Trouble with Logto behind an nginx reverse proxy

[Leonich77]

Hello everyone!

I'm hoping you can help me understand what I'm doing wrong. I'm working on integrating Logto into my application. Without a proxy server, everything works perfectly and was quite easy to set up. However, I've been struggling with the proxy setup for a week now and I'm completely stuck.

I've been following this guide as a base: https://docs.logto.io/logto-oss/deployment-and-configuration#reverse-proxy. I've found similar configurations in a couple of online posts, but couldn't find any other information on the topic. I also didn't find anything new for my situation in this discussion: https://github.com/orgs/logto-io/discussions/1779.

Here's the issue in detail:

When I run Logto behind the proxy server, everything starts up and there are no error messages in the logs. However, when I try to access the admin console on port 7778, I get a 302 Found response, which immediately redirects me to the Logto auth page on port 7777, where I see a "404 Session not found" message.

The strange part is that if I open the console URL directly in another tab, bypassing the proxy, on port 3002, it loads the welcome page just fine (i.d., http://localhost:3002/console/welcome).

I've created a repository with the docker-compose.yaml and nginx.conf files I'm using, and I'm also including them below for convenience.
https://github.com/Leonich77/logtonix

Could you please point me in the right direction or suggest what the problem might be?

Thanks in advance!

File docker-compose.yam

networks:
  logtonix-net:
    driver: bridge

services:
  nginx:
    image: nginx:stable-alpine3.23
    container_name: logtonix-inpoint
    ports:
      - "7777:7777"
      - "7778:7778"
    networks:
      - logtonix-net
    restart: always
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
    depends_on:
      pg:
        condition: service_healthy
      logto:
        condition: service_healthy
  pg:
    networks:
      - logtonix-net
    image: postgres:17.4
    container_name: logtonix-pg
    restart: always
    ports:
      - "5432:5432"
    environment:
      POSTGRES_PASSWORD: postgrespassword
    healthcheck:
      test:
        - CMD-SHELL
        - pg_isready -U postgres
        - -d
        - postgres
        - -q
      timeout: 60s
      interval: 30s
      start_period: 60s

  logto:
    networks:
      - logtonix-net
    depends_on:
      pg:
        condition: service_healthy
    image: svhd/logto:${TAG-latest}
    # image: svhd/logto:1.33
    container_name: logtonix-logto
    entrypoint: ["sh", "-c", "npm run cli db seed -- --swe && npm start"]
    ports:
      - 3001:3001
      - 3002:3002
    environment:
      - TRUST_PROXY_HEADER=1
      - DB_URL=postgres://postgres:postgrespassword@pg:5432/logto
      # Mandatory for GitPod to map host env to the container, thus GitPod can dynamically configure the public URL of Logto;
      # Or, you can leverage it for local testing.
      # - ENDPOINT=http://localhost:7777/auth
      # - ADMIN_ENDPOINT=http://localhost:7777/admin
      - ENDPOINT=http://localhost:7777
      - ADMIN_ENDPOINT=http://localhost:7778
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "--no-verbose",
          "--tries=1",
          "--spider",
          "http://localhost:3001/api/status",
        ]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s

File nginx.conf

worker_processes auto;

events {
    worker_connections 1024;
}

http {

    # Docker embedded DNS for name resolution from NJS (ngx.fetch) and proxy
    resolver 127.0.0.11 ipv6=off valid=30s;

    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                   '$status $body_bytes_sent "$http_referer" '
                   '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main;
    error_log /var/log/nginx/error.log debug;


    upstream logto {
        server logto:3001 max_fails=3 fail_timeout=30s;
    }

    upstream logto_admin {
        server logto:3002 max_fails=3 fail_timeout=30s;
    }

    

    server {
        listen 7777;
        server_name localhost;

        location / {
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
    
            proxy_pass http://logto;
        }

        # Healthcheck endpoint
        location /healthcheck {
            access_log off;
            add_header Content-Type text/plain;
            return 200 'Logto OK';
        }
    }

    server {
        listen 7778;
        server_name localhost;

        location / {
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
    
            proxy_pass http://logto_admin;
        }

        # Healthcheck endpoint
        location /healthcheck {
            access_log off;
            add_header Content-Type text/plain;
            return 200 'Logto admin OK';
        }
    }
}