Docker doesn't work behind a reverse proxy that takes care of SSL offloading

Question

I tried to deploy this on my stack, which uses Traefik to take care of the reverse proxying and SSL offloading.

So basically, I removed the certbot part from docker compose and tried to deploy it in HTTP (expose 8080:8080 and 31000:31000).

Then upon deployment, apparently HMDM sekf deploy a couple APKs, and during LaunchRestarter install, it gets stuck looking for SSL keys:

headwindmdm-1 | 2026-08-16 09:32:35 (1.84 MB/s) - ‘LauncherRestarter-1.04.apk’ saved [1653792/1653792]

headwindmdm-1 |

headwindmdm-1 | Looking for SSL keys in /etc/letsencrypt/live/hmdm.eastcode.org...

headwindmdm-1 | Keys not found, waiting...

headwindmdm-1 | Keys not found, waiting...
 

that sounds like an internal dependence on the HTTPS certificate, which should ideally be taken car of externally.

It'll probably be hard to disentangle, but the deployment would be cleaner with a clear separation of concern.

In the meantime I'm stuck here as I can't provide SSL keys

Answer 1

By default, Headwind MDM Docker uses Let's Encrypt to generate the SSL keys, so it expects to see the keys and certificates in /volumes/letsencrypt/live/your-domain.com/.

To use custom SSL certificates

(This is not your case but may still be a useful info)

• Comment out the whole certbot: section in docker-compose.yaml
• Create the subdirectory ./volumes/letsencrypt/live/your-domain.com/
• Copy the private key, certificate, and full certificate chain in the PEM (base64) format to that subdirectory. Use the following names: cert.pem, fullchain.pem, privkey.pem

To use HTTP only

• Comment out the whole certbot: section in docker-compose.yaml
• In the .env file, change PROTOCOL to http

Answer 2

version: "3.9"

services:

  headwind-db:

    image: postgres:15

    container_name: headwind-db

    restart: unless-stopped

    environment:

      POSTGRES_DB: headwind

      POSTGRES_USER: headwind

      POSTGRES_PASSWORD: change_me

    volumes:

      - headwind_postgres_data:/var/lib/postgresql/data

    networks:

      - hmdm-net

      - docker

  headwind-mdm:

    image: headwindmdm/hmdm:latest

    container_name: headwind-mdm

    restart: unless-stopped

    depends_on:

      - headwind-db

    ports:

      - "8089:80"

    environment:

      SQL_HOST: headwind-db

      SQL_PORT: 5432

      SQL_BASE: headwind

      SQL_USER: headwind

      SQL_PASS: change_me

      HTTPS_LETSENCRYPT: false

      BASE_DOMAIN: mdm.change_me.de

    volumes:

      - headwind_app_data:/opt/hmdm

    networks:

      - hmdm-net

      - docker

volumes:

  headwind_postgres_data:

    name: headwind_postgres_data

  headwind_app_data:

    name: headwind_app_data

networks:

  hmdm-net:

    name: hmdm-net

    driver: bridge

  docker:

    external: true

Comments

Add the entry PROTOCOL: http in the environment section of the headwind-mdm service. Also, Tomcat listens on port 8080, so I believe the ports entry should be 8080:80, not 8089:80