reverse proxy with HTTPS. The iPad needs HTTPS to install Ingle as a home-screen app, and sign-in cookies are only marked Secure over HTTPS.

Whichever proxy you use, it needs to:

• Pass X-Forwarded-Proto, so Ingle knows the request came over HTTPS. Caddy, Traefik and nginx’s usual config all do.
• Keep the Host header as the browser sent it. Most proxies do by default.
• Not buffer the live updates. See below.

Then set INGLE_TRUSTED_PROXIES to the proxy’s address. Ingle then believes the proxy’s X-Forwarded-For, so too many wrong passwords or codes block the device that tried them, not the whole house. Don’t trust addresses that aren’t proxies: anyone at a trusted address can claim to be anyone.

Caddy

• With Docker Compose: the deploy/ setup includes Caddy, with certificates from Let’s Encrypt through Cloudflare DNS. See Install.
• Installed natively: see Without Docker.

The site block is all Ingle needs:

ingle.home.example.com {
  tls {
    dns cloudflare {env.CLOUDFLARE_API_TOKEN}
  }
  encode zstd gzip
  reverse_proxy 127.0.0.1:8080
}

Other DNS hosts

Caddy supports many DNS providers through plugins (see caddy-dns). With Docker Compose, swap github.com/caddy-dns/cloudflare in caddy/Dockerfile for yours, change the dns line in Caddyfile to match, and pass that provider’s credentials instead of CLOUDFLARE_API_TOKEN. Natively, download a Caddy build with that plugin instead.

Traefik

If you already run Traefik with its Docker provider, add Ingle to the same Docker network and give it labels. This assumes an entrypoint called websecure and a certificate resolver called letsencrypt, so use your own names:

services:
  ingle:
    image: ghcr.io/lukeskelhorn/ingle:latest
    restart: unless-stopped
    environment:
      INGLE_TZ: Europe/London
      TZ: Europe/London
      # Traefik's address on the proxy network, or the network's range
      # if only Traefik and Ingle are on it.
      INGLE_TRUSTED_PROXIES: 172.30.50.0/24
    volumes:
      - ingle-data:/data
      - ./backups:/backups
    networks: [proxy]
    labels:
      traefik.enable: "true"
      traefik.http.routers.ingle.rule: Host(`ingle.home.example.com`)
      traefik.http.routers.ingle.entrypoints: websecure
      traefik.http.routers.ingle.tls.certresolver: letsencrypt
      traefik.http.services.ingle.loadbalancer.server.port: "8080"

networks:
  proxy:
    external: true

volumes:
  ingle-data:

Traefik sets X-Forwarded-Proto and streams the live updates without any extra settings. Run sudo chown 65532:65532 backups first, as in Install.

Traefik and Docker Engine 29

Traefik before v3.6 can’t talk to Docker Engine 29 or later, and logs “client version 1.24 is too old”. Use Traefik v3.6 or later.

nginx

location / {
    proxy_pass http://127.0.0.1:8080;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_read_timeout 1h;
}

Live updates

Every open board stays up to date through a server-sent event stream at /board/events. It’s a long-lived response that Ingle writes to as things change, with a keep-alive every 25 seconds. Your proxy mustn’t buffer it or time it out quickly:

• Caddy and Traefik stream it without any settings.
• nginx is told not to buffer it by the X-Accel-Buffering: no header Ingle sends. Keep proxy_read_timeout above 25 seconds.
• Cloudflare’s proxy (the orange cloud) isn’t needed for a home setup. Keep the record DNS only.

If the board only changes when you reload it, the stream is being buffered. You can check from a signed-in browser: /board/events should print : ping every 25 seconds.

Plain HTTP on the LAN

Ingle works over plain HTTP too, for example http://192.168.1.10:8080, without a proxy. The iPad won’t install it as an offline-capable app, and cookies aren’t marked secure, but everything else works.