HTTPS and a reverse proxy

killBottleneck itself speaks plain HTTP. To reach it from outside your LAN, put it behind a VPN or a reverse proxy that terminates TLS.

Caddy (automatic certificates)

# Caddyfile
killbottleneck.your-domain.com {
    encode gzip zstd
    reverse_proxy 127.0.0.1:8090
}

Add Caddy to the stack through docker-compose.override.yml — that file is not overwritten by updates:

services:
  caddy:
    image: caddy:2
    ports: ["80:80", "443:443"]
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
volumes:
  caddy_data:

Turn compression on — it is a threefold saving

killBottleneck does not compress responses itself. There is no way to enable it in PocketBase without changing how the API behaves when it rejects an oversized body, so the job belongs to your proxy.

The main frontend file is 488 kB uncompressed and 157 kB gzipped. On mobile data that is the difference you notice most when opening the app for the first time.

• Caddy — the encode gzip zstd line above
• nginx — gzip on; gzip_types application/javascript text/css;
• Cloudflare and similar — happens on its own, nothing to configure

What HTTPS unlocks

Two features exist only in a secure context, because browsers refuse them over plain HTTP:

• Share… for the My day image — your phone's native share dialog, with no third-party service in the path
• Adding the app to your phone's home screen — a service worker only runs over HTTPS

Neither needs configuring. On an HTTPS domain they simply appear.

Do not forget the redirect URI

If you use Google sign-in, the authorized redirect URI in the Google Cloud Console must match the public HTTPS address:

https://killbottleneck.your-domain.com/api/oauth2-redirect