Reverse proxy

nooks speaks plain HTTP and expects something else to terminate TLS. Any proxy will do; what matters is that the event stream is not buffered, and that nooks is told it is behind TLS rather than left to guess.

Do not buffer the event stream

Live updates are server-sent events on /api/v1/events. A proxy that buffers responses will hold them until the connection closes, which looks exactly like updates being broken — ticks from other people simply never arrive.

location /api/v1/events {
    proxy_pass http://127.0.0.1:8081;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
    proxy_buffering off;
    proxy_read_timeout 1h;
}

location / {
    proxy_pass http://127.0.0.1:8081;
    proxy_set_header Host $host;
}

Caddy does the right thing without being told:

nooks.example {
    reverse_proxy 127.0.0.1:8081
}

Tell nooks it is behind TLS

Set NOOKS_SECURE_COOKIES=true. The session cookie is then marked Secure, so a browser will never send it over plain HTTP, and it is renamed to __Host-nooks_session.

That prefix is a promise to the browser: refuse this cookie unless it came from exactly this host, over HTTPS, with no domain set. It is what stops something on a neighbouring subdomain of yours planting a session cookie for everybody on the parent domain.

Because the name changes, everybody signed in at the moment you turn it on signs in once more. Nothing has gone wrong; the browser is holding a cookie under the old name and the instance is now asking for the new one.

nooks does not work this out for itself and does not read X-Forwarded-Proto. Behind a proxy the server sees plain HTTP even though the person using it does not, and a forwarded header is only as trustworthy as whatever sent it — so this is a deployment fact you state rather than one the server guesses at.

Leave it off while the instance is served over plain HTTP, on a LAN address say. A browser refuses to store a Secure cookie on an insecure origin, so turning it on without TLS is what makes signing in appear to do nothing.

Offline, and installing it as an app

nooks keeps a copy of the app on the machine that opened it, so reading a list works with no signal, including after closing the tab and opening it again. It is also what lets a phone install nooks to its home screen.

Browsers allow that only in a secure context: HTTPS, or the machine the instance runs on. Over plain HTTP at a LAN address such as http://192.168.1.20:8081 the browser refuses, and nooks falls back to what it did before. Everything works while the tab is open, and reopening it needs the instance to answer.

So if people use your instance from their phones, TLS is not only about eavesdropping. It is the difference between a list that works in a shop and one that does not.