How to start pydio-cells docker with my own ssl certificate file?

docker run -d --restart=always \
  --name pydio-cells \
  --network pydio \
  --hostname pydio-cells \
  --link pydio-fpm:pydio-fpm \
  --link pydio-mariadb:pydio-mariadb \
  -v /data/pydio/cells:/root/.config/pydio/cells \
  -e \
  -e \

Like this, I want to use https but not self signed. I have a valid certificate for my domain.

Hi there,

The easiest way would be to add a proxy in front of your docker. There are quite a few docker containers to help you with that (traefik, nginx, httpd, caddy, …) You also have a few examples of configuration on that page (

I’ve seen you had submitted a pr to have the certificates setup directly during the installation, so that would be another way. Thanks for that, we’ll review it asap.

Personally, I’d rather have people use a proxy when using the docker version of the pydio cells as it eases the management in the long run to have things clearly separated (as we do for the mysql database and the php fpm for example)



Thanks for reply. I’ve tried nginx reverse proxy before, but failed for several times. There is no nginx sample, so I tried to config by myself. I wrote some simple proxy_pass in the nginx conf file, and the install page runs well. But after installation, the server returned error 500, and I don’t know why.

Here’s nginx docker start command:

docker run -d --restart=always \
  --name pydio-nginx \
  --network pydio \
  --hostname pydio-nginx \
  --link pydio-cells:pydio-cells \
  -v /data/pydio/nginx-confs/nginx.conf:/etc/nginx/nginx.conf \
  -v /data/pydio/nginx-confs/conf.d:/etc/nginx/conf.d/ \
  -v /root/** \
  -v /root/** \
  -p 12080:80 -p 12443:443 nginx

Here’s my conf file in /etc/nginx/conf.d/:

server {
    listen 12080;
    listen [::]:12080;
    # enforce https
    return 301 https://$server_name:12443$request_uri;

server {
    listen 12443 ssl http2;
    listen [::]:12443 ssl http2;

    ssl_certificate /etc/nginx/ssl/;
    ssl_certificate_key /etc/nginx/ssl/;

    fastcgi_read_timeout 600s;

    # Add headers to serve security related headers
    # Before enabling Strict-Transport-Security headers please read into this
    # topic first.
    # add_header Strict-Transport-Security "max-age=15768000;
    # includeSubDomains; preload;";
    # WARNING: Only add the preload option once you read about
    # the consequences in This option
    # will add the domain to a hardcoded list that is shipped
    # in all major browsers and getting removed from this list
    # could take several months.
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;
    add_header X-Download-Options noopen;
    add_header X-Permitted-Cross-Domain-Policies none;

    # Path to the root of your installation
    root /var/www/html;

    # set max upload size
    client_max_body_size 20G;
    fastcgi_buffers 64 4K;

    # Enable gzip but do not remove ETag headers
    gzip on;
    gzip_vary on;
    gzip_comp_level 4;
    gzip_min_length 256;
    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
    gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/ application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

    # Uncomment if your server is build with the ngx_pagespeed module
    # This module is currently not supported.
    #pagespeed off;

    location / {
        proxy_pass http://pydio-cells:12443/;
        proxy_set_header Host $host;

Is there and article about how to setup a proxy in front of pydio docker? Maybe I can read it word by word to figure out where is my mistake.

I’ve tried using caddy as proxy server docker, still get problems.

# install

export DB_PW=Passw0rd
export HTTP_PORT=12080
export HTTPS_PORT=12443
export SSL_CRT_FILE=/root/**
export SSL_KEY_FILE=/root/**
export CADDY_FILE=/data/pydio/caddy/Caddyfile

docker network create --driver bridge --subnet pydio

    redir https://{hostonly}:$HTTPS_PORT{path}
    log stdout

    tls /etc/ssl/ssl.crt /etc/ssl/ssl.key

    timeouts 0

    # And the rest to pydio
    proxy / pydio-cells:$HTTPS_PORT {

docker run -d --restart=always \
  --name pydio-mariadb \
  --network pydio \
  --hostname pydio-mariadb \
  -v /data/pydio/mariadb:/var/lib/mysql \
  -p 12306:3306 \
  -e TZ='Asia/Shanghai' \

docker run -d --restart=always \
  --name pydio-fpm \
  --network pydio \
  --hostname pydio-fpm \
  --link pydio-mariadb:pydio-mariadb \
  -v /data/pydio/cells:/root/.config/pydio/cells pydio/cells-php-fpm

docker run -d --restart=always \
  --name pydio-cells \
  --network pydio \
  --hostname pydio-cells \
  --link pydio-fpm:pydio-fpm \
  --link pydio-mariadb:pydio-mariadb \
  -v /data/pydio/cells:/root/.config/pydio/cells \
  -e CELLS_NO_SSL=1 \

docker restart pydio-fpm

docker run -d \
  --name pydio-caddy \
  --network pydio \
  --hostname pydio-caddy \
  --link pydio-cells:pydio-cells \
  -v /data/pydio/caddy/Caddyfile:/etc/Caddyfile \
  -v $SSL_CRT_FILE:/etc/ssl/ssl.crt:ro \
  -v $SSL_KEY_FILE:/etc/ssl/ssl.key:ro \

# uninstall

docker stop pydio-caddy && docker rm pydio-caddy
docker stop pydio-cells && docker rm pydio-cells
docker stop pydio-fpm && docker rm pydio-fpm
docker stop pydio-mariadb && docker rm pydio-mariadb

rm -rf /data/pydio/cells
rm -rf /data/pydio/mariadb

After install, server returned error 502.

Oooops, I find that the problem is not on the proxy, I’ll create another issue for details now.

Hi, i managed to make it work with apache as a reverse proxy,
you could take a look at how i configured everything it could give you an idea.

<IfModule mod_ssl.c>
<VirtualHost *:443>
  # May be necessary for API direct accesses
  AllowEncodedSlashes On
  RewriteEngine On
   # Make sure to proxy SSL
  SSLProxyEngine On
  # Disable SSLProxyCheck : maybe necessary if Cells is configured with self_signed
  SSLProxyCheckPeerCN Off
  SSLProxyCheckPeerName Off
  SSLProxyVerify none

  # Proxy WebSocket
  RewriteCond %{HTTP:Upgrade} =websocket [NC]
  RewriteRule /(.*)           wss://$1 [P,L]
   # Finally simple proxy instruction
  ProxyPass "/" ""
  ProxyPassReverse "/" ""

# You can use your own path
SSLCertificateFile /home/user/cert/apache.crt
SSLCertificateKeyFile /home/user/cert/apache.key


version: '3'

    # Cells image with two named volumes for the static and for the data
        image: pydio/cells:latest
        restart: always
        volumes: ["static:/root/.config/pydio/cells/static/pydio", "data:/root/.config/pydio/cells/data"]
        ports: ["8080:8080"]
            - CELLS_BIND=
            - CELLS_EXTERNAL=
            - CELLS_NO_SSL=0

    # MySQL image with a default database cells and a dedicated user pydio
         image: mysql:5.7
         restart: always
             MYSQL_ROOT_PASSWORD: root
             MYSQL_DATABASE: cells
             MYSQL_USER: cells
             MYSQL_PASSWORD: cells
         command: [mysqld, --character-set-server=utf8mb4, --collation-server=utf8mb4_unicode_ci]
         ports: ["3306:3306"]

    # PHP FPM image with the static named volume from the cells container
        image: pydio/cells-php-fpm:latest
        restart: always
        volumes: ["static:/root/.config/pydio/cells/static/pydio"]
        ports: ["9000:9000"]

    static: {}
    data: {}

Yeah, my nginx config has no problem, just like what I said above.

The problem is here: if you set CELLS_NO_SSL=1 you’ll get a server error after install.