Exposing Publicly

Dokku Pro serves plain http and cannot terminate https itself, so to reach it over a domain with TLS you put Dokku's own proxy in front of it. Dokku 0.25.0+ can route to a service it does not build or run, which lets you register Dokku Pro as an ordinary Dokku app whose only job is to proxy traffic to the running service.

The example below exposes a Dokku Pro server listening on port 5000 as a Dokku app called admin:

# create the app
dokku apps:create admin

# use the null builder, which does nothing - Dokku Pro is already running, so there is
# nothing to build
dokku builder:set admin selected null

# use the null scheduler, which does nothing - the service is already running, so Dokku
# should not try to start containers for it
dokku scheduler:set admin selected null

# point the app at the address Dokku Pro actually listens on
dokku network:set admin static-web-listener 127.0.0.1:5000

# map the public port to the static-web-listener port
dokku ports:set admin http:80:5000

# set the domain the app answers on
dokku domains:set admin admin.dokku.me

# generate the proxy (nginx) configuration from the settings above
dokku proxy:build-config admin

The static-web-listener network property tells Dokku's proxy where the already-running service lives, and proxy:build-config writes the nginx configuration that routes the domain to it.

Enabling SSL

Note

This requires the letsencrypt plugin.

Expose Dokku Pro as a Dokku app first, then request a certificate for it:

# enable letsencrypt (if installed)
dokku letsencrypt:enable admin

WebSocket Support

Dokku Pro streams live logs - the application, nginx access, and nginx error logs on an app's Logs tab, plus running-job output on the Activity tab - over a WebSocket connection. The browser opens it by upgrading a normal HTTP request, so any CDN or reverse proxy in front of Dokku Pro must allow the WebSocket Upgrade.

The app Logs tab streaming live application output over a WebSocket — Live logs streaming on the Logs tab

The Activity tab live-tailing a running job's output — Live job output on the Activity tab

If the proxy does not forward the Upgrade and Connection headers - for example Cloudflare with WebSocket support disabled - the log stream cannot connect, and the Logs tab shows a connection-error banner instead of output. To fix it, enable WebSocket support on the proxy, or reach the server through a proxy that allows WebSocket connections, then use the banner's Retry button.