Reverse proxy

The panel does not need one. It serves HTTPS itself on its port, for the address and the domain alike. Put a proxy in front only when you already run one for other sites and want the panel on 443 beside them.

Install for it

At install, choose 4. Skip SSL and answer yes to binding the panel to 127.0.0.1. Or install without questions:

bash <(curl -Ls https://raw.githubusercontent.com/AbolfazlTafakori/w-ui/main/install.sh) --no-tls --local-only --port 2053 -y

Then tell the panel which address may set the forwarded headers, so that sign-in throttling and "last seen from" use the customer's address rather than the proxy's:

wui setting set --listen 127.0.0.1 --port 2053
# Settings → General → Trusted proxy CIDRs: 127.0.0.1/32

nginx

server {
    server_name panel.example.com;

    location / {
        proxy_pass         http://127.0.0.1:2053;
        proxy_http_version 1.1;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_read_timeout 300s;
        proxy_buffering    off;
    }
    client_max_body_size 16m;

    listen 443 ssl;
    ssl_certificate     /etc/letsencrypt/live/panel.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/panel.example.com/privkey.pem;
}

certbot --nginx -d panel.example.com fills in the TLS half and renews it.

proxy_buffering off and the long read timeout matter: the customer's subscription page and the panel keep a stream open, and a buffering proxy holds it back.

If the panel itself already serves HTTPS, as a default install does, proxy to it as HTTPS instead:

proxy_pass https://127.0.0.1:2053;
proxy_ssl_server_name on;

Caddy

panel.example.com {
    reverse_proxy 127.0.0.1:2053
}

Caddy issues and renews the certificate itself.

The subscription path

Customers' subscription links carry the panel's public address. Behind a proxy, set Settings → Subscription → Reverse Proxy URI to https://panel.example.com/subscribe/ so the links point at the proxy, or give the subscription service its own port and proxy that too.

Keep the panel's own port closed

With a proxy in front, nothing outside should reach the panel directly. Bind it to 127.0.0.1, as above, and do not open its port in the firewall (w-ui → 23).