Base path should be made into a runtime environment variable for reverse proxy

[Pietro228]

Description

I would like to change the TUDUDI_BASE_PATH without the need to compile the source code.

Steps to Reproduce

Try to change the env variable in runtime - it doesn’t do anything.

Expected Behavior

This change should enable me to change the path to my Tududi website - example.com/apps/tududi.

Actual Behavior

You need to change that variable before compiling the docker image.

Operating System

Linux

Browser

Firefox

Tududi Version

No response

Screenshots

No response

Additional Context

No response

[chrisvel]

That's an enormous change and I would consider this a feature. Since we are in a feature freeze because of v1.0.0 release, I'll freeze it for the next versions.

[Drakonas]

That's an enormous change and I would consider this a feature. Since we are in a feature freeze because of v1.0.0 release, I'll freeze it for the next versions.

While I agree that this does classify as a request, and I'm guessing it'll require a decent codebase change based on your wording, this is a vital change for security purposes. Opening the port on a home network is a huge security risk for people running other services at home. Reverse proxy is a must if you run home lab setups. By nature, this kind of application needs to be accessed on the go, so security is a must.

Without being able to force the base path, running through a reverse proxy will cause many requests to fail because the header's address will not always match the reverse proxy address. Forcing the base path is meant to be set by the user for this reason. It's not supposed to be a build-specific thing.

I'm not a network engineer, but I can say from personal experience that if you have a domain pointing to your home, and you watch network logs, you will find a MASSIVE amount of things trying to poke your network, that you may not realize, from sketchy places.

Most selfhosted projects offer this as an option when they are intended for access outside your home network.
Even though this is an enormous change, please consider it, because many people need this.

[Drakonas]

Here is a technical example if you're curious how reverse proxies work and why this request is needed.

You have a reverse proxy server running isolated on a specific IP on your network, and have ports 80 and 443 port forwarded to it via router or via Tailscale/cloudflare tunnel.
We'll say ours is 10.0.0.82. This is open to the internet in some shape or form.

Your tududi server is running on port 8285 on another local server with IP 10.0.0.38. So, http://10.0.0.38:8285.
This server is not open to the internet.

So, you try to connect to tududi.mydomain.com. This is what happens:

1. tududi.3rdn3rd.com resolves to your public IP
2. This gets port forwarded to your local server at 10.0.0.82.
3. The reverse proxy automatically makes it HTTPS with SSL using your certificate of choice, and internally handles the traffic to http://10.0.0.38:8285. Only the reverse proxy server sees the 10.0.0.38 server on port http.

So this is why the header may fail. Reverse proxy translates the connection in such a way that your tududi server will never resolve to a domain directly. It's technically being access directly with the local IP 10.0.0.38. So if your authentication or requests expect a domain or specific IP, it will fail because tududi isn't going to be receiving requests as tududi.mydomain.com. It would be either 10.0.0.82:80/443 or 10.0.0.38:8285.