I have a spare PC in which I replicate all my “production” systems, all on docker containers (MariadB+HA+ a bunch of others).
I have a script that daily update container images and restart all the dockers, the only difference from my primary system is that the network created on the spare PC is an isolated network.
The intent of that is to have a running replica of all my things ant in the event of a major problem on my primary system the only change needed on the spare one is an hostname/IP change on the host and the change of the segregated docker network to a “normal” one to get fully running and accessible services in a short time. All this without having 2 instances of HA conflicting each other with all the IP addressable devices (Modbus, REST etc etc).
I have a secondary network, wich is externally reachable, and a Nginx proxy, also on docker which is connected to both networks.
Nginx proxy the EXTERNAL-IP:80 external port to the HAOS-DOCKER-NAME:8123 internal port.
I can reach HA login page but after logging in the answer is inevitably “Unable to connect to Home Assistant.”
In the config YAML I have what I think is the correct proxy config:
http:
use_x_forwarded_for: true
trusted_proxies:
- 172.0.0.0/8 <---docker class A IP range both docker network are in this IP space
- 127.0.0.1
and NginX with this config:
http {
server {
listen 80;
server_name EXTERNAL-SPARE-PC-IP:80;
location / {
#proxy_redirect http:// https://;
proxy_pass http://homeassistant:8123/; <--- HA docker name
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
# Enabling this will make all requests give 400 error
#proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection “upgrade”;
# WebSocket support
proxy_http_version 1.1;
}
}
In HA the errors are all like this one:
2026-08-20 22:19:11.799 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from nginx.mynetwork (172.18.0.10). Requested URL: '/auth/token'. (Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0)
where nginx.mynetwork (172.18.0.10) is the Nginx docker name on the INTERNAL SEGREGATED network
What dumb thing am I missing??
EDIT: this configuration used to work some month ago, the “only” change have been multiple HA docker image updates, I use the spare PC as a test for all the integrations before upgrading my primary system, I did not upgrade HA docker on the production PC for some month so I detected the error only when tried to access my secondary system to prepare for an upgrade I wanted to plan, Now I have updated blindily my primary system and luckily all went well so primary and spare have now the same version, the same config (apart from the http proxy section).