HTTPS

The recommended way to serve Comicarr over HTTPS is a reverse proxy (Caddy, nginx, Traefik). Comicarr also supports optional built-in TLS via uvicorn when you set certificate paths in config.

Reverse proxy (recommended)

A reverse proxy handles certificate provisioning and renewal automatically, supports HTTP/2, and keeps TLS configuration outside your application.

When using a reverse proxy, leave ENABLE_HTTPS set to False in Comicarr. The proxy terminates TLS and forwards plain HTTP to port 8090.

Caddy handles certificate provisioning and renewal automatically via Let's Encrypt.

Caddyfile

comics.example.com {
    reverse_proxy comicarr:8090
}

nginx.conf

server {
    listen 443 ssl;
    server_name comics.example.com;

    ssl_certificate     /etc/nginx/ssl/cert.pem;
    ssl_certificate_key /etc/nginx/ssl/key.pem;

    location / {
        proxy_pass http://comicarr:8090;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # SSE support — disable buffering and allow long-lived connections
        proxy_buffering off;
        proxy_read_timeout 86400s;
    }
}

docker-compose.yml

services:
  comicarr:
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.comicarr.rule=Host(`comics.example.com`)"
      - "traefik.http.routers.comicarr.tls.certresolver=letsencrypt"
      - "traefik.http.services.comicarr.loadbalancer.server.port=8090"

Built-in HTTPS (optional)

Comicarr can load TLS certificates directly when starting uvicorn:

Setting	Description
`ENABLE_HTTPS`	Set `True` to serve TLS from the app process
`HTTPS_CERT`	Path to the certificate file
`HTTPS_KEY`	Path to the private key
`HTTPS_CHAIN`	Optional certificate chain

When ENABLE_HTTPS is true, Comicarr also sets Strict-Transport-Security on responses.

Prefer a reverse proxy for production certificate renewal and multi-service routing; use built-in HTTPS mainly for simple single-host setups where you manage cert files yourself.

Reverse proxy (recommended)

Built-in HTTPS (optional)

On this page