how to self-host affine with traefik?

[dalamudx]

i can create workspace,add new pages and save,then sync with cloud,but it seems websocket does not work,when i open the affine,the console output many DOMException error

if i change my account email in settings,it will output ssl error

compose config:

version: "3"

services:
  affine:
    image: ghcr.io/toeverything/affine-graphql:stable
    container_name: affine
    networks:
      - traefik
    command:
      ['sh', '-c', 'node ./scripts/self-host-predeploy && node ./dist/index.js']
    expose:
      - 3010
    volumes:
      ...
    restart: unless-stopped
    environment:
      - NODE_OPTIONS="--import=./scripts/register.js"
      - AFFINE_CONFIG_PATH=/root/.affine/config
      - REDIS_SERVER_HOST=redis
      - DATABASE_URL=postgres://affine:xxxxxx@postgres:5432/affine
      - NODE_ENV=production
      - AFFINE_ADMIN_EMAIL=xxxxxx
      - AFFINE_ADMIN_PASSWORD=xxxxxx
      - AFFINE_SERVER_HOST=doc.xxx.com
      - AFFINE_SERVER_HTTPS=true
      - NEXTAUTH_URL=https://doc.xxx.com
      ...
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik"

traefik config:

http:
  routers:
    affine:
      entryPoints:
      - "https"
      rule: "Host(`doc.xxx.com`)"
      service: "affine-svc"
      tls: true
      middlewares: "securityHeaders@file,local-ipallowlist@file"
  services:
    affine-svc:
      loadBalancer:
        servers:
        - url: "http://affine:3010"
        passHostHeader: true

http:
  middlewares:
    local-ipallowlist:
      ipAllowList:
        sourceRange: 
          - "x.x.x.x/x"
    securityHeaders:
      headers:
        accessControlAllowMethods: 
          - GET
          - OPTIONS
          - PUT
        accesscontrolallowheaders: "*"
        accessControlMaxAge: 100
        addVaryHeader: true
        customResponseHeaders:
          X-Robots-Tag: "none,noarchive,nosnippet,notranslate,noimageindex"
          X-Forwarded-Proto: "https"
          server: ""
        customRequestHeaders:
          X-Forwarded-Proto: "https"
        sslProxyHeaders:
          X-Forwarded-Proto: "https"
        referrerPolicy: "same-origin"
        hostsProxyHeaders:
          - "X-Forwarded-Host"
        contentTypeNosniff: true
        browserXssFilter: true
        forceSTSHeader: true
        stsIncludeSubdomains: true
        stsSeconds: 63072000
        stsPreload: true

[dalamudx]

ok,changed to canary channel,it works fine