I don't think there's an option to terminate the TLS in the container. But maybe I am wrong.
But if there is, you can run it without a reverse proxy.
The reason for a base URL is the following:
If an app were to use a URL like
/another/dir and it runs on
localhost:8888 and I reverse proxy it to
https://myserver.com/subdir/, I will run into an issue as soon as the app or a link returns
https://myserver.com/test/here.html does not exist and it should be
(However, it would work if you created a subdomain and reverse proxied it to
https://joplin.myserver.com, but not all people can create subdomains and others rather like to use subdirs (aliases) instead of subdomains.)
The thing is that afaik all nodejs apps actually use absolute paths (which I believe has to do with the way routes are built in nodejs).
Thus an APP URL is required for situations where the app is not run in the root of a separate sub domain. Unless there's another reason why the server needs the BASE_APP_URL.
Also, sometimes the BASE URL only denotes the dir relative to the root and does not require the domain name to be part of it. I have no idea why in this case it is required. I don't know the server code.
Laurent can speak to the specifics since he wrote the code.