Reverse Proxy and Seerr

Looking for the basic setup steps instead? See Seerr Setup. This page covers running behind a reverse proxy and how the integration works underneath.

Running behind a reverse proxy

If your server sits behind a reverse proxy (Nginx, Caddy, Traefik, and so on), make sure the proxy forwards every /Moonfin/ path through to your Jellyfin or Emby server, and passes auth headers along. Moonbase serves the web app, settings sync, and all of its APIs under /Moonfin/, so if those paths are not forwarded the web app and integrations will fail.

This matters most for Seerr. Seerr API traffic is proxied through your server at /Moonfin/Seerr/Api/ (and the legacy /Moonfin/Jellyseerr/Api/). If the proxy does not pass those paths through, Seerr requests will not reach Seerr.

Quick check

Open https://<your public address>/Moonfin/Web/ in a browser from outside your network. If the web app loads there, the paths are forwarded and you can stop reading this section.

Examples

Most people proxy the whole server to one hostname. In that case everything under /Moonfin/ is already forwarded and nothing needs adding. The problem only appears when a proxy config lists the paths it allows, or rewrites them.

Nginx (add next to your existing Jellyfin location / block, and copy the same proxy_set_header lines you use there):

location /Moonfin/ {
    proxy_pass http://127.0.0.1:8096;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_buffering off;
}

Caddy forwards every path by default, so a plain reverse_proxy 127.0.0.1:8096 inside your site block is already enough.

Traefik, Nginx Proxy Manager, SWAG: a router or proxy host for the whole hostname forwards /Moonfin/ too. Only add a rule if you used path-based rules such as PathPrefix(/web), in which case add /Moonfin alongside.

Use port 8920 (or whatever you set) instead of 8096 for Emby.

How Seerr integration works

Moonbase talks to Seerr from the server, not the browser. This is what makes single sign-on work: you log in once with your Jellyfin or Emby account, the server exchanges that for a Seerr session, and it stores the session server-side. Every later Seerr request rides that stored session through the proxy, so the client never handles Seerr credentials directly.

The plugin handles redirects, reverse-proxy sub-paths, and domain differences on the server side. If Seerr integration is not working, check that:

• Seerr is enabled and its URL is set in the Moonbase admin panel
• Your reverse proxy forwards /Moonfin/ paths, including /Moonfin/Seerr/Api/
• Auth headers are passed through by the proxy

Request and issue notifications (webhooks)

Moonbase can notify users about Seerr request and issue activity. To do that, it registers a webhook in Seerr that points back at your server's /Moonfin/Seerr/Webhook endpoint. That inbound webhook is authenticated with a shared secret rather than a login, so it must be reachable through your proxy too.

From the admin panel you can view the webhook URL, its secret, and the current provisioning status, and re-register the webhook if you ever need to. Users choose what they want to be notified about in their own notification preferences.

Seerr Notifications covers the whole thing in detail, including which events fire, who receives them, push setup, and how notifications appear on each client.

See API Reference for the Seerr and notification endpoints.