mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-23 20:42:02 +00:00
Boon
65 lines
2.0 KiB
Markdown
65 lines
2.0 KiB
Markdown
# Prowler Reverse Proxy Configuration
|
|
|
|
Ready-to-use nginx configuration for running Prowler behind a reverse proxy.
|
|
|
|
## Problem
|
|
|
|
Prowler's default Docker setup exposes two separate services:
|
|
- **UI** on port 3000
|
|
- **API** on port 8080
|
|
|
|
This causes CORS issues and authentication failures (especially SAML SSO) when accessed through an external reverse proxy, since the proxy typically exposes a single domain.
|
|
|
|
## Solution
|
|
|
|
This adds an nginx container that unifies both services behind a single port, correctly forwarding headers so that Django generates proper URLs for SAML ACS callbacks and API responses.
|
|
|
|
## Quick Start
|
|
|
|
From the prowler root directory:
|
|
|
|
docker compose -f docker-compose.yml \
|
|
-f contrib/reverse-proxy/docker-compose.reverse-proxy.yml \
|
|
up -d
|
|
|
|
Access Prowler at http://localhost (port 80).
|
|
|
|
## With an External Reverse Proxy
|
|
|
|
Point your external reverse proxy to the prowler-nginx container on port 80.
|
|
|
|
### Environment Variables
|
|
|
|
| Variable | Default | Description |
|
|
|----------|---------|-------------|
|
|
| PROWLER_PROXY_PORT | 80 | Port exposed by the nginx proxy |
|
|
|
|
### Example: Traefik
|
|
|
|
services:
|
|
nginx:
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.prowler.rule=Host(`prowler.example.com`)"
|
|
- "traefik.http.routers.prowler.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.prowler.loadbalancer.server.port=80"
|
|
|
|
### Example: Caddy
|
|
|
|
prowler.example.com {
|
|
reverse_proxy prowler-nginx:80
|
|
}
|
|
|
|
## SAML SSO
|
|
|
|
If using SAML SSO behind a reverse proxy, also set the SAML_ACS_BASE_URL environment variable:
|
|
|
|
SAML_ACS_BASE_URL=https://prowler.example.com
|
|
|
|
## Architecture
|
|
|
|
Internet -> External Reverse Proxy -> prowler-nginx:80
|
|
|-- /api/* -> prowler-api:8080
|
|
|-- /accounts/saml/ -> prowler-api:8080
|
|
+-- /* -> prowler-ui:3000
|