Skip to main content
Path routing for split deployments, HTTPS tunnels in development, and why some OAuth redirects travel through redirectmeto.

​
Production reverse proxy

How you reverse-proxy depends on how you are running PostQueen.
On ghcr.io/gkhankinay/postqueen-app, frontend and backend are bundled inside one container and exposed on a single port (5000 internally; the official compose maps it to host 4007). Your reverse proxy only needs to forward one upstream. On this image you rarely need anything beyond standard HTTPS termination.
For the split setup, forward:
The two rows people get wrong are the first two. /auth and /integrations look like backend concerns and are not: they are directories under apps/frontend/src/app/(app)/. Sending them to the backend leaves you with no login page and an OAuth callback that 404s on every channel you try to connect. The browser does reach the backend’s own /auth and /integrations controllers, but it does so through NEXT_PUBLIC_BACKEND_URL, which on the bundled image is <host>/api.
Worked examples:

Caddy

Certificates without being asked.

Nginx

More configuration, full control.

Traefik

Labels on the container.

​
Dev behind ngrok / Cloudflared

Running next dev behind an HTTPS tunnel needs three things.
1

Bind to all interfaces

2

Allow the tunnel host in next.config

Add your tunnel hostname to the allowedDevOrigins field in apps/frontend/next.config.js (introduced in Next.js 15.x).
Without this, Next.js refuses HMR connections coming through the tunnel.
3

Let WebSockets reach the dev server

Most tunnels support WSS out of the box. If you have put your own reverse proxy in front of the tunnel, ensure Upgrade and Connection headers pass through.
Without them the HMR client disconnects every few seconds.
Open the tunnel URL, edit a file, and the change appears without a manual refresh. HMR is reaching the dev server.

​
redirectmeto: why OAuth redirects sometimes go through a third party

When FRONTEND_URL is plain HTTP, several social providers (Slack, TikTok, Threads, VK, Instagram standalone) refuse to register your redirect URI.
PostQueen works around this by wrapping the redirect through https://redirectmeto.com/:
The browser hits redirectmeto, which serves an HTTPS page that immediately redirects to the HTTP target, satisfying the provider’s HTTPS-only validation without needing your dev environment to have a TLS cert.
You only see this in dev. Once FRONTEND_URL is HTTPS, PostQueen skips redirectmeto entirely and uses your URL directly.
To keep redirectmeto out of the middle even in dev, terminate TLS at your tunnel (ngrok and Cloudflared both do this by default) and set FRONTEND_URL to the https:// tunnel URL.

​
Next steps

Domain and HTTPS

What a reverse proxy is, and which one to choose.

Development environment

Run her from source with hot reload.

Channel connect errors

Invalid state, invalid_grant, and fetch failures.

Configuration reference

Every environment variable, including the URL trio.