Reverse proxies in container-based production environments

Container-based production environments frequently require reverse proxy configurations for TYPO3 to run properly.

Containerized environments typically involve a dynamic or wide range of IP addresses, making it impractical to rely on a single IP for reverse proxy configuration.

Refer to the documentation of the hosting company or to their support hotline to find out the concrete ranges.

You can use the CIDR notation, for example 10.0.0.0/8 or a wildcard. If the hosting provider can promise no range at all you can use wildcard *, be sure this is safe for the hosting environment being used.

Configure the reverse proxy settings in your custom Docker image

If you maintain the config/system/additional.php within your project-specific docker image, you can use Application Context or environment variables to activate the reverse proxy settings on production only. For example:

config/system/additional.php 
<?php

use TYPO3\CMS\Core\Core\Environment;

if (Environment::getContext()->isProduction()) {
    $customChanges = [
        // Database Credentials and other production settings
        'SYS' => [
            'reverseProxySSL' => '192.0.2.1,192.168.0.0/16',
        ],
    ];
    $GLOBALS['TYPO3_CONF_VARS'] = array_replace_recursive($GLOBALS['TYPO3_CONF_VARS'], (array)$customChanges);
}
Copied!

Configure the reverse proxy in a mounted volume

If you have mounted config/system/settings.php or a path above to a persistent volume on the host you can edit this file directly.

Incorrect reverse proxy settings can unfortunately render the TYPO3 backend and Install Tool inaccessible (See Bug #106797 Missing reverse Proxy leads to perpetual loading Install tool login).

Therefore you need to edit the config/system/settings.php or add a config/system/additional.php for the reverse proxy settings.

The linux environment inside a container that is run on production is usually very reduced. For example tools like nano and vim might not be installed.

You can however edit the config/system/additional.php locally and upload it via SCP:

scp additional.php user@example.org:/var/www/html/typo3conf/system/
Copied!

If your host supports this you can use SSH or SFTP to edit the file.

If your host does not support SSH directly into the container you can run a container that allows you to edit files like filebrowser/filebrowser or run a one-time container job to adjust the settings like linawolf/typo3-nexaa-reverse-proxy-copier to override the config/system/additional.php. This container is designed to copy reverse proxy settings into a live system and should be used with caution.