Docker doesn't work behind a reverse proxy that takes care of SSL offloading

Question

I tried to deploy this on my stack, which uses Traefik to take care of the reverse proxying and SSL offloading.

So basically, I removed the certbot part from docker compose and tried to deploy it in HTTP (expose 8080:8080 and 31000:31000).

Then upon deployment, apparently HMDM sekf deploy a couple APKs, and during LaunchRestarter install, it gets stuck looking for SSL keys:

headwindmdm-1 | 2026-08-16 09:32:35 (1.84 MB/s) - ‘LauncherRestarter-1.04.apk’ saved [1653792/1653792]

headwindmdm-1 |

headwindmdm-1 | Looking for SSL keys in /etc/letsencrypt/live/hmdm.eastcode.org...

headwindmdm-1 | Keys not found, waiting...

headwindmdm-1 | Keys not found, waiting...
 

that sounds like an internal dependence on the HTTPS certificate, which should ideally be taken car of externally.

It'll probably be hard to disentangle, but the deployment would be cleaner with a clear separation of concern.

In the meantime I'm stuck here as I can't provide SSL keys

Answer 1

By default, Headwind MDM Docker uses Let's Encrypt to generate the SSL keys, so it expects to see the keys and certificates in /volumes/letsencrypt/live/your-domain.com/.

To use custom SSL certificates

(This is not your case but may still be a useful info)

• Comment out the whole certbot: section in docker-compose.yaml
• Create the subdirectory ./volumes/letsencrypt/live/your-domain.com/
• Copy the private key, certificate, and full certificate chain in the PEM (base64) format to that subdirectory. Use the following names: cert.pem, fullchain.pem, privkey.pem

To use HTTP only

• Comment out the whole certbot: section in docker-compose.yaml
• In the .env file, change PROTOCOL to http