[Self hosted] proxy and SSL settings are not clear in docs for MinIO

[4rombusiness]

🐛 Bug Report: Image Upload Fails in Production

Thank you for this wonderful project!
I've been experimenting with it for a while, but encountered a problem configuring it in production on my server.

---

⚙️ Environment Details

• Deployment Type: Docker Compose (1-minute setup script)
• Server: Self-hosted (Ubuntu)
• CDN: Cloudflare (Proxy ON)
• Problem: Unable to upload images — 400 error from MinIO endpoint

---

🧾 Configuration Files

compose.yaml

`services:
  museum:
    image: ghcr.io/ente-io/server
    ports:
      - 8080:8080 # API
    depends_on:
      postgres:
        condition: service_healthy
    volumes:
      - ./museum.yaml:/museum.yaml:ro
      - ./data:/data:ro
    healthcheck:
      test: ["CMD", "curl", "--fail", "http://localhost:8080/ping"]
      interval: 60s
      timeout: 5s
      retries: 3
      start_period: 5s

  # Resolve "localhost:3200" in the museum container to the minio container.
  socat:
    image: alpine/socat
    network_mode: service:museum
    depends_on: [museum]
    command: "TCP-LISTEN:3200,fork,reuseaddr TCP:minio:3200"

  web:
    image: ghcr.io/ente-io/web
    # Uncomment what you need to tweak.
    ports:
      - 3000:3000 # Photos web app
      # - 3001:3001 # Accounts
      - 3002:3002 # Public albums
      # - 3003:3003 # Auth
      # - 3004:3004 # Cast
    # Modify these values to your custom subdomains, if using any
    environment:
      ENTE_API_ORIGIN: https://entee_api.MY_DOMAIN.COM
      ENTE_ALBUMS_ORIGIN: https://entee_albums.MY_DOMAIN.COM

  postgres:
    image: postgres:15
    environment:
      POSTGRES_USER: pguser
      POSTGRES_PASSWORD: s6aosq9HqoE+7EzCR21NoqRM4YAU
      POSTGRES_DB: ente_db
    healthcheck:
      test: pg_isready -q -d ente_db -U pguser
      start_period: 40s
      start_interval: 1s
    volumes:
      - postgres-data:/var/lib/postgresql/data

  minio:
    image: minio/minio
    ports:
      - 3200:3200 # MinIO API
      # Uncomment to enable MinIO Web UI      
      # - 3201:3201
    environment:
      MINIO_ROOT_USER: minio-user-oEad0XZw
      MINIO_ROOT_PASSWORD: 3L1vZQqFiRETzMZ4Zd/LvAJzxGr2
    command: server /data --address ":3200" --console-address ":3201"
    volumes:
      - minio-data:/data
    post_start:
      - command: |
          sh -c '
          #!/bin/sh

          while ! mc alias set h0 http://minio:3200 minio-user-oEad0XZw 3L1vZQqFiRETzMZ4Zd/LvAJzxGr2 2>/dev/null
          do
            echo "Waiting for minio..."
            sleep 0.5
          done

          cd /data

          mc mb -p b2-eu-cen
          mc mb -p wasabi-eu-central-2-v3
          mc mb -p scw-eu-fr-v3
          '

volumes:
  postgres-data:
  minio-data:`

museum.yaml

`db:
      host: postgres
      port: 5432
      name: ente_db
      user: pguser
      password: s6aosq9HqoE+7EzCR21NoqRM4YAU

s3:
      are_local_buckets: false #changed this as docs mentioned
      use_path_style_urls: true
      b2-eu-cen:
         # Uncomment the below configuration to override the top-level configuration 
         # are_local_buckets: true
         # use_path_style_urls: true
         key: minio-user-oEad0XZw
         secret: 3L1vZQqFiRETzMZ4Zd/LvAJzxGr2
         endpoint: https://entee_minio.MY_DOMAIN.COM
         region: eu-central-2
         bucket: b2-eu-cen
      wasabi-eu-central-2-v3:
         # are_local_buckets: true
         # use_path_style_urls: true
         key: minio-user-oEad0XZw
         secret: 3L1vZQqFiRETzMZ4Zd/LvAJzxGr2
         endpoint: https://entee_minio.MY_DOMAIN.COM
         region: eu-central-2
         bucket: wasabi-eu-central-2-v3
         compliance: false
      scw-eu-fr-v3:
         # are_local_buckets: true
         # use_path_style_urls: true
         key: minio-user-oEad0XZw
         secret: 3L1vZQqFiRETzMZ4Zd/LvAJzxGr2
         endpoint: https://entee_minio.MY_DOMAIN.COM
         region: eu-central-2
         bucket: scw-eu-fr-v3

# Specify the base endpoints for various web apps
apps:
    # If you're running a self hosted instance and wish to serve public links,
    # set this to the URL where your albums web app is running.
    public-albums: https://entee_albums.MY_DOMAIN.COM
    cast: http://localhost:3004
    # Set this to the URL where your accounts web app is running, primarily used for
    # passkey based 2FA.
    accounts: http://localhost:3001

key:
      encryption: 5mhZiilLlMkE42OMMGYKIYx2zzNkB2bSHPX65SxJ5PY=
      hash: NC7+X/ymwyfsl9F+2NV3nn+h4+OiW2vPeX835Gi4SgoAM+vwZFvwUwpK+yFeJUAhmCeHycEwxBit0w9+/5zoZg==

jwt:
      secret: CxX7ob6RoBO4xz4l55I1DaSV-k-WmcYIqZwuArmCxQs=`

NGINX Configuration

I create account and log in successfully but when I try to upload anything I get:

Failed to load resource: the server responded with a status of 400 ()

https://entee_minio.MY_DOMAIN.COM/b2-eu-cen/1580559962386438/a1d32627-1317-4c9f-8024-30a4c68d444e?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=minio-user-oEad0XZw%2F20251102%2Feu-central-2%2Fs3%2Faws4_request&X-Amz-Date=20251102T050217Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=2468fe3a606774b1e4d2faf44f3ca8ed41eed291e7e033b8bd7e3a00c5dd8370
  


NGINX settings:

# ───────────────────────────────
# Ente Web
# ───────────────────────────────
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name entee_web.MY_DOMAIN.COM;

    ssl_certificate         /etc/ssl/cf-origin/cert.pem;
    ssl_certificate_key     /etc/ssl/cf-origin/key.pem;

    location / {
        proxy_pass http://localhost:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

server {
    listen 80;
    listen [::]:80;
    server_name entee_web.MY_DOMAIN.COM;
    return 301 https://$host$request_uri;
}

# ───────────────────────────────
# Ente Albums
# ───────────────────────────────
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name entee_albums.MY_DOMAIN.COM;

    ssl_certificate         /etc/ssl/cf-origin/cert.pem;
    ssl_certificate_key     /etc/ssl/cf-origin/key.pem;

    location / {
        proxy_pass http://localhost:3002;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

server {
    listen 80;
    listen [::]:80;
    server_name entee_albums.MY_DOMAIN.COM;
    return 301 https://$host$request_uri;
}

# ───────────────────────────────
# Ente API (Museum)
# ───────────────────────────────
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name entee_api.MY_DOMAIN.COM;

    ssl_certificate         /etc/ssl/cf-origin/cert.pem;
    ssl_certificate_key     /etc/ssl/cf-origin/key.pem;

    location / {
        proxy_pass http://localhost:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

server {
    listen 80;
    listen [::]:80;
    server_name entee_api.MY_DOMAIN.COM;
    return 301 https://$host$request_uri;
}
# ───────────────────────────────
server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name entee_minio.MY_DOMAIN.COM;

    ssl_certificate         /etc/ssl/cf-origin/cert.pem;
    ssl_certificate_key     /etc/ssl/cf-origin/key.pem;

    client_max_body_size 0;
    proxy_buffering off;
    ignore_invalid_headers off;

    location / {
        proxy_pass  http://localhost:3200;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $http_host;
        proxy_connect_timeout 300;
        # To support websocket
        # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        chunked_transfer_encoding off;
        
    }

}
# ───────────────────────────────

---

🪵 Logs

Access Log Snippet

172.70.242.126 - - [02/Nov/2025:08:32:36 ] "OPTIONS /b2-eu-cen/1580559962386438/a1d32627-1317-4c9f-8024-30a4c68d444e?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=minio-user-oEad0XZw%2F20251102%2Feu-central-2%2Fs3%2Faws4_request&X-Amz-Date=20251102T050217Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=2468fe3a606774b1e4d2faf44f3ca8ed41eed291e7e033b8bd7e3a00c5dd8370 HTTP/2.0" 204 0 "https://entee_web.MY_DOMAIN.COM/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"
172.70.242.126 - - [02/Nov/2025:08:32:37 ] "PUT /b2-eu-cen/1580559962386438/a1d32627-1317-4c9f-8024-30a4c68d444e?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=minio-user-oEad0XZw%2F20251102%2Feu-central-2%2Fs3%2Faws4_request&X-Amz-Date=20251102T050217Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=2468fe3a606774b1e4d2faf44f3ca8ed41eed291e7e033b8bd7e3a00c5dd8370 HTTP/2.0" 400 339 "https://entee_web.MY_DOMAIN.COM/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"
172.70.243.26 - - [02/Nov/2025:08:32:37 ] "GET /users/session-validity/v2 HTTP/2.0" 200 579 "https://entee_web.MY_DOMAIN.COM/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"
172.70.243.26 - - [02/Nov/2025:08:32:37 ] "GET /remote-store/feature-flags HTTP/2.0" 200 206 "https://entee_web.MY_DOMAIN.COM/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"
172.70.243.26 - - [02/Nov/2025:08:32:37 ] "GET /collections/v2?sinceTime=1761893228152415 HTTP/2.0" 200 42 "https://entee_web.MY_DOMAIN.COM/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"
172.70.243.26 - - [02/Nov/2025:08:32:38 ] "GET /trash/v2/diff?sinceTime=0 HTTP/2.0" 200 51 "https://entee_web.MY_DOMAIN.COM/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"
172.70.243.26 - - [02/Nov/2025:08:32:38 ] "GET /user-entity/entity/diff?type=location&sinceTime=0&limit=500 HTTP/2.0" 200 35 "https://entee_web.MY_DOMAIN.COM/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"

---

❌ Error

When trying to upload any image, I receive this error in the browser console:

Failed to load resource: the server responded with a status of 400 ()

Request URL example:

https://entee_minio.MY_DOMAIN.COM/b2-eu-cen/... (AWS4-HMAC-SHA256 signed URL)

---

🧩 What I Tried

• Verified API endpoints and SSL certificates
• Confirmed MinIO works locally and accessible via HTTPS
• Adjusted are_local_buckets and use_path_style_urls
• Rechecked NGINX proxy headers

---

💭 Expected Behavior

The upload should succeed and the image should appear in the collection.

---

💡 Additional Context

If helpful, I can share more logs or verbose output from the containers.

---

Any help diagnosing why MinIO responds with 400 would be appreciated! 🙏

[PaPa1ya]

If the problem is still relevant, then it seems that you don't need to specify the full URL, just the host. I think that's how it was in the original museum.

endpoint: https://entee_minio.MY_DOMAIN.COM
endpoint: entee_minio.MY_DOMAIN.COM

s3:
      are_local_buckets: false #changed this as docs mentioned
      use_path_style_urls: true
      b2-eu-cen:
         # Uncomment the below configuration to override the top-level configuration 
         # are_local_buckets: true
         # use_path_style_urls: true
         key: minio-user-oEad0XZw
         secret: 3L1vZQqFiRETzMZ4Zd/LvAJzxGr2
         endpoint: entee_minio.MY_DOMAIN.COM
         region: eu-central-2
         bucket: b2-eu-cen
      wasabi-eu-central-2-v3:
         # are_local_buckets: true
         # use_path_style_urls: true
         key: minio-user-oEad0XZw
         secret: 3L1vZQqFiRETzMZ4Zd/LvAJzxGr2
         endpoint: entee_minio.MY_DOMAIN.COM
         region: eu-central-2
         bucket: wasabi-eu-central-2-v3
         compliance: false
      scw-eu-fr-v3:
         # are_local_buckets: true
         # use_path_style_urls: true
         key: minio-user-oEad0XZw
         secret: 3L1vZQqFiRETzMZ4Zd/LvAJzxGr2
         endpoint: entee_minio.MY_DOMAIN.COM
         region: eu-central-2
         bucket: scw-eu-fr-v3