Audiobookshelf reverse proxy: Nginx, Caddy and HTTPS setup

A reverse proxy gives your Audiobookshelf server an HTTPS address for listening outside your home network. A VPN such as Tailscale is another option if you don’t want a public address.

The examples below assume the proxy runs on the same host as Audiobookshelf and reaches it at port 13378. In a separate Docker container, localhost means the proxy container itself: use a shared Docker network and the Audiobookshelf service name and container port instead, such as audiobookshelf:80. Point your hostname’s DNS to the proxy and configure its certificate before connecting remotely.

The one thing every config has in common: WebSocket support is required. Audiobookshelf uses WebSockets for real-time updates, and things will break without it.

Caddy (the easy option)

If you don’t already have a preference, use Caddy. It handles SSL certificates automatically and the config is two lines:

# Caddy and Audiobookshelf are on the same host.
audiobookshelf.yourdomain.com {
    reverse_proxy localhost:13378
}

That’s the entire config. Caddy handles SSL via Let’s Encrypt, WebSocket proxying, and HTTP/2 automatically.

Nginx

server {
    listen 443 ssl;
    server_name audiobookshelf.yourdomain.com;

    ssl_certificate /path/to/certificate;
    ssl_certificate_key /path/to/key;

    location / {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $http_host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_http_version 1.1;
        proxy_pass http://localhost:13378;
        proxy_redirect http:// https://;
        client_max_body_size 10240M;
    }
}

The Upgrade and Connection headers are the WebSocket bits. The large client_max_body_size allows uploading audiobook files through the web UI.

Nginx Proxy Manager

If you’re running Nginx Proxy Manager (common on home servers):

1. Add a new Proxy Host
2. Set your domain name
3. Forward to your server’s IP on port 13378
4. Enable Websockets Support. This is the toggle that trips people up
5. Under SSL, enable Force SSL and HTTP/2

Apache

Requires mod_ssl, mod_proxy, mod_proxy_wstunnel, and mod_rewrite:

<VirtualHost *:443>
    ServerName audiobookshelf.yourdomain.com

    ProxyPreserveHost On
    ProxyPass / http://localhost:13378/
    ProxyPassReverse / http://localhost:13378/

    RewriteEngine on
    RewriteCond %{HTTP:Upgrade} websocket [NC]
    RewriteCond %{HTTP:Connection} upgrade [NC]
    RewriteRule ^/?(.*) "ws://localhost:13378/$1" [P,L]

    SSLCertificateFile /path/to/cert
    SSLCertificateKeyFile /path/to/key
</VirtualHost>

On Apache 2.4.47+, there’s a simpler syntax:

<VirtualHost *:443>
    ServerName audiobookshelf.yourdomain.com

    ProxyPreserveHost on
    ProxyPass / http://localhost:13378/ upgrade=websocket
    ProxyPassReverse / http://localhost:13378/

    SSLCertificateFile /path/to/cert
    SSLCertificateKeyFile /path/to/key
</VirtualHost>

HAProxy

frontend my_frontend
    bind :443 ssl crt-list /path/to/cert.crt_list alpn h2,http/1.1
    acl is_audiobookshelf hdr_beg(host) -i audiobookshelf
    use_backend audiobookshelf_backend if is_audiobookshelf

backend audiobookshelf_backend
    mode http
    server audiobookshelf 127.0.0.1:13378

Traefik

Traefik works with standard Docker labels. One important pitfall: do NOT apply CORS middleware headers (accessControlAllowMethods, accessControlAllowOriginList, accessControlMaxAge). They cause an “Unknown Error” on the login screen. Just let Audiobookshelf handle CORS itself.

Running under a subfolder

If you want to run Audiobookshelf at yourdomain.com/audiobookshelf instead of a subdomain, the path must be /audiobookshelf. This is hardcoded and not configurable.

Verify it works

After setting up your reverse proxy:

1. Open https://audiobookshelf.yourdomain.com in a browser
2. Log in and test playback. In browser developer tools, check the Network WebSocket request for a successful upgrade; playback alone does not prove that connection works.
3. In SoundLeaf, use the full URL including https:// to connect

If playback or live updates fail, inspect the failed request and proxy logs before changing settings. WebSocket headers are one possible cause; an unreachable upstream, certificate error or denied request can also break playback.

For repeated login prompts, use the token and session troubleshooting guide. A dropped WebSocket and a rejected refresh token are different failures. SoundLeaf can also keep separate local and remote server addresses.

The protocol details are documented in Nginx’s WebSocket guide and Caddy’s reverse_proxy reference.