docs(docker): document outbound proxy configuration

This commit is contained in:
Cynosure159
2026-08-13 15:10:03 +08:00
committed by Maurice
parent 84a84078f6
commit eecde11061
2 changed files with 20 additions and 1 deletions
+3
View File
@@ -31,6 +31,9 @@ services:
# - COOKIE_SECURE=false # Escape hatch: force session cookies over plain HTTP even in production. Not recommended.
# - TRUST_PROXY=1 # Trusted proxy count for X-Forwarded-For / X-Forwarded-Proto. Required for FORCE_HTTPS to work.
# - ALLOW_INTERNAL_NETWORK=false # Set to true if Immich or other services are hosted on your local network (RFC-1918 IPs). Loopback and link-local addresses remain blocked regardless.
# - HTTP_PROXY=${HTTP_PROXY:-} # Optional. Proxy URL for outbound HTTP requests (e.g. http://192.168.1.10:7890)
# - HTTPS_PROXY=${HTTPS_PROXY:-} # Optional. Proxy URL for outbound HTTPS requests
# - NO_PROXY=${NO_PROXY:-localhost,127.0.0.1} # Optional. Comma-separated hosts and domains that bypass the outbound proxy
# - APP_URL=https://trek.example.com # Public base URL — required when OIDC is enabled (must match the redirect URI registered with your IdP); also used as base URL for links in email notifications
# - OIDC_ISSUER=https://auth.example.com # OpenID Connect provider URL
# - OIDC_CLIENT_ID=trek # OpenID Connect client ID
+17 -1
View File
@@ -97,7 +97,23 @@ translations are added to TREK.
---
## HTTPS / Proxy
## Outbound HTTP(S) Proxy
TREK can route supported outbound HTTP(S) requests through a proxy by setting the standard variables below. Outbound
proxying is disabled by default.
| Variable | Description | Default |
|---------------|---------------------------------------------------------------|---------|
| `HTTP_PROXY` | Proxy URL for outbound HTTP requests | — |
| `HTTPS_PROXY` | Proxy URL for outbound HTTPS requests | — |
| `NO_PROXY` | Comma-separated hosts or domains that should bypass the proxy | — |
> **Note:** Proxy environment variables apply to requests made through Node.js's default HTTP dispatcher. Requests
> handled by TREK's SSRF protection use a dedicated dispatcher and do not use the environment proxy.
---
## HTTPS / Reverse Proxy
These three variables work together behind a TLS-terminating reverse proxy. See [Reverse-Proxy](Reverse-Proxy) for the
full explanation.