I
Immich•4w ago
VJ

caddy reverse proxy issue with the android app

I am on v1.141.1 and so is my android app. I was facing some issues with delayed sync and decided to log out and log back in again. Now, I can log in normally with my local IP and everything looks fine. But if I try to log in with my reverse proxy. I get the following error message in my app (see the screenshot). Of course, everything is working perfectly fine on the browser. I started this discussion in the immich channel as well. Here's the anchor. Another note, everything used to work fine with the current reverse proxy setup until v1.140.0 I am using caddy as my reverse proxy with no caching mechanism. Here's my Caddyfile. Looking for a positive discussion. 
{
        email <my_email_id>
}

(hetzner_dns) {
        tls {
                dns hetzner {$HETZNER_API_KEY}
                propagation_timeout 2m
                resolvers 1.1.1.1
        }
}

(central_logging) {
    log {
        output stdout
        format json {
            time_format "2006-01-02 15:04:05 MST"
            time_local
        }
    }
}

http:// {
        redir https://{host}{uri} permanent
}

photos.homelab.example.com {
        import hetzner_dns
        import central_logging
        reverse_proxy http://192.168.1.32:2283
        encode gzip
}
{
        email <my_email_id>
}

(hetzner_dns) {
        tls {
                dns hetzner {$HETZNER_API_KEY}
                propagation_timeout 2m
                resolvers 1.1.1.1
        }
}

(central_logging) {
    log {
        output stdout
        format json {
            time_format "2006-01-02 15:04:05 MST"
            time_local
        }
    }
}

http:// {
        redir https://{host}{uri} permanent
}

photos.homelab.example.com {
        import hetzner_dns
        import central_logging
        reverse_proxy http://192.168.1.32:2283
        encode gzip
}
No description
8 Replies
Immich
Immich•4w ago
:wave: Hey @VJ, Thanks for reaching out to us. Please carefully read this message and follow the recommended actions. This will help us be more effective in our support effort and leave more time for building Immich :immich:. References - Container Logs: docker compose logs docs - Container Status: docker ps -a docs - Reverse Proxy: https://immich.app/docs/administration/reverse-proxy - Code Formatting https://support.discord.com/hc/en-us/articles/210298617-Markdown-Text-101-Chat-Formatting-Bold-Italic-Underline#h_01GY0DAKGXDEHE263BCAYEGFJA Checklist I have... 1. :ballot_box_with_check: verified I'm on the latest release(note that mobile app releases may take some time). 2. :ballot_box_with_check: read applicable release notes. 3. :ballot_box_with_check: reviewed the FAQs for known issues. 4. :ballot_box_with_check: reviewed Github for known issues. 5. :ballot_box_with_check: tried accessing Immich via local ip (without a custom reverse proxy). 6. :ballot_box_with_check: uploaded the relevant information (see below). 7. :ballot_box_with_check: tried an incognito window, disabled extensions, cleared mobile app cache, logged out and back in, different browsers, etc. as applicable (an item can be marked as "complete" by reacting with the appropriate number) Information In order to be able to effectively help you, we need you to provide clear information to show what the problem is. The exact details needed vary per case, but here is a list of things to consider: - Your docker-compose.yml and .env files. - Logs from all the containers and their status (see above). - All the troubleshooting steps you've tried so far. - Any recent changes you've made to Immich or your system. - Details about your system (both software/OS and hardware). - Details about your storage (filesystems, type of disks, output of commands like fdisk -l and df -h). - The version of the Immich server, mobile app, and other relevant pieces. - Any other information that you think might be relevant. Please paste files and logs with proper code formatting, and especially avoid blurry screenshots. Without the right information we can't work out what the problem is. Help us help you ;) If this ticket can be closed you can use the /close command, and re-open it later if needed. Successfully submitted, a tag has been added to inform contributors. :white_check_mark:
Mraedis
Mraedis•4w ago
What if you remove encode gzip? Also not sure what this hetzner dns is supposed to do there
Zeus
Zeus•4w ago
It would be helpful if you shared your domain here so we can test. Also check the app logs
Sergey Katsubo
Sergey Katsubo•4w ago
Did you test with your mobile only? Or is it reproducible on other mobile clients? Also, in addition to the app logs, you can enable server-side debug/verbose logging (Admin > Logging) to see how far the client gets through the initial phase. Below is my log, trimmed 
11:42:20   DEBUG  HttpException(401): {"message":"Authentication required","error":"Unauthorized","statusCode":401}
11:42:24   DEBUG  GET /.well-known/immich   200 0.90ms
11:42:24   DEBUG  GET /api/server/version   200 1.00ms
11:42:24   DEBUG  GET /api/server/features  200 54.36ms
11:42:24   DEBUG  GET /api/server/config    200 46.89ms
11:42:43   DEBUG  POST /api/auth/login      201 345.56ms
11:42:43 VERBOSE  {"email":"xxx@yyy.com","password":"********"}
11:42:43   DEBUG  GET /api/users/me         200 5.72ms
11:42:43   DEBUG  GET /api/users/me/preferences 200 5.08ms
11:42:43   DEBUG  POST /api/auth/validateToken 200 1.11ms
11:42:43   DEBUG  GET /api/server/version   200 0.98ms
11:42:43   DEBUG  GET /api/server/features  200 46.71ms
11:42:43     LOG  Websocket Connect:    39fxxjwatVLoTHRVAAEH
11:42:43   DEBUG  GET /api/users            200 66.37ms
...
11:42:20   DEBUG  HttpException(401): {"message":"Authentication required","error":"Unauthorized","statusCode":401}
11:42:24   DEBUG  GET /.well-known/immich   200 0.90ms
11:42:24   DEBUG  GET /api/server/version   200 1.00ms
11:42:24   DEBUG  GET /api/server/features  200 54.36ms
11:42:24   DEBUG  GET /api/server/config    200 46.89ms
11:42:43   DEBUG  POST /api/auth/login      201 345.56ms
11:42:43 VERBOSE  {"email":"xxx@yyy.com","password":"********"}
11:42:43   DEBUG  GET /api/users/me         200 5.72ms
11:42:43   DEBUG  GET /api/users/me/preferences 200 5.08ms
11:42:43   DEBUG  POST /api/auth/validateToken 200 1.11ms
11:42:43   DEBUG  GET /api/server/version   200 0.98ms
11:42:43   DEBUG  GET /api/server/features  200 46.71ms
11:42:43     LOG  Websocket Connect:    39fxxjwatVLoTHRVAAEH
11:42:43   DEBUG  GET /api/users            200 66.37ms
...
Or simply check your Caddy's log. Going to lower level you can sniff traffic on the server, either on host or on immich container interface. Below is my invocation of "ngrep" in docker and how it displays traffic of the "version" endpoint: 
docker run --rm --net container:immich_server nicolaka/netshoot ngrep -d any -W byline -s 1000 '' 'port 2283'

T 172.18.0.3:43210 -> 172.18.0.7:2283 [AP] #43
GET /api/server/version HTTP/1.1
Host: xxx
User-Agent: Immich_Android_1.141.1
Via: 1.1 Caddy
...

T 172.18.0.7:2283 -> 172.18.0.3:43210 [AP] #44
HTTP/1.1 200 OK
X-Powered-By: Express
x-immich-cid: v7i9hgo9
Content-Type: application/json; charset=utf-8
Content-Length: 33
ETag: "21-2oFrWmXWRG7fxxOAYMc4uzubgjs"
Vary: Accept-Encoding
Date: Fri, 12 Sep 2025 11:42:24 GMT
Connection: keep-alive
Keep-Alive: timeout=5

{"major":1,"minor":140,"patch":1}
docker run --rm --net container:immich_server nicolaka/netshoot ngrep -d any -W byline -s 1000 '' 'port 2283'

T 172.18.0.3:43210 -> 172.18.0.7:2283 [AP] #43
GET /api/server/version HTTP/1.1
Host: xxx
User-Agent: Immich_Android_1.141.1
Via: 1.1 Caddy
...

T 172.18.0.7:2283 -> 172.18.0.3:43210 [AP] #44
HTTP/1.1 200 OK
X-Powered-By: Express
x-immich-cid: v7i9hgo9
Content-Type: application/json; charset=utf-8
Content-Length: 33
ETag: "21-2oFrWmXWRG7fxxOAYMc4uzubgjs"
Vary: Accept-Encoding
Date: Fri, 12 Sep 2025 11:42:24 GMT
Connection: keep-alive
Keep-Alive: timeout=5

{"major":1,"minor":140,"patch":1}
VJ
VJOP•3w ago
I'll try this. This is for ACME DNS challenge. I have not exposed my server to the internet. Everything is on my tailnet (tailscale). This is how I'm accessing my server right now. But, I don't think that should be the issue here. Forgot to mention, it is behind a VPN.
Zeus
Zeus•3w ago
The issue is definitely with the VPN or the proxy you have setup This sounds like a complex network so we probably can’t help much
VJ
VJOP•3w ago
Could be. But nothing has changed for my proxy and VPN setup from v1.140.0 to v1.141.0. And the proxy and VPN work just fine on the browser (mobile as well as PC). It is hard to believe that could be a problem.
Zeus
Zeus•3w ago
What’s the first thing you see if you open the immich website in an incognito window? Are you using any self signed SSL, MTLS etc?

Did you find this page helpful?