Mixed Content Warnings behind reverse proxy

[PatDyn]

Describe the Bug

I'm getting mixed content warnings when calling https://my.bookstack.instance.
It seems content is served under http://my.bookstack.instance although the APP_URL is set to https://my.bookstack.instance.

I recently updated the APP_URL following this: https://www.bookstackapp.com/docs/admin/commands/#update-system-url and doing php artisan cache:clear.

I'm currently out of options trying anything else - that's why I think there might be a bug.

I set up bookstack using docker compose behind an nginx reverse proxy.
The reverse proxy terminates SSL and forwards requests to my docker compose service.

Steps to Reproduce

1. Set up a reverse proxy with SSL on a VPS
2. Set up a docker compose service using bookstack
3. Visit the site

Expected Behaviour

Files are served through https://... instead of http://... with APP_URL set to https://...

Screenshots or Additional Context

No response

Browser Details

No response

Exact BookStack Version

v25.12.4

[ssddanbrown]

Hi @PatDyn,

I recently updated the APP_URL following this: https://www.bookstackapp.com/docs/admin/commands/#update-system-url and doing php artisan cache:clear.

Did you also run that command found at the link? Just want to be sure you ran that, and it displayed some counts in the output of content which was updated.

I recently updated the APP_URL

Where exactly did you set this? And have you re-created the stack (down and up, not just restart) since changing this option?

[PatDyn]

Hey, thanks for the quick response!
Yes I did run that command, changing the IP of the host to the new URL (e.g. from http://192.168.123.123:9000 to https://my.bookstack.instance). The command returned a table with some counts of course.

I initially set the APP_URL as an Environment Variable of the bookstack docker compose service.
Just to make sure I added it also to the app.ini and then restarted the service.

[ssddanbrown]

Thanks for confirming.

What docker image are you using for BookStack?

When you hover over an internal link when in BookStack, does the popup in the corner of the browser with the link show http:// or https://?

If http://, how exactly did you set it as an environment variable (just want to confirm the exact file/method, since it can be done in a few ways in docker).
BTW, i wouldn't expect it to be part of any kind of .ini file unless there's a real funky setup at play.

Do the mixed warnings show on all views, or just some? Does it show when viewing the <URL>/licenses page on your instance?

[PatDyn]

I build my own image as defined here: https://codeberg.org/patdyn/docker-bookstack-nginx/src/branch/main - so I had to rebuild this image in order to update the app.ini.

Update: Just for the sake of it I used the php artisan bookstack:update-url to change the APP_URL to something different to provoke the "You still need to update your APP_URL env value. This is currently set to:
https://my.bookstack.instance" warning. That way i could make sure the APP_URL is actually set correctly.

Update2: I just read some of the other issues indicating v25.12.4 as a problematic version, so upgraded v25.12.8 and the issue persists.

Any internal link in bookstack shows up as http:// link. The mixed content warning occurs on all pages and the <URL>/licenses page does not exist on that instance. This is a snippet of the docker-compose.yaml showing how i set the env vars:

services:
  nginx:
    build:
      context: .
      dockerfile: nginx/Dockerfile
    networks:
      - internal
      - external
    ports:
      - 9000:9000
    volumes:
      - ./nginx/sites-enabled/:/etc/nginx/sites-enabled:ro
      - /data/bookstack-data/:/var/www/bookstack:rw
      - ./logs/nginx:/var/log/nginx/
    restart: always
  bookstack:
    build:
      context: .
      dockerfile: php/Dockerfile
    networks:
      - internal
    volumes:
      - /data/bookstack-data/:/var/www/bookstack:rw
    depends_on:
      - db-bookstack
    environment:
      ADMIN_NAME: "admin_name"
      ADMIN_EMAIL: "admin@example.com"
      ADMIN_PASSWORD_FILE: /run/secrets/bookstack_admin_pass
      DB_HOST: db-bookstack:3306
      DB_DATABASE: bookstack
      DB_USERNAME: bookstack
      DB_PASSWORD_FILE: /run/secrets/db_pass
      APP_URL: "https://my.bookstack.instance"
      APP_PROXIES: "[reverse-proxy-ip]"
    expose:
      - 9000
    secrets:
      - db_pass
      - bookstack_admin_pass
    restart: always

[ssddanbrown]

Thanks @PatDyn,

What's this bit of code doing?:
https://codeberg.org/patdyn/docker-bookstack-nginx/src/commit/eec3d89e13bc22d4b5d156be7ac767aa3325b145/php/scripts/docker-entrypoint.sh#L11-L15

I couldn't find any other references to the APP_URL_PROX, so I'm wondering (if not set elsewhere) if this is essentially blanking out the APP_URL via the entrypoint?