Corsfix
Corsfix is an open source CORS proxy platform for fetching APIs from browser applications, with origin and target allowlists, encrypted API secrets, response caching, and a management dashboard.
Deploy Corsfix on Dokploy
- Install Dokploy on your server if you haven't already.
- In your Dokploy panel, open a project and click Create Service → Template.
- Search for Corsfix and click Create — Dokploy configures domains, environment variables, and volumes for you.
Alternatively, create a Compose service, go to Advanced → Import from Base64, and paste this payload:
ewogICJjb21wb3NlIjogInNlcnZpY2VzOlxuICBjb3JzZml4OlxuICAgIGltYWdlOiBnaGNyLmlvL2NvcnNmaXgvY29yc2ZpeC1hcHA6ODg5OWJiMTVlNzFjNzIzODI4NWNjZWZjNGM5NWEwY2Q0N2RhZWFmMFxuICAgIHBsYXRmb3JtOiBsaW51eC9hbWQ2NFxuICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkXG4gICAgZXhwb3NlOlxuICAgICAgLSBcIjMwMDBcIlxuICAgIGVudmlyb25tZW50OlxuICAgICAgTU9OR09EQl9VUkk6IG1vbmdvZGI6Ly9jb3JzZml4OiR7TU9OR09EQl9QQVNTV09SRH1AbW9uZ29kYjoyNzAxNy9kYj9hdXRoU291cmNlPWFkbWluXG4gICAgICBSRURJU19VUkk6IHJlZGlzOi8vZGVmYXVsdDoke1JFRElTX1BBU1NXT1JEfUByZWRpczo2Mzc5XG4gICAgICBLRUtfVkVSU0lPTjogS0VLX1ZFUlNJT05fMVxuICAgICAgS0VLX1ZFUlNJT05fMTogJHtLRUtfVkVSU0lPTl8xfVxuICAgICAgQVVUSF9TRUNSRVQ6ICR7QVVUSF9TRUNSRVR9XG4gICAgICBBVVRIX1RSVVNUX0hPU1Q6IFwidHJ1ZVwiXG4gICAgICBBVVRIX1VSTDogJHtBVVRIX1VSTH1cbiAgICAgIFBST1hZX0RPTUFJTjogJHtQUk9YWV9ET01BSU59XG4gICAgICBESVNBQkxFX1NJR05VUDogJHtESVNBQkxFX1NJR05VUDotZmFsc2V9XG4gICAgZGVwZW5kc19vbjpcbiAgICAgIG1vbmdvZGI6XG4gICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5XG4gICAgICByZWRpczpcbiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHlcblxuICBjb3JzZml4LXByb3h5OlxuICAgIGltYWdlOiBnaGNyLmlvL2NvcnNmaXgvY29yc2ZpeC1wcm94eTo4ODk5YmIxNWU3MWM3MjM4Mjg1Y2NlZmM0Yzk1YTBjZDQ3ZGFlYWYwXG4gICAgcmVzdGFydDogdW5sZXNzLXN0b3BwZWRcbiAgICBleHBvc2U6XG4gICAgICAtIFwiODBcIlxuICAgIGVudmlyb25tZW50OlxuICAgICAgTU9OR09EQl9VUkk6IG1vbmdvZGI6Ly9jb3JzZml4OiR7TU9OR09EQl9QQVNTV09SRH1AbW9uZ29kYjoyNzAxNy9kYj9hdXRoU291cmNlPWFkbWluXG4gICAgICBSRURJU19VUkk6IHJlZGlzOi8vZGVmYXVsdDoke1JFRElTX1BBU1NXT1JEfUByZWRpczo2Mzc5XG4gICAgICBLRUtfVkVSU0lPTl8xOiAke0tFS19WRVJTSU9OXzF9XG4gICAgICBBUFBfRE9NQUlOOiAke0FQUF9ET01BSU59XG4gICAgICBSUE06ICR7UlBNOi0xODB9XG4gICAgICBBTExPV0VEX09SSUdJTlM6ICR7QUxMT1dFRF9PUklHSU5TOi19XG4gICAgICBBTExPV0VEX1RBUkdFVFM6ICR7QUxMT1dFRF9UQVJHRVRTOi19XG4gICAgZGVwZW5kc19vbjpcbiAgICAgIG1vbmdvZGI6XG4gICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5XG4gICAgICByZWRpczpcbiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHlcblxuICBtb25nb2RiOlxuICAgIGltYWdlOiBtb25nbzo4LjAuMTdcbiAgICByZXN0YXJ0OiB1bmxlc3Mtc3RvcHBlZFxuICAgIGVudmlyb25tZW50OlxuICAgICAgTU9OR09fSU5JVERCX1JPT1RfVVNFUk5BTUU6IGNvcnNmaXhcbiAgICAgIE1PTkdPX0lOSVREQl9ST09UX1BBU1NXT1JEOiAke01PTkdPREJfUEFTU1dPUkR9XG4gICAgICBNT05HT19JTklUREJfREFUQUJBU0U6IGRiXG4gICAgdm9sdW1lczpcbiAgICAgIC0gbW9uZ29kYi1kYXRhOi9kYXRhL2RiXG4gICAgICAtIG1vbmdvZGItY29uZmlnOi9kYXRhL2NvbmZpZ2RiXG4gICAgaGVhbHRoY2hlY2s6XG4gICAgICB0ZXN0OlxuICAgICAgICAtIENNRC1TSEVMTFxuICAgICAgICAtID4tXG4gICAgICAgICAgbW9uZ29zaCAtLXF1aWV0IC0tdXNlcm5hbWUgXCIkJHtNT05HT19JTklUREJfUk9PVF9VU0VSTkFNRX1cIlxuICAgICAgICAgIC0tcGFzc3dvcmQgXCIkJHtNT05HT19JTklUREJfUk9PVF9QQVNTV09SRH1cIiAtLWF1dGhlbnRpY2F0aW9uRGF0YWJhc2UgYWRtaW5cbiAgICAgICAgICAtLWV2YWwgJ3F1aXQoZGIuYWRtaW5Db21tYW5kKHsgcGluZzogMSB9KS5vayA/IDAgOiAxKSdcbiAgICAgIGludGVydmFsOiAxMHNcbiAgICAgIHRpbWVvdXQ6IDVzXG4gICAgICByZXRyaWVzOiAxMFxuICAgICAgc3RhcnRfcGVyaW9kOiAzMHNcblxuICByZWRpczpcbiAgICBpbWFnZTogcmVkaXM6Ny40LjExLWFscGluZVxuICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkXG4gICAgY29tbWFuZDogW1wicmVkaXMtc2VydmVyXCIsIFwiLS1yZXF1aXJlcGFzc1wiLCBcIiR7UkVESVNfUEFTU1dPUkR9XCIsIFwiLS1hcHBlbmRvbmx5XCIsIFwieWVzXCJdXG4gICAgZW52aXJvbm1lbnQ6XG4gICAgICBSRURJU19QQVNTV09SRDogJHtSRURJU19QQVNTV09SRH1cbiAgICB2b2x1bWVzOlxuICAgICAgLSByZWRpcy1kYXRhOi9kYXRhXG4gICAgaGVhbHRoY2hlY2s6XG4gICAgICB0ZXN0OiBbXCJDTUQtU0hFTExcIiwgXCJSRURJU0NMSV9BVVRIPVxcXCIkJHtSRURJU19QQVNTV09SRH1cXFwiIHJlZGlzLWNsaSBwaW5nIHwgZ3JlcCAtcSBQT05HXCJdXG4gICAgICBpbnRlcnZhbDogMTBzXG4gICAgICB0aW1lb3V0OiA1c1xuICAgICAgcmV0cmllczogMTBcbiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzXG5cbnZvbHVtZXM6XG4gIG1vbmdvZGItZGF0YTpcbiAgbW9uZ29kYi1jb25maWc6XG4gIHJlZGlzLWRhdGE6IiwKICAiY29uZmlnIjogIlt2YXJpYWJsZXNdXG5hcHBfZG9tYWluID0gXCIke2RvbWFpbn1cIlxucHJveHlfZG9tYWluID0gXCIke2RvbWFpbn1cIlxubW9uZ29kYl9wYXNzd29yZCA9IFwiJHtoYXNoOjY0fVwiXG5yZWRpc19wYXNzd29yZCA9IFwiJHtoYXNoOjY0fVwiXG5rZWtfdmVyc2lvbl8xID0gXCIke2Jhc2U2NDozMn1cIlxuYXV0aF9zZWNyZXQgPSBcIiR7YmFzZTY0OjMyfVwiXG5cbltjb25maWddXG5lbnYgPSBbXG4gIFwiQVBQX0RPTUFJTj0ke2FwcF9kb21haW59XCIsXG4gIFwiQVVUSF9VUkw9aHR0cDovLyR7YXBwX2RvbWFpbn1cIixcbiAgXCJQUk9YWV9ET01BSU49JHtwcm94eV9kb21haW59XCIsXG4gIFwiTU9OR09EQl9QQVNTV09SRD0ke21vbmdvZGJfcGFzc3dvcmR9XCIsXG4gIFwiUkVESVNfUEFTU1dPUkQ9JHtyZWRpc19wYXNzd29yZH1cIixcbiAgXCJLRUtfVkVSU0lPTl8xPSR7a2VrX3ZlcnNpb25fMX1cIixcbiAgXCJBVVRIX1NFQ1JFVD0ke2F1dGhfc2VjcmV0fVwiLFxuICBcIkRJU0FCTEVfU0lHTlVQPWZhbHNlXCIsXG4gIFwiUlBNPTE4MFwiLFxuICBcIkFMTE9XRURfT1JJR0lOUz1cIixcbiAgXCJBTExPV0VEX1RBUkdFVFM9XCIsXG5dXG5tb3VudHMgPSBbXVxuXG5bW2NvbmZpZy5kb21haW5zXV1cbnNlcnZpY2VOYW1lID0gXCJjb3JzZml4XCJcbnBvcnQgPSAzMDAwXG5ob3N0ID0gXCIke2FwcF9kb21haW59XCJcblxuW1tjb25maWcuZG9tYWluc11dXG5zZXJ2aWNlTmFtZSA9IFwiY29yc2ZpeC1wcm94eVwiXG5wb3J0ID0gODBcbmhvc3QgPSBcIiR7cHJveHlfZG9tYWlufVwiIgp9
Configuration
The exact Docker Compose and template configuration this template deploys.
Instructions
Corsfix
This template deploys the Corsfix dashboard and proxy with MongoDB and Redis. The dashboard image requires an x86-64 / amd64 server.
Before deploying
- Dokploy imports template domains without a certificate configuration, so
AUTH_URLdefaults tohttp://followed by the generated dashboard hostname. When enabling HTTPS and Let's Encrypt in the Domains tab, also changeAUTH_URLin Environment tohttps://followed by that hostname and redeploy. This URL must match the public dashboard address, even though Dokploy terminates TLS at the edge. Enable HTTPS for both domains before using the playground, which uses HTTPS proxy URLs. - If using custom domains, point both DNS records to your server, update the domain entries, and set
APP_DOMAINandPROXY_DOMAINin Environment to the matching hostnames, withouthttps://or a trailing slash. UpdateAUTH_URLto the full public dashboard URL, including itshttp://orhttps://scheme. - Deploy, then open the dashboard domain (the
corsfixservice on port3000) and create your account with an email address and password. Self-hosted signup does not require an email server. - Set
DISABLE_SIGNUP=truein Environment and redeploy after creating the accounts you need.
Using the proxy
The second domain routes to corsfix-proxy on port 80. Use the dashboard to register your application's origin and permitted target domains, manage secrets, and try requests in the playground.
RPM sets the self-hosted rate limit (default: 180 requests per minute). Optional ALLOWED_ORIGINS and ALLOWED_TARGETS accept comma-separated hostnames for environment-based allowlists; leave them empty to manage applications through the dashboard.
Persistent data and upgrades
MongoDB stores users, applications, and encrypted secrets in named volumes. Redis uses a named volume with append-only persistence. Preserve these volumes and the generated environment values when upgrading.
Keep a backup of KEK_VERSION_1: changing or losing this encryption key makes existing saved secrets unreadable. Do not re-import the template to upgrade an existing installation, because imports generate new credentials and keys. Update the image tags in the existing Compose configuration instead. Changing MONGODB_PASSWORD alone does not change the password already stored in MongoDB.
The Corsfix images are pinned to the same upstream commit because the project publishes commit tags rather than numbered releases.
See the Corsfix self-hosting documentation for more information.
Related Templates
9Router
Version: 0.5.59
Self-hosted AI model router that rotates requests across 40+ providers with automatic fallback, exposing an OpenAI-compatible endpoint for coding agents.
FreeLLMAPI
Version: v0.8.4
FreeLLMAPI aggregates free tiers from 29 LLM providers into a single OpenAI-compatible endpoint with smart routing, automatic failover, per-key rate tracking, and encrypted key storage.
Adminer
Version: 4.8.1
Adminer is a comprehensive database management tool that supports MySQL, MariaDB, PostgreSQL, SQLite, MS SQL, Oracle, Elasticsearch, MongoDB and others. It provides a clean interface for efficient database operations, with strong security features and extensive customization options.
Cloudflare DDNS
Version: 1.15.1
A small, feature-rich, and robust Cloudflare DDNS updater.
Cloudflared
Version: latest
A lightweight daemon that securely connects local services to the internet through Cloudflare Tunnel.
DockRoute
Version: 0.2.0
External-DNS for plain Docker hosts: watches container labels and reconciles DNS records and Cloudflare Tunnel routes, never touching records it cannot prove it manages.
Self-host Corsfix in minutes
Dokploy is a free, open source deployment platform. Deploy Corsfix and 567+ other templates on your own infrastructure with a single click.