Nginx

Nginx takes more setup than Caddy and gets its certificate from a separate tool, Certbot. Use it when Nginx already runs on the server. Domain and HTTPS explains what the proxy is for.

Before you start

The domain’s A record points at the server: dig +short postqueen.example.com prints its IP.
Ports 80 and 443 are open. Certbot proves control of the domain over port 80.
PostQueen answers on the server: curl -I http://localhost:4007 returns 200. If you run the image on its own with -p 127.0.0.1:5000:5000, use port 5000 wherever this page says 4007.

Set it up

The commands are for Ubuntu and Debian.

Install Nginx and Certbot

sudo apt update
sudo apt install -y nginx certbot python3-certbot-nginx

Write the site

Create /etc/nginx/sites-available/postqueen with your own domain:

/etc/nginx/sites-available/postqueen

server {
    listen 80;
    listen [::]:80;
    server_name postqueen.example.com;

    # PostQueen accepts uploads up to 1 GB, sent in one request.
    # Nginx refuses anything over 1 MB unless this is raised.
    client_max_body_size 1G;

    location / {
        proxy_pass http://127.0.0.1:4007;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Then enable it and check the syntax:

sudo ln -s /etc/nginx/sites-available/postqueen /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

Get the certificate

sudo certbot --nginx -d postqueen.example.com

Certbot proves the domain over port 80, then adds HTTPS to this server block and a redirect from HTTP to HTTPS. The package also installs a timer that renews the certificate and reloads Nginx on its own; sudo certbot renew --dry-run tests it.

Tell PostQueen its address

Put the public address in the .env file next to docker-compose.yaml. The shipped Compose file reads that file and fills these three values into the postqueen service, so there is no YAML to edit:

MAIN_URL=https://postqueen.example.com
FRONTEND_URL=https://postqueen.example.com
NEXT_PUBLIC_BACKEND_URL=https://postqueen.example.com/api

Keep /api on the last one, and leave off trailing slashes. Leave BACKEND_INTERNAL_URL as it ships, http://localhost:3000: it is the path from the web app to the API inside the container, not a public address.Recreate the app container so it reads the new values. A plain docker restart or docker compose restart keeps the old container and its old environment.In the folder that holds docker-compose.yaml, recreate only the postqueen service:

docker compose up -d --no-deps --force-recreate postqueen

The database, Redis and Temporal keep running. Avoid docker compose down for a settings change: on a host that runs other Compose services in the same project, it stops them too. On Kubernetes, see Kubernetes with Helm.

Skipping this step is the usual way to get a valid padlock and a sign-in that does not stick. The certificate is fine in that case; these three values are not.

Check it

From your own computer:

curl -I https://postqueen.example.com

HTTP/2 200 or HTTP/1.1 200, then a sign-in in the browser that holds.

The AI Copilot streams its replies and sends X-Accel-Buffering: no, which Nginx honors, so no buffering setting is needed. PostQueen uses no WebSockets in production, so no Upgrade headers are needed either.

If it does not work

502 Bad Gateway

Nginx runs and nothing answers on the port in proxy_pass. curl -I http://localhost:4007 on the server tells you whether PostQueen is up; if it is, the port in proxy_pass is wrong.

413 Request Entity Too Large

client_max_body_size is missing or too small in the server block that serves HTTPS. Certbot adds HTTPS to the block you wrote, so the value above carries over. If you wrote your own listen 443 block, add the line there, then reload.

Certbot cannot validate the domain

The name does not resolve to this server yet, or port 80 is closed. Both have to be true while Certbot runs.

Domain and HTTPS
Split deployments: routing when the frontend and backend run apart
MCP on your server
Self-hosting troubleshooting

Start here

Install

Domain and HTTPS

Configure

Channel developer apps

Operate

Develop

Before you start

Set it up

If it does not work

​Before you start

​Set it up

​If it does not work

​Related

Before you start

Set it up

If it does not work

Related