Reverse proxies, Cloudflare Access and Pangolin

Forked supports Mealie on a root hostname or IP address. It cannot complete browser-based login flows, so anything in front of Mealie has to let Forked’s requests through.

• Direct LAN access
• Local plain HTTP on private addresses
• Public HTTPS
• Tailscale with HTTPS enabled
• Caddy or Traefik reverse proxies at a dedicated host
• Cloudflare Tunnel for review or demo access
• Local or private HTTPS with a self-signed or mkcert certificate, with Trust local self-signed HTTPS turned on

Your proxy must preserve the Authorization header and expose Mealie at the host root. An interactive login wall such as Authentik must not sit in front of the Mealie API routes Forked uses.

If your gateway can accept headers instead, add them under Connection Options (below). Otherwise, bypass the Mealie API and media routes or give Forked a separate hostname that reaches Mealie directly.

A sign-in proxy that accepts headers works with request headers.

1. Open Connection Options when you enter your server address, or go to Settings → Edit Connection.

2. Under Request Headers, add your proxy’s headers:

   • Cloudflare Access service token: CF-Access-Client-Id and CF-Access-Client-Secret.
   • Pangolin: the header name and value you set for header authentication.

3. Save and connect.

Forked keeps the values in this iPhone’s Keychain and sends them only to your server’s address, never to other sites. Disconnect & Reset removes them.