Reverse Proxy

Snipraw is plain HTTP on localhost. A reverse proxy gives you TLS, a custom domain, and access control, since snipraw has no built-in authentication.

Caddy

Caddy handles TLS automatically via Let's Encrypt.

snippets.example.com {
    reverse_proxy localhost:8245
}

Reload:

caddy reload

nginx

Obtain a certificate first:

certbot certonly --nginx -d snippets.example.com

Then configure the server block:

server {
    listen 80;
    server_name snippets.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name snippets.example.com;

    ssl_certificate     /etc/letsencrypt/live/snippets.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/snippets.example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:8245;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

Access control

Snipraw has no built-in authentication. Add it at the proxy layer using a forward-auth service, or fall back to plain basic auth if you want something simpler.

Forward auth (recommended)

Tools like Tinyauth or Authelia sit in front of your proxy and gate every request before it reaches snipraw, giving you a real login page, session cookies, and (optionally) 2FA.

Caddy, with Tinyauth:

auth.example.com {
    reverse_proxy localhost:3000
}

snippets.example.com {
    forward_auth localhost:3000 {
        uri /api/auth/caddy
        copy_headers Remote-User Remote-Name Remote-Email Remote-Groups
    }
    reverse_proxy localhost:8245
}

See Tinyauth's docs for setting up the auth service itself.

Basic auth (simpler, less capable)

Caddy:

snippets.example.com {
    basicauth {
        pat $2a$14$...hashed-password...
    }
    reverse_proxy localhost:8245
}

Generate a password hash:

caddy hash-password

nginx:

location / {
    auth_basic "Snippets";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://127.0.0.1:8245;
}

Generate a password file:

htpasswd -c /etc/nginx/.htpasswd your-username

WARNING

Basic auth transmits credentials in base64. Always use it with TLS.