[Bug]: Docker Compose without Caddy

[PP-JN-RL]

Issue Description

I'm looking to get OpenSign working without Caddy, so we can use our own proxy.
Does anyone have a working example of a docker compose file?

I managed to get the Client and Server running fine, but there seems to be an issue with defining the API endpoint for the client. It looks like the API on the server is running on localhost:8080/app but the client requests localhost:8080/api/app and I cant seem to change that.

Here is the docker compose file:

services:
  server:
    image: opensign/opensignserver:main
    container_name: OpenSignServer-container
    volumes:
      - opensign-files:/usr/src/app/files
    ports:
      - "8080:8080"
    depends_on:
      - mongo
    env_file: .env.prod
    environment:
      - NODE_ENV=production
      - SERVER_URL=http://localhost:8080/app
      - PUBLIC_URL=http://localhost:3000

  mongo:
    image: mongo:latest
    container_name: mongo-container
    volumes:
      - data-volume:/data/db
    ports:
      - "27018:27017"

  client:
    image: opensign/opensign:main
    container_name: OpenSign-container
    depends_on:
      - server
    env_file: .env.prod  
    ports:
      - "3000:3000"

volumes:
  data-volume:
  opensign-files:

and here is the .env file:

PUBLIC_URL=http://localhost:3000
GENERATE_SOURCEMAP=false
# REACT_APP_SERVERURL=http://localhost:8080/app
# (DEPRECATED) This should not be changed if provided; it should be 'opensign'.
REACT_APP_APPID=opensign
appName=open_sign_server
MASTER_KEY=XnAadwKxxByMr
MONGODB_URI=mongodb://mongo-container:27017/OpenSignDB
PARSE_MOUNT=/app
SERVER_URL=http://localhost:8080/app

SMTP_ENABLE=true
SMTP_HOST=test.test
SMTP_PORT=25
SMTP_USER_EMAIL=test@test
SMTP_PASS=

PFX_BASE64='MIIKCQIBAzCCCc8GCSqGSIb3DQEHAaCCCcAEggm8MIIJuDCCBG8GCSqGSIb3DQEH
BqCCBGAwggRcAgEAMIIEVQYJKoZIhvcNAQcBMBwGCiqGSIb3DQEMAQYwDgQIpumu
bFabBWACAggAgIIEKDqHS7Icd5MzIBk1dBokGK2s+5a2fA4308WA1QzEWmczqVYI
z6lYmW8qsiZIw4PFkRzdIx1+zCmP8jgWiiqh5RKnbHYmh1JPNyx9SqmUDILDXmjg
KxO9agRw9LXge4hgRL7YW0TxYZYw4EeXV9Yr7kcOq9DoO2MoRikJ+2Tuvvq/hfuV
9zFHsz4jpf7W95k1IeH6bZ92klz5R1e/EK8JuHy592i/u+BxxW1vTkiPpTaHD6s9
1lDSkT1j0LIDU6l9gVvJvFBV8j88vet/Z4QkTbHPMYvBnKNRstKuOvDasEJE4RkA
PV4TfBwFF6uvREZI1vBboM/18pzeyjoRX+mlJNfcH3kh1tkck+Jg+M2bLXAH1EdD
GRwENvnTNW1CFIn37VVja7SFBQNXA+E6rejmqtUmZ5XktSINDBUyjow9XuYTUtI/
sgcRSC0aB0EKKpphbFPp1niKCLm1ef33e+bWyWbtR2L2Kc3ETmhjNADpyapAGmzc
LP2BafGaKj18KiLAG4GL6+kXk0GUz7Fw5q8H8RY1T33o+xjWvC0+aJgvr65qWdKw
+ug6wuu4Cr2kFEuXxPKsnYqmE5NT/x+lfunlZ5iEQN3w2XO5J2u2eMXVRUsPH2T6
0sJKomjY0RB1JsqZBnyleWm+tYo0RpVAyJ3NGBp9dVb7a3Qw6jNZBG/xMW+gvtUJ
q6hfK/cD3cagD0NQFVD5STMOuGOSqq/bbwAKjZ/lrPmCCYATKwkjAFybYfHJVrrW
Y2tQgCQ/zrZLIxQjp7F17hU0+gT54x0MpF6AoqIM/qqNnHrQ0fi50ECmLvx3SqYa
nvjvt/HZhMZfqRXiXjeicIwpnNoG7+uQknySk+7cc9GNhHZR7cfPfkTpgvuuebrQ
l5YW+k9tG+xrX8g72nvtFMnammlBixlFwECJaEszEQk5tc2ti8uG2z+kGnFoDoBV
M6ZVMpKDJzXPxLdzT6ChIPyatjIkqOKe6vDpnmzcoEhbBhmtkVjWFA2dfX846ugV
y1QiecWgk8pMNWhh3IDd05v/wzbFwNcq+Gi+1dZsPmFH+egIcrQKZu2r3jCJtGHh
DNG/nyf/anqvKXF90bi4hRT3vdDXXuWgY7EUwfn9h5jYabCO6HsQxQOBjFYNmBrh
MfaiBZe72E8fzNAfIlwDcJ4AWY1SOM7hi8bqfRWw1NtNxuMUiRFoR31O6XkQauye
9hAmpdlZHZXtJ6LM0QaWkPJmG3058GMtIn/qS60V9nINh+zXhwza/1pnFB+e9MWc
hAPgo0nn55FusM//g1nM31PKe+nOm3Jyp0nEQ4m8aDtJS63o2fvp3e2KJbPWQMHE
a83W975diWg4NTdevV9lFpNllHclVoPoavUHIzHd7HF9TcPpjbXJSUZ7cITHHefr
kQTa/2G9cWuRhN9GKIHBdr13nfEvMIIFQQYJKoZIhvcNAQcBoIIFMgSCBS4wggUq
MIIFJgYLKoZIhvcNAQwKAQKgggTuMIIE6jAcBgoqhkiG9w0BDAEDMA4ECDgnjfOf
AjArAgIIAASCBMgkbVuptroBdyMY5gl/eBQj5+iAV02YSaF969ihStLSWI4x5FAf
HuDgqCyEMSl4RHG8ZvNaO9JoNfIpMK/TPQBoQRCzE2Vjf66VTERaQtU6h7tZrbQt
K96n9eqvohm/vXbXe08fsodYp2s79kAvKgpuGG5iX77qYVzJHBPed87cvczo4ToP
CpurDpByt8fGEmjtcikal8o+H9uoHjcFwqMigX1Q7IEjuKXrb5e6wTvxMRob8yfv
LVl6ahteKSkWCMb6rLZ5f12jDoCGX/YXRrSsU9t/lXe0Nxv5i7c8flb2EsNtwygD
fexVvn5u6ble6RDYNpuQkPgF41HyZh+JvGAF6i1r4tJPL9Pf4HnjEB8Y8IHgon+w
T5I+8LTgcrWyhptzblXMjKySTEp9OEa2cCVwZkl4z43PWJ5oIAQ2IDTOQ603/5o/
d9KA76/zMPQ5O0gv17OA7kwFv98v6sTcR4vgkQZqnyDpJSEPHyNxhw2MSBqS3jq3
YPhRz+3Ei1oFp9uYFhzn39f9gzNi++X9pOjSrDb8v3mcDXZKNrxQLuoRMSf0eQNI
dgJRqj/fuqNZ5ac3kd4P5BALCsnA1tM27zYrgUdpOnrc2D9FBthEjpRlQKMMzhQf
cNMFWmoNjakDilvvLcsQeQ3P6cXbN1ODoNnjgK3VzcmeKyzW2PrTXEPHARUM3j4V
sZzGaUOVKLqaaDrXWQKC0vrTvxP2WMfjQ1dTdXQP/kSZTXRC5rtB9tky38flBor0
N9rhUDIGMs5qBvyrkV2hKXiW39G69p1KWY+Cw28AzY+CNSjePRi60TsnUxgcOS7i
0AT25Gx3A4YqxmTY38MPB4wPcBPcw4hjNoQamaC9mqs+KVHcP5YHUlqykMeH0YVi
J+ehytJE9xuDcfBOjxjadxp3/q/Lku4rky89gdJGFQWuuz75VulDywPRZRwmQTel
sjEGMHR1zTOlPJdTDWhqaKmWvL4GhbCgEPIKwmqd1QKRTl/3Baa1nYllJeYVwiTT
qLCkbA6qXrLGj1ENZxrKn9yqr8HwOoApjwhARu4LF/BRMgdkzelK2kOXHnZ26sZ2
NY/MMtVmq4c59y6iQwmsbHr9tWGz3ahyXcZZufjNXU/AVnO1c92g7umAWZF4RohL
gMmh57cAhN9PEbEv6j/6BT3XXp8jB0ywcRriYxfxwidviCKH/76Q4sytYJQaDFI1
fnzmv0aDotbG2BdpWSiYPDOPm+3cmfjlULsn1FYWL4NDCX1f+C4lNtKVX9LU8c5M
m8dA1DUlDfnuNO5/BShuoGXG2z4O/XwxIaRFizMxWS2sWurbAEFJ6oNw3kC7WSah
NIe8aUC1umpc1Gk3X2f4Ytzj9OEqn0y55qoqLINJuejXMffF/gjopxHWadLVaVaj
Q1SewrECuEXdSbBR/a10po24wmRtkmlvRJXJl7sG95xE5ZCqp+m6sRPWGdf1yKbV
vyWNUe4Qvkxe4a0VAJpTyIGr980CKz/jkvtNQMobGl7AfhxKJ450wg454WcexMct
BYXvZMSdUDCgMLlh0nHJHl5btrFWqE0Z/fqWmIknZL2jZ4J+2hdVl/xB/sUt6kcu
txw+RfL+vNE8PxhTNaOdJFwD8yeN1mJ3yMUA8HHYpw9yljgxJTAjBgkqhkiG9w0B
CRUxFgQUDYlgGVxSxuOknhQc256x3++7BDwwMTAhMAkGBSsOAwIaBQAEFFjASdYl
3pXAXxZuvVvv9tsb4bdrBAhyb+KCIjp/gAICCAA='

PASS_PHRASE=opensign 

# (DEPRECATED) This should not be changed if provided; it should be 'opensign'.
APP_ID=opensign

Expected Behavior

No response

Current Behavior

No response

Steps to reproduce

No response

Screenshots of the issue(optional)

Here is the error log from docker:

OpenSign-container        |  HTTP  4/10/2025 8:55:32 AM 172.19.0.1 GET /
OpenSign-container        |  HTTP  4/10/2025 8:55:32 AM 172.19.0.1 Returned 304 in 1 ms
OpenSign-container        |  HTTP  4/10/2025 8:55:32 AM 172.19.0.1 GET /static/js/main.3b4e3a7c.js
OpenSign-container        |  HTTP  4/10/2025 8:55:32 AM 172.19.0.1 Returned 304 in 1 ms
OpenSign-container        |  HTTP  4/10/2025 8:55:32 AM 172.19.0.1 GET /static/css/main.a6e623cd.css
OpenSign-container        |  HTTP  4/10/2025 8:55:32 AM 172.19.0.1 Returned 304 in 1 ms
OpenSign-container        |  HTTP  4/10/2025 8:55:32 AM 172.19.0.1 GET /locales/en-GB/translation.json
OpenSign-container        |  HTTP  4/10/2025 8:55:32 AM 172.19.0.1 GET /locales/en/translation.json
OpenSign-container        |  HTTP  4/10/2025 8:55:32 AM 172.19.0.1 Returned 304 in 0 ms
OpenSign-container        |  HTTP  4/10/2025 8:55:32 AM 172.19.0.1 Returned 304 in 1 ms
OpenSign-container        |  HTTP  4/10/2025 8:55:32 AM 172.19.0.1 GET /favicon.ico
OpenSign-container        |  HTTP  4/10/2025 8:55:32 AM 172.19.0.1 Returned 304 in 1 ms
OpenSign-container        |  HTTP  4/10/2025 8:55:32 AM 172.19.0.1 GET /manifest.json
OpenSign-container        |  HTTP  4/10/2025 8:55:32 AM 172.19.0.1 Returned 304 in 0 ms
OpenSign-container        |  HTTP  4/10/2025 8:55:32 AM 172.19.0.1 GET /static/media/login_img.8408eaa02c5e8edff164e682b7245c3a.svg
OpenSign-container        |  HTTP  4/10/2025 8:55:32 AM 172.19.0.1 POST /api/app/functions/getlogobydomain
# this seems to never get a response, which is correct since the server container only responds to /app not /api/app
OpenSign-container        |  HTTP  4/10/2025 8:55:32 AM 172.19.0.1 Returned 304 in 1 ms
OpenSign-container        |  HTTP  4/10/2025 8:55:32 AM 172.19.0.1 Returned 200 in 1 ms
OpenSign-container        |  HTTP  4/10/2025 8:55:32 AM 172.19.0.1 GET /favicon.ico
OpenSign-container        |  HTTP  4/10/2025 8:55:32 AM 172.19.0.1 Returned 304 in 0 ms
OpenSign-container        |  HTTP  4/10/2025 8:55:32 AM 172.19.0.1 GET /logo192.png
OpenSign-container        |  HTTP  4/10/2025 8:55:32 AM 172.19.0.1 Returned 304 in 1 ms

This is the error message on the login page:

Unable to connect to the OpenSign™ server. If you are self-hosting OpenSign™, please ensure that all the steps in the documentation have been followed correctly. If you're running OpenSign™ locally, you might be accessing it through an incorrect port number.

Operating System [e.g. MacOS Sonoma 14.1, Windows 11]

Docker Desktop, Windows 11

What browsers are you seeing the problem on?

Microsoft Edge

What version of OpenSign™ are you seeing this issue on? [e.g. 1.0.6]

2.15.0

What environment are you seeing the problem on?

Dev (localhost or vercel)

Please check the boxes that apply to this issue report.

• I have searched the existing issues & discussions to make sure that this is not a duplicate.

Code of Conduct

• I agree to follow this project's Code of Conduct
• I have searched the existing issues & discussions to make sure that this is not a duplicate.

[bispino-ag]

Hey,

I actually managed to get the server working with trafik proxy.

It seems like you need to strip the "/api" prefix from the url with your proxy server before passing the request to opensign server.

docker-compose.yml

services:

  server:
    image: opensign/opensignserver:main
    expose:
      - "8080"
    depends_on:
      - mongo
    env_file: ./.env
    networks:
      - proxy
      - opensign_net
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.opensign.entrypoints=web"
      - "traefik.http.routers.opensign.rule=Host(`sign.yourdomain.com`) && PathPrefix(`/api`)"
      - "traefik.http.middlewares.opensign-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.opensign.middlewares=opensign-https-redirect"

      - "traefik.http.routers.opensign-secure.entrypoints=websecure"
      - "traefik.http.routers.opensign-secure.rule=Host(`sign.yourdomain.com`) && PathPrefix(`/api`)"
      - "traefik.http.routers.opensign-secure.tls=true"
      - "traefik.http.routers.opensign-secure.tls.certresolver=lets-encrypt"
      - "traefik.http.routers.opensign-secure.service=opensign"
      - "traefik.http.services.opensign.loadbalancer.server.port=8080"
      - "traefik.docker.network=proxy"
      
      - "traefik.http.middlewares.opensign-strip.stripprefix.prefixes=/api"

      - "traefik.http.routers.opensign-secure.middlewares=opensign,opensign-strip"

  mongo:
    image: mongo:latest
    volumes:
      - /opt/opensign/db:/data/db
    expose:
      - "27017"
    networks:
      - opensign_net

  client:
    image: opensign/opensign:main
    depends_on:
      - server
    env_file: ./.env
    expose:
      - "3000"
    networks:
      - proxy
      - opensign_net
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.opensign-client.entrypoints=web"
      - "traefik.http.routers.opensign-client.rule=Host(`sign.yourdomain.com`) && !PathPrefix(`/api`)"
      - "traefik.http.middlewares.opensign-client-https-redirect.redirectscheme.scheme=https"

      - "traefik.http.routers.opensign-client-secure.entrypoints=websecure"
      - "traefik.http.routers.opensign-client-secure.rule=Host(`sign.yourdomain.com`) && !PathPrefix(`/api`)"
      - "traefik.http.routers.opensign-client-secure.tls=true"
      - "traefik.http.routers.opensign-client-secure.tls.certresolver=lets-encrypt"
      - "traefik.http.routers.opensign-client-secure.service=opensign-client"
      - "traefik.http.services.opensign-client.loadbalancer.server.port=3000"
      - "traefik.docker.network=proxy"

      - "traefik.http.routers.opensign-client.middlewares=opensign-client-https-redirect,opensign-client"

networks:
  proxy:
    external: true
  opensign_net:
    driver: bridge

.env

PUBLIC_URL=https://sign.yourdomain.com
MASTER_KEY=aaaaaaaaaaaaa
MONGODB_URI=mongodb://mongo:27017/OpenSignDB
PARSE_MOUNT=/app
SERVER_URL=https://sign.yourdomain.com/api/app
SMTP_ENABLE=true
SMTP_HOST=mail.yourdomain.com
SMTP_PORT=587
SMTP_USERNAME=mail@yourdomain.com
SMTP_USER_EMAIL=mail@yourdomain.com
SMTP_PASS=ladidaapassword
PFX_BASE64=
GENERATE_SOURCEMAP=false
appName=opensign
NODE_ENV=production
REACT_APP_APPID=opensign
APP_ID=opensign
REACT_APP_SERVERURL=https://sign.yourdomain.com/api/app

[sregmi001]

This helped to some extend (getting services running) but how do you handle admin login scenario in this case. How is port 3001 exposed here?

I tried to portfoward 3000 to machine with browser but still no luck. I haven't looked at the internals yet but may be the security is bit too tied to caddy as reverse proxy and admin user added via https://localhost:3001 only?

[bispino-ag]

I actually do not expose port 3000 or 8080 at all. Both of the services are accessible using port 80/443 (or whatever port you choose). The Proxyserver then differenciates both services depending on the path and forwards the traffic to the corresponding container/port.

sign.yourdomain.com/api goes to opensign/opensignserver:main container on port 8080

sign.yourdomain.com (every other path) goes to opensign/opensign:main container on port 3000

[pintxxo]

I see that after striping api, I have only a login screen and no wizard that should guide me through a creation of admin user, why it is like that?

[bispino-ag]

In my case i simply used the registration form to create the admin user and after that i changed the environment variables to disable user registration.