OpenPostReverse proxy and public access
Put OpenPost behind HTTPS so sign-in, callbacks, and media fetching work.
Run OpenPost behind HTTPS on a stable public origin. Social sign-in, passkeys, MCP, webhooks, and provider media downloads depend on that origin.
Set the public origin
Set the three public URL settings before registering callbacks. Use a dedicated subdomain, such as https://post.example.com. OpenPost does not support subpath hosting such as https://example.com/openpost/.
If the origin changes, update each provider app and reconnect its accounts.
What must be reachable
- OAuth callbacks must match the provider portal exactly, including the scheme, host, path, and trailing slash. Copy the path from the provider guide.
- Media URLs must return the file without sign-in or an expiring link. Threads, Facebook, Instagram, and TikTok fetch media from
OPENPOST_MEDIA_URL. TikTok also requires ownership proof for the domain or URL prefix. - Webhooks and MCP must remain reachable at their documented paths when those features are enabled.
Proxy setup
Use the Caddy and Nginx examples. Forward the original host and scheme, the app, /api/v1/, and /media/. Allow the largest upload you plan to accept and disable request buffering for large video uploads.
Set OPENPOST_TRUSTED_PROXY_CIDRS to the networks used by the proxy's connection to OpenPost. With Caddy or Nginx on the same host, use 127.0.0.1/32,::1/128. For containers or tunnels, use their actual upstream addresses or dedicated subnet. The default ignores forwarded IP and scheme headers, so configure this before upgrading an existing HTTPS proxy deployment. Keep the backend private and have the proxy overwrite client-supplied forwarded headers.
IPv4-mapped IPv6 CIDRs such as ::ffff:10.0.0.0/120 are normalized to their IPv4 equivalent, 10.0.0.0/24. Mapped prefixes shorter than 96 bits are rejected because they include addresses outside the IPv4-mapped range.
Recreate the backend after changing its environment, then sign in through the HTTPS URL and save a draft. The session cookie should have Secure.
Before connecting an account, confirm that https://your-domain.example/api/v1/ready returns "status":"ready". Test an uploaded media URL from outside your network too.
Tunnels and existing Traefik setups
A tunnel can provide the public origin for a trial. Set all three URLs to its stable HTTPS address and confirm it accepts the required upload size. For Traefik, route a dedicated subdomain to port 8080 and preserve the original host and scheme.
If a callback or media check fails, use connection troubleshooting.