Repository navigation
docs(android): document Coolify pairing behind basic auth - #123
Merged
Merged
Conversation
Explain the public wss address, loopback-safe QR setup, and the nginx login the official Android app cannot send yet. Co-authored-by: Andras Bacsai <andrasbacsai@users.noreply.github.com>
andrasbacsai
marked this pull request as ready for review
November 15, 2026 10:57
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Coolify's HTTPS hostname reaches this image through nginx, which asks for HTTP basic auth before the gateway sees the WebSocket. The official Android app can be given a public
wssaddress while the gateway stays on loopback, and it still cannot send that nginx login.Refs #118
What changed
Scope
Covers the public WebSocket address, pairing URL setup, the two credentials, and interim options that leave basic auth in place. The Android client, nginx, and
AUTH_PASSWORDbehavior stay as they are.Tradeoffs
The interim options are the phone browser, the Mac app's SSH transport, and Tailscale with its VPN-switching cost. Clearing the nginx password, and publishing the raw gateway port, were rejected.
Blast Radius
Documentation only. A deploy of this commit does not change a running gateway.
Verification
mergedis false, and its last update was 2026-11-04 (rechecked 2026-11-15).GatewayProxyAuth.ktis HTTP 404 on the default branch,v2026.10.10,v2026.11.3, andv2026.11.5-beta.3.gateway.publicOrigin, the loopback QR error, and the--urloverride in OpenClawv2026.11.3(the fallback text is also inv2026.10.10). This repo has no dedicated env var for that key. Grep ofscripts/configure.js,scripts/entrypoint.sh, and the Dockerfiles matches the keys, paths, and ports named in the page. Linked docs pages returned HTTP 200.node scripts/utils.test.jspassed 568.node scripts/nginx-bearer.test.jspassed 128 afterapache2-utilssuppliedhtpasswd.node scripts/docker-cli.test.jspassed 46.node scripts/image-update-guard.test.jspassed 59.