Pelican Docker Step By Step

Connect your Drako Bot v2 dashboard to a public HTTPS address when the bot runs in Pelican, Pterodactyl, or Docker.

Before starting, install the dashboard addon and configure its license and Discord credentials using Dashboard Setup. Use a bot release that supports both Hosting and TrustedProxies.

If your hosting provider manages the server, they will need to set up the HTTPS proxy. Docker and Nginx commands run in the host's SSH terminal, not Pelican's bot console.

1

Find your dashboard port

Pelican: Open your bot server's Network page and find the dashboard allocation: its assigned address and port. Ask your host for an extra allocation if needed. Keep the existing primary allocation unless your host tells you to change it.

Confirm these two values with your host:

• Container port: the port Drako should listen on. This normally matches the allocation port, unless your host uses port translation.

• Proxy destination: the HTTP address Nginx or Cloudflare Tunnel can use to reach the dashboard.

Self-managed Docker: Use your existing deployment. If the proxy runs directly on the Docker host, a port mapping such as 127.0.0.1:3016:3000 gives Drako container port 3000 and the proxy destination http://127.0.0.1:3016. Add the mapping to your existing service and redeploy with your configuration and data stored persistently. See Docker port publishing.

If the proxy runs in another container on a shared Docker network, use the bot's service name and container port, for example http://drako:3000. That route does not require a published host port. See Docker Compose networking.

127.0.0.1 always refers to the machine or container making the connection. A separate proxy container or server needs a destination it can reach.

2

Configure Drako

The examples below use https://dashboard.example.com and container port 3000. Replace both with your values.

config/core.yml

Update your existing Dashboard section, keeping its license and credentials:

Dashboard:
  Enabled: true
  URL: "https://dashboard.example.com"
  Port: 3000
  Hosting: "container"

.env / hosting variables

Update the equivalent settings:

DASHBOARD_ENABLED=true
DASHBOARD_URL=https://dashboard.example.com
DASHBOARD_PORT=3000
DASHBOARD_HOSTING=container

When Drako loads a .env file, it uses that file instead of the core.yml dashboard section. Hosting environment variables can override either file. Edit the source your bot actually uses.

Hosting: "container" makes the dashboard listen on the container's network interface. Remove an old Host: "127.0.0.1" or DASHBOARD_HOST=127.0.0.1 override if present; it would prevent connections through the container's published port.

Save and restart the bot. Keep its existing session secret; Drako generates one automatically when needed.

3

Connect your HTTPS address

First, have your host test the proxy destination from where the proxy runs. For the Docker host example:

curl -I http://127.0.0.1:3016/

Expect 200 with a Content-Type containing text/html. Use your actual destination for Pelican or a separate proxy container. Keep this connection on HTTP: setting Drako's public URL to HTTPS does not enable TLS on its internal listener.

Then choose one proxy:

• Cloudflare Tunnel: Create the tunnel and install its connector, add your dashboard hostname, and enable the public HTTPS redirect. Set the route's service type to HTTP and its destination to the address you just tested. Leave the path empty.

• Nginx: Point your domain to the proxy server, configure a separate dashboard site, and obtain its HTTPS certificate. Set proxy_pass to the tested HTTP destination. Keep the proxy headers from that guide, including proxy_set_header X-Forwarded-Proto $scheme; when Nginx handles HTTPS directly.

Use those guides for the proxy installation, while keeping the container settings from this page. Your public HTTPS address should now open the dashboard without a certificate warning.

4

Set the Discord callback

Open your bot's application in the Discord Developer Portal. Under OAuth2 → Redirects, add and save:

https://dashboard.example.com/api/auth/callback

Replace the domain with your dashboard domain. Keep /api/auth/callback out of Dashboard.URL.

Drako uses this callback automatically. If you already have RedirectURI or DASHBOARD_REDIRECTURI configured, update it to the same address and restart the bot.

5

Configure trusted proxies

The homepage can work while login fails. Drako must trust the proxy reporting that the visitor used HTTPS before it can issue a secure login cookie. Hosting: "container" does not automatically grant that trust.

Open the public HTTPS dashboard, click Sign in with Discord, and check the bot console. If you see this warning, note the address after Connection source::

Dashboard OAuth cannot set a secure session cookie: check X-Forwarded-Proto and proxy trust. Connection source: 192.0.2.10.

Ask your host to confirm that this address belongs to the intended proxy or its connection through the Docker host. It may differ from the host's public IP or the proxy container's IP.

The examples below show where to add the trusted proxy alongside your existing dashboard connection settings. Use 192.0.2.10 only as an example; replace it with the confirmed source IP. Keep your own domain, container port, license, and Discord credentials.

config/core.yml

Add TrustedProxies to your existing Dashboard section at the same indentation as Hosting. Keep one Dashboard section:

Dashboard:
  Enabled: true
  URL: "https://dashboard.example.com"
  Port: 3000
  Hosting: "container"
  TrustedProxies: "192.0.2.10"
  # Keep your existing license and Discord credentials here.

.env / hosting variables

Add DASHBOARD_TRUSTEDPROXIES alongside your existing dashboard settings:

DASHBOARD_ENABLED=true
DASHBOARD_URL=https://dashboard.example.com
DASHBOARD_PORT=3000
DASHBOARD_HOSTING=container
DASHBOARD_TRUSTEDPROXIES=192.0.2.10
# Keep your existing license and Discord credentials.

If your bot loads .env, make the change there; the YAML dashboard section is not used. Check for hosting environment variables that override the file.

Replace the example IP with the confirmed source address. Multiple exact IPv4 or IPv6 addresses can be separated by commas in one quoted string. Do not use a YAML list, hostname, port, wildcard, or network range. TrustLoopbackProxy alone does not trust a remote proxy address.

The proxy must also forward X-Forwarded-Proto: https for HTTPS visitors. If Cloudflare Tunnel connects through Nginx, Nginx must preserve the original HTTPS header instead of replacing it with the tunnel's HTTP connection scheme. Have your administrator restrict the backend to the intended proxy and configure trustworthy forwarded headers. See Express proxy handling.

Save, restart the bot, and start a fresh sign-in from the dashboard. If login already works and there is no warning, keep your working proxy settings.

6

Check sign-in

Open your public dashboard URL in a private browser window. Sign in, open a server you manage, then sign out and back in. The secure-cookie warning should be gone.

If login still fails, use the checks below.

Problem	What to check
Connection refused or 502 Bad Gateway	The bot is running, the allocation or mapping matches Drako's container port, and the proxy can reach its HTTP destination. Check for an old loopback Host override.
Connection times out	The destination address, routing, and firewall permit access from the proxy.
Secure session cookie warning	The confirmed source IP is in TrustedProxies, the proxy forwards the HTTPS protocol, and the bot restarted with the active settings.
Missing, expired, or mismatched sign-in state	Fix any secure-cookie warning first, then start a new sign-in. If it persists, check that /auth/discord sets the drako.sid cookie and the callback sends it back.
Discord rejects the redirect	Its registered redirect matches Drako's callback exactly, including scheme, domain, port if used, and path.
“This session could not verify the request”	Open the exact configured public URL and start a fresh session.

If containers or networks are recreated and login stops working, check whether the proxy's source IP changed. Keep HTTPS enabled while fixing proxy trust.

For an intentional direct HTTP allocation, use http://HOST:OUTSIDE_PORT as the public URL and in the Discord callback, while keeping Hosting: "container" and the correct container port. Skip the HTTPS proxy steps. HTTP leaves login sessions unencrypted; use the HTTPS setup above for a public dashboard.

Need your host's help?

Send this message with your own domain and port details:

I'm setting up the Drako Bot dashboard at https://dashboard.example.com with Hosting set to container. Please confirm its container port and the HTTP destination for Nginx or Cloudflare Tunnel, configure the HTTPS proxy, and confirm the connection source IP Drako should trust. The proxy needs to forward the original HTTPS protocol, and the backend should be restricted to the intended proxy.

Include any relevant bot warning and whether you use core.yml, .env, or hosting variables. Remove credentials, license keys, cookies, and OAuth callback codes from anything you share.