feat: update docker-compose for Proxmox/LXC environments with local persistence by Matheuscara · Pull Request #70 · ZimengXiong/ExcaliDash

Matheuscara · 2026-02-21T21:44:15Z

Hi there!

I’m running this project on my Home Lab (Proxmox/LXC with CasaOS) and I successfully managed to get it working with a few adjustments to the docker-compose.yml.

The main changes I made were:

Added ALLOWED_ORIGIN and NEXT_PUBLIC_BACKEND_URL environment variables to fix CORS issues when accessing via server IP instead of localhost.

Set TRUST_PROXY=true to ensure the backend correctly handles requests coming through the server's network interface.

Ensured volumes are mapped correctly for local data persistence on the host machine.

My setup:

CPU: Intel i5 6th Gen

RAM: 16GB DDR4

OS: CasaOS running on a Proxmox LXC

This configuration is working perfectly now, and I hope it helps other users with similar local server setups!

Best regards,

Replaced commented-out environment variables with active settings for production deployment.

Copilot

Pull request overview

This PR attempts to modify the production docker-compose configuration to support deployment in Proxmox/LXC environments with CasaOS. The changes aim to address CORS issues and enable proxy support for non-localhost access, but introduce several critical security and configuration issues.

Changes:

Commented out original environment variable configuration and replaced with hardcoded values
Set TRUST_PROXY=true unconditionally
Added ALLOWED_ORIGIN environment variable with placeholder syntax
Hardcoded placeholder secrets in Portuguese for JWT and CSRF

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-23T05:14:55Z

+      - JWT_SECRET=sua_chave_secreta_aqui
+      - CSRF_SECRET=outra_chave_secreta_aqui


Hardcoded secret 'outra_chave_secreta_aqui' (Portuguese for 'another_secret_key_here') should not be committed to the repository. This is a production compose file and should use environment variables for secrets. The original file correctly used CSRF_SECRET=${CSRF_SECRET} to allow secrets to be provided externally via .env file or environment variables.

Suggested change

- JWT_SECRET=sua_chave_secreta_aqui

- CSRF_SECRET=outra_chave_secreta_aqui

- JWT_SECRET=${JWT_SECRET}

- CSRF_SECRET=${CSRF_SECRET}

Copilot · 2026-02-23T05:14:55Z

+      - NODE_ENV=production
+      - AUTH_MODE=local
+      - TRUST_PROXY=true
+      - ALLOWED_ORIGIN=http://{{ip_server}}:6767


The environment variable ALLOWED_ORIGIN is not used by the backend application. Based on the backend code (backend/src/config.ts and backend/src/index.ts), the correct variable name is FRONTEND_URL, not ALLOWED_ORIGIN. This variable will have no effect and CORS will not work as intended.

Suggested change

- ALLOWED_ORIGIN=http://{{ip_server}}:6767

- FRONTEND_URL=http://{{ip_server}}:6767

Copilot · 2026-02-23T05:14:56Z

+      - NODE_ENV=production
+      - AUTH_MODE=local
+      - TRUST_PROXY=true
+      - ALLOWED_ORIGIN=http://{{ip_server}}:6767


The placeholder '{{ip_server}}' is not valid syntax for docker-compose environment variables. This will be treated as a literal string, not interpolated. Users would need to manually edit this value to their actual IP address. Consider using ${SERVER_IP} syntax or removing this hardcoded value entirely and letting users provide it via environment variables.

Suggested change

- ALLOWED_ORIGIN=http://{{ip_server}}:6767

- ALLOWED_ORIGIN=${ALLOWED_ORIGIN:-http://localhost:6767}

Copilot · 2026-02-23T05:14:56Z

+      - PORT=8000
+      - NODE_ENV=production
+      - AUTH_MODE=local
+      - TRUST_PROXY=true


Setting TRUST_PROXY=true unconditionally is potentially insecure for a production configuration file. The original docker-compose.prod.yml correctly set TRUST_PROXY=false by default with a comment explaining it should only be enabled when a trusted proxy sanitizes forwarded headers. The README documentation also recommends setting this to a specific hop count (like 1) only when using a reverse proxy. Enabling this without a proper reverse proxy setup could allow header spoofing attacks.

Suggested change

- TRUST_PROXY=true

- TRUST_PROXY=false

Copilot · 2026-02-23T05:14:56Z

+    environment:
+      - DATABASE_URL=file:/app/prisma/dev.db
+      - PORT=8000
+      - NODE_ENV=production
+      - AUTH_MODE=local
+      - TRUST_PROXY=true
+      - ALLOWED_ORIGIN=http://{{ip_server}}:6767
+      - JWT_SECRET=sua_chave_secreta_aqui
+      - CSRF_SECRET=outra_chave_secreta_aqui


The environment variable NEXT_PUBLIC_BACKEND_URL mentioned in the PR description is not present in this docker-compose.prod.yml file and is not used anywhere in the codebase. The frontend uses BACKEND_URL (without the NEXT_PUBLIC_ prefix) for nginx proxy configuration, as shown in docker-compose.yml. If CORS issues were encountered, they should be resolved using the FRONTEND_URL variable on the backend, not a nonexistent frontend variable.

Copilot · 2026-02-23T05:14:56Z

+    #environment:
+      #- DATABASE_URL=file:/app/prisma/dev.db
+      #- PORT=8000
+      #- NODE_ENV=production
+      #- AUTH_MODE=${AUTH_MODE:-local}
      # Keep disabled by default; only enable when a trusted proxy sanitizes forwarded headers.
-      - TRUST_PROXY=false
+      #- TRUST_PROXY=false
      # Optional for single-instance deployments:
      # if unset, backend auto-generates and persists one in the volume.
      # Recommended to set explicitly for portability and multi-instance setups.
-      - JWT_SECRET=${JWT_SECRET}
-      - CSRF_SECRET=${CSRF_SECRET}
+      #- JWT_SECRET=${JWT_SECRET}
+      #- CSRF_SECRET=${CSRF_SECRET}
      # Optional OIDC settings (required for AUTH_MODE=hybrid or oidc_enforced)
      # - OIDC_PROVIDER_NAME=Authentik
      # - OIDC_ISSUER_URL=https://auth.example.com/application/o/excalidash/
      # - OIDC_CLIENT_ID=your-client-id
      # - OIDC_CLIENT_SECRET=your-client-secret
      # - OIDC_REDIRECT_URI=https://excalidash.example.com/api/auth/oidc/callback


The original environment variable configuration has been commented out and duplicated below. This creates maintainability issues as there are now two sets of configuration (one commented, one active). The recommended approach is to either use the original configuration with proper environment variable substitution (${VAR}) or remove the commented section entirely to avoid confusion.

Copilot · 2026-02-23T05:14:57Z

+      - DATABASE_URL=file:/app/prisma/dev.db
+      - PORT=8000
+      - NODE_ENV=production
+      - AUTH_MODE=local


AUTH_MODE is hardcoded to 'local' instead of using the flexible default pattern AUTH_MODE=${AUTH_MODE:-local} from the original configuration. This removes the ability to override the auth mode via environment variables without editing the docker-compose file, which goes against the principle of configuration management and makes the setup less flexible for different deployment scenarios.

Suggested change

- AUTH_MODE=local

- AUTH_MODE=${AUTH_MODE:-local}

Copilot · 2026-02-23T05:14:57Z

+      - JWT_SECRET=sua_chave_secreta_aqui
+      - CSRF_SECRET=outra_chave_secreta_aqui


Hardcoded secret 'sua_chave_secreta_aqui' (Portuguese for 'your_secret_key_here') should not be committed to the repository. This is a production compose file and should use environment variables for secrets. The original file correctly used JWT_SECRET=${JWT_SECRET} to allow secrets to be provided externally via .env file or environment variables.

Suggested change

- JWT_SECRET=sua_chave_secreta_aqui

- CSRF_SECRET=outra_chave_secreta_aqui

- JWT_SECRET=${JWT_SECRET}

- CSRF_SECRET=${CSRF_SECRET}

Update backend service environment variables

7a88eb3

Replaced commented-out environment variables with active settings for production deployment.

ZimengXiong requested review from ZimengXiong and Copilot and removed request for Copilot February 23, 2026 05:08

Copilot started reviewing on behalf of ZimengXiong February 23, 2026 05:11 View session

Copilot AI reviewed Feb 23, 2026

View reviewed changes

ZimengXiong added enhancement New feature or request priority:p3 Normal priority area:deploy Deployment and infrastructure labels Apr 1, 2026

ZimengXiong self-assigned this Apr 7, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: update docker-compose for Proxmox/LXC environments with local persistence#70

feat: update docker-compose for Proxmox/LXC environments with local persistence#70
Matheuscara wants to merge 1 commit into
ZimengXiong:mainfrom
Matheuscara:main

Matheuscara commented Feb 21, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 23, 2026

Uh oh!

Copilot AI Feb 23, 2026

Uh oh!

Copilot AI Feb 23, 2026

Uh oh!

Copilot AI Feb 23, 2026

Uh oh!

Copilot AI Feb 23, 2026

Uh oh!

Copilot AI Feb 23, 2026

Uh oh!

Copilot AI Feb 23, 2026

Uh oh!

Copilot AI Feb 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		- JWT_SECRET=sua_chave_secreta_aqui
		- CSRF_SECRET=outra_chave_secreta_aqui

	- ALLOWED_ORIGIN=http://{{ip_server}}:6767
	- FRONTEND_URL=http://{{ip_server}}:6767

	- ALLOWED_ORIGIN=http://{{ip_server}}:6767
	- ALLOWED_ORIGIN=${ALLOWED_ORIGIN:-http://localhost:6767}

Uh oh!

Conversation

Matheuscara commented Feb 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants