TLS modes (FOG_TLS_MODE)

One setting configures how you open the web UI, how iPXE reaches boot.php, and whether Apache terminates TLS inside the container. This matches FOG 1.6 netboot transport (WEB_url_proto / BOOT_url_proto), extended for Docker and Traefik.

Quick reference

FOG_TLS_MODE Open the UI at PXE / default.ipxe chain Apache :443 in container
standard (default) https://FOG_WEB_HOST/... (trust the FOG CA, or accept the warning) http://…/boot.php Yes (signed by the container FOG CA)
http-only http://FOG_WEB_HOST/... http://…/boot.php No
mounted-certs https://… (your cert files) http://…/boot.php Yes (mounted)
public-cert https://FQDN/... https://FQDN/.../boot.php Yes (mounted public cert)
reverse-proxy https://FQDN/... via proxy only https://FQDN/.../boot.php No (proxy → :80)

Set in .env:

FOG_TLS_MODE=standard

On container start, the entrypoint prints the resolved Browse and Netboot URLs.

Mode details

standard

Default single-server install: HTTPS management UI, HTTP netboot (same as upstream FOG 1.6 standard). The Apache certificate is signed by the FOG CA at /fog/management/other/ca.cert.pem, which is what FOG Agent enrollment trusts. PXE stays on HTTP, so iPXE does not need that CA.

http-only

Plain HTTP for UI and netboot. Use for labs or when debugging protocol issues.

mounted-certs

Mount certificate files into /opt/fog/snapins/ssl/ and set filenames:

FOG_TLS_MODE=mounted-certs
FOG_APACHE_SSL_CERT_FILE=fullchain.pem
FOG_APACHE_SSL_KEY_FILE=privkey.pem

Netboot stays on HTTP unless you switch to public-cert or overrides.

public-cert

HTTPS UI and HTTPS netboot using a publicly trusted certificate (e.g. Let’s Encrypt) on Apache. Requires FOG_WEB_HOST to be the FQDN on the certificate (not an IP).

reverse-proxy

Traefik, Caddy, or Nginx terminates TLS. The container serves HTTP only; PHP on port 80 is told the outside world uses HTTPS (SetEnv HTTPS) so sessions and boot URLs stay on https://.

Do not use http://container-ip:80/fog/management/ for daily admin work — use the proxy URL. See Reverse Proxy Setup and Troubleshooting.

Advanced overrides

Usually leave unset. When set, these override the preset for that field only:

FOG_WEB_PROTOCOL=https   # UI / session semantics
FOG_BOOT_PROTOCOL=http   # default.ipxe and DHCP HTTPBoot URL

Legacy variables

Recommended: set FOG_TLS_MODE in .env (.env.example uses standard).

If FOG_TLS_MODE is empty or unset in the container environment, the entrypoint infers a mode from FOG_INTERNAL_HTTPS_ENABLED and FOG_HTTP_PROTOCOL and logs a reminder to set FOG_TLS_MODE explicitly.

When FOG_TLS_MODE is set, FOG_INTERNAL_HTTPS_ENABLED and FOG_HTTP_PROTOCOL are ignored (use FOG_WEB_PROTOCOL / FOG_BOOT_PROTOCOL for advanced overrides). FOG_HTTP_PROTOCOL is still populated internally as a mirror of FOG_WEB_PROTOCOL for older references.