# How to add TLS using nginx **URL:** \ **Category:** Support\ **Created:** [May 16, 2024, 8:04am UTC](https://openziti.discourse.group/t/how-to-add-tls-using-nginx/2566 "2024-05-16T08:04:31Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![sigoko7829](https://avatars.discourse-cdn.com/v4/letter/s/d07c76/32.png) [@sigoko7829](https://openziti.discourse.group/u/sigoko7829)\ **Post date:** [May 16, 2024, 8:04am UTC](https://openziti.discourse.group/t/how-to-add-tls-using-nginx/2566/1 "2024-05-16T08:04:31Z")
absolute noob here. self-hosted using docker. copied every line to line. now I want to enable TLS using nginx. I was able add TLS using nginx. now I want to change url template. but, I don't know how to get token. when I run `zrok admin list frontends`, it asks me to provide admin token. but even when I provide` ZROK_ADMIN_TOKEN` it says `panic: [GET /frontends][401] listFrontendsUnauthorized`. how do I get token? ---
**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\ **Post date:** [May 16, 2024, 10:59am UTC](https://openziti.discourse.group/t/how-to-add-tls-using-nginx/2566/2 "2024-05-16T10:59:14Z")
Hey @sigoko7829! Are you following this guide: [Self-hosting guide for Docker | Zrok](https://docs.zrok.io/docs/guides/self-hosting/docker/)? I understand you don't want to use the included Caddy container to automatically renew you wildcard TLS certificate, and you have set up Nginx with an external certificate renewal process instead. If you change your mind and decide to follow that guide to enable Caddy by renaming `caddy.compose.override.yml` as `compose.override.yml` and providing the API token from your DNS provider, then the frontend will be automatically updated. That extra Compose file enables Caddy and sets these environment variables on the frontend container so that it will configure the "public" frontend's template on startup. You can change the `zrok-frontend` container/service in your Compose file to override its entrypoint or change it in `zrok-frontend.Dockerfile` if you wish to disable env var auto-configuration. ```yaml zrok-frontend: environment: ZROK_FRONTEND_SCHEME: https ZROK_FRONTEND_PORT: 443 ``` * * * Here's the manual process that's applicable to zrok generally. This is done automatically in the Docker project from the guide by the frontend container's entrypoint script. Assuming you followed that guide, you can run `zrok admin` commands in the frontend container (not the controller container) like this, but changes to the frontend template will be reset the next time the frontend container starts. See the above env vars to persist the change, even if not using Caddy. ```bash docker compose exec zrok-frontend zrok admin list frontends ``` ```plaintext TOKEN ZID PUBLIC NAME URL TEMPLATE CREATED AT UPDATED AT GL5LZOJuv9Xi jCMfHELM4 public http://{token}.local.bingnet.cloud:8080 2024-05-16 10:52:48.293 +0000 UTC 2024-05-16 10:52:48.293 +0000 UTC ``` That reveals your current frontend template and the "public" frontend token, which is necessary for updating the template. Now, we can update the template to use the Nginx or Caddy reverse proxy, which modifies the URL of new public shares. ```bash docker compose exec zrok-frontend zrok admin update frontend "GL5LZOJuv9Xi" --url-template 'https://{token}.local.bingnet.cloud:443' ``` ```plaintext [0.016] INFO main.(*adminUpdateFrontendCommand).run: updated global frontend 'GL5LZOJuv9Xi' ``` ```bash docker compose exec zrok-frontend zrok admin list frontends ``` ```auto TOKEN ZID PUBLIC NAME URL TEMPLATE CREATED AT UPDATED AT GL5LZOJuv9Xi jCMfHELM4 public https://{token}.local.bingnet.cloud:443 2024-05-16 10:52:48.293 +0000 UTC 2024-05-16 10:55:26 +0000 UTC ``` ---
**Author:** ![sigoko7829](https://avatars.discourse-cdn.com/v4/letter/s/d07c76/32.png) [@sigoko7829](https://openziti.discourse.group/u/sigoko7829)\ **Post date:** [May 16, 2024, 11:46am UTC](https://openziti.discourse.group/t/how-to-add-tls-using-nginx/2566/3 "2024-05-16T11:46:25Z")
thanks, it worked 🧡 how do I mark your reply solved, btw? ---
**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\ **Post date:** [May 16, 2024, 11:49am UTC](https://openziti.discourse.group/t/how-to-add-tls-using-nginx/2566/4 "2024-05-16T11:49:56Z")
Cool, thanks for letting me know! I don't know of a way to mark an answer in this forum. 🤷 Did you decide to set the env vars like this so the frontend will auto-configure itself for TLS even without Caddy? ```yaml zrok-frontend: environment: ZROK_FRONTEND_SCHEME: https ZROK_FRONTEND_PORT: 443 ``` BTW, the same vars can go in the `.env` file or be set in the parent process environment of the Docker host. ---
**Author:** ![sigoko7829](https://avatars.discourse-cdn.com/v4/letter/s/d07c76/32.png) [@sigoko7829](https://openziti.discourse.group/u/sigoko7829)\ **Post date:** [May 16, 2024, 11:58am UTC](https://openziti.discourse.group/t/how-to-add-tls-using-nginx/2566/5 "2024-05-16T11:58:00Z")
no, i did not configure caddy at all. also i did not change env vars as you mentioned in your last reply. my `zrok` is running in non-tls mode and nginx handling the tls ---
**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\ **Post date:** [May 16, 2024, 12:01pm UTC](https://openziti.discourse.group/t/how-to-add-tls-using-nginx/2566/6 "2024-05-16T12:01:47Z")
Yeah you can use Nginx for sure. You might not have seen the info I added about how the vars will persist the frontend template, whereas setting it manually with `zrok admin` will not. It's because the frontend container in this project uses env vars to auto-configure on startup, so it will go back to non-TLS next time you restart the frontend container. If you just set these two vars in your .env or the compose file it will auto-configure for TLS. ```bash ZROK_FRONTEND_SCHEME: https ZROK_FRONTEND_PORT: 443 ```