WebSocket fix for persisted Docker installations

Applies to

You persisted /etc/nginx as a Docker volume from a Nginx UI version older than the one that introduced this fix, and Nginx UI is fronted by another reverse proxy that terminates TLS (host nginx, Cloudflare, Traefik, ...).

Symptoms

WebSocket connections (terminal, log live tail, ...) fail with origin-mismatch errors. This happens because the container's internal nginx was overwriting X-Forwarded-Proto with its own $scheme (http), breaking the same-origin check on HTTPS deployments.

Automatic fix (recommended)

1. Open System → Self Check.
2. Locate Bundled nginx-ui.conf has WebSocket reverse-proxy fix.
3. Click Attempt to fix. A timestamped .bak file is written next to the original.

If the fix fails

The original file is restored from backup automatically. The error message includes the backup path. See Manual fix below.

Manual fix

Additions at top of conf.d/nginx-ui.conf

map $http_x_forwarded_proto $forwarded_proto {
    default $http_x_forwarded_proto;
    ''      $scheme;
}
map $http_x_forwarded_host $forwarded_host {
    default $http_x_forwarded_host;
    ''      $http_host;
}

Replace inside location /

-        proxy_set_header   X-Forwarded-Proto    $scheme;
-        proxy_set_header   X-Forwarded-Host     $http_host;
+        proxy_set_header   X-Forwarded-Proto    $forwarded_proto;
+        proxy_set_header   X-Forwarded-Host     $forwarded_host;

After saving, run docker exec <container> nginx -s reload.

Opt-out

INFO

Set NGINX_UI_PRESERVE_BUNDLED_CONF=true on the container to disable the startup-time auto-upgrade. The UI-driven fix remains available regardless.

If you delete /etc/nginx/conf.d/nginx-ui.conf from an existing persisted configuration, startup leaves it deleted. Only a completely empty /etc/nginx directory is initialized from the bundled templates.

Set NGINX_UI_DISABLE_BUNDLED_NGINX=true when Nginx UI should not manage or run the bundled Nginx instance at all. This skips template initialization, keeps the bundled Nginx service idle, and excludes bundled-Nginx checks from self-check.