docker-templates-unraid

Docker templates for Unraid

Automatic catalog updates

The Unraid Template Sync catalog app receives authenticated GitHub push webhooks and refreshes the private Community Applications templates automatically. Nginx Proxy Manager restricts traffic to GitHub's current webhook networks; the service validates the webhook secret, exact repository, and branch before cloning or updating its managed checkout. See its README for Nginx Proxy Manager and GitHub webhook setup.

Pomerium behind Nginx Proxy Manager

Use Nginx Proxy Manager as the public TLS endpoint and send protected application hosts directly to Pomerium's HTTP port:

Browser (HTTPS) -> Nginx Proxy Manager -> Pomerium:80 -> application

For containers on the same custom Docker network, configure the NPM proxy host with scheme http, hostname Pomerium, and port 80. When using the Unraid host mapping instead, use the Unraid address and Pomerium's mapped port (by default 8801). Enable NPM's WebSocket support for applications that require it.

Set Trusted Reverse Proxy Hops to 1 in the Pomerium template. A typical WebSocket application route is:

routes:
  - from: https://notes.example.com
    to: http://obsidian:3000
    allow_websockets: true
    preserve_host_header: true
    pass_identity_headers: true
    policy:
      - allow:
          or:
            - email:
                is: user@example.com

Point the public Pomerium Authenticate hostname at the same Pomerium HTTP endpoint in NPM. Send every protected application hostname to that endpoint; Pomerium matches the incoming hostname against its from routes and forwards authorized requests to the corresponding to destinations. Pomerium Verify is only a diagnostic application, and Pomerium Route Sync is optional if config.yaml is maintained directly.

Pomerium Route Sync can generate these route settings by enabling its Allow WebSockets and Preserve Host Header options. These switches apply to every route generated by that container.