OpenLiteSpeed Proxy¶

The OpenLiteSpeed Proxy provides a reusable Docker Compose deployment for placing a web application behind OpenLiteSpeed. It configures the reverse proxy from environment variables and can request an SSL certificate for the site automatically.

Use this stack when your application already runs in a Docker container and you want OpenLiteSpeed to handle public HTTP and HTTPS traffic, support HTTP/3, and enhance security. Application-specific guides, such as Langflow, n8n, and Open WebUI, use the same proxy environment.

Prerequisites¶

Before starting, ensure that you have:

A Linux server with Docker Engine and Docker Compose installed.
A backend application running in a Docker container.
A domain whose DNS records point to the server.
Ports 80/tcp, 443/tcp, and 443/udp open in the server firewall.

Note

The examples in this guide use www.example.com as the domain, app as the backend container name, and 3000 as the backend container port. Replace these values with those for your deployment.

Connect the application to the proxy network¶

The proxy and backend containers must share the ls-net Docker network so that OpenLiteSpeed can reach the application by its container or service name.

If the OpenLiteSpeed proxy is already running, ls-net is created automatically by the proxy Compose configuration. Otherwise, create it before starting the backend application:

docker network inspect ls-net >/dev/null 2>&1 || docker network create ls-net

Then configure the backend application to use the existing network:

services:
  app:
    networks:
      - ls-net

networks:
  ls-net:
    external: true

Apply the backend Compose configuration:

docker compose up -d

Tip

Use the backend's container port in the proxy configuration. You do not need to publish that port on the host when both containers use ls-net.

Install the proxy environment¶

Download the repository and enter its directory:

git clone https://github.com/litespeedtech/ols-proxy-docker-env
cd ols-proxy-docker-env

Copy the example environment file:
```
cp .env.example .env
```

Open .env in a text editor and configure the deployment:

OLS_IMAGE=litespeedtech/openlitespeed:latest
BACKEND_IP=app
BACKEND_PORT=3000
DOMAIN=www.example.com
PROXY_METHOD=context
PROXY_SOCKET=false
ACME_EMAIL=admin@example.com

Variable	Description
`OLS_IMAGE`	OpenLiteSpeed container image to run.
`BACKEND_IP`	Backend container name or IP.
`BACKEND_PORT`	Port on which the application listens inside its container.
`DOMAIN`	Domain name served by OpenLiteSpeed.
`PROXY_METHOD`	Method used to configure the OpenLiteSpeed reverse proxy. Supports `context` and `rewrite` values.
`PROXY_SOCKET`	Enables WebSocket proxying when set to `true`.
`ACME_EMAIL`	Email address used for ACME certificate registration and notifications.

Start OpenLiteSpeed:
```
docker compose up -d
```

OpenLiteSpeed now accepts requests for www.example.com, forwards them to app:3000, and serves the site over HTTPS after the certificate is issued automatically.

Options¶

Configure WebSocket proxying¶

Applications that use WebSockets require socket proxying. Set PROXY_SOCKET in .env to true:

PROXY_SOCKET=true

Recreate the proxy container to apply the change:

docker compose up -d --force-recreate

For example, Open WebUI requires WebSocket proxying, while an application that only uses regular HTTP requests can use PROXY_SOCKET=false.

Set a request header¶

Some applications validate the request's Origin header. If the repository's .env.example includes HEADER_SET, uncomment it and set the public origin:

HEADER_SET=RequestHeader set Origin "https://${DOMAIN}"

Restart the proxy after changing .env:

docker compose up -d --force-recreate

Only enable this setting when the backend requires it.

FAQ¶

How do I add additional domains?¶

Keep the primary domain in .env. Add each additional domain on a new line in domains.conf.

Context method example:

DOMAIN, BACKEND_IP, BACKEND_PORT, PROXY_SOCKET, PROXY_METHOD, HEADER_SET
second.example.com, backend-service, 8080, false, context, Strict-Transport-Security: max-age=31536000; includeSubDomains

Rewrite method example:

third.example.com, another-backend, 3000, false, rewrite

Use PROXY_SOCKET=true only when the backend needs WebSocket support. HEADER_SET is optional and works only with the context method. With rewrite, it is ignored, and a warning is written to the container log.

Restart the proxy after editing the file:

docker compose restart ols-proxy

How do I access WebAdmin?¶

WebAdmin port 7080 is disabled by default. If needed, uncomment - "7080:7080" under ports, then recreate the container:

docker compose up -d

Set or reset the WebAdmin password interactively:

docker compose exec ols-proxy /usr/local/lsws/admin/misc/admpass.sh