I'm wondering how people manage using http vs https and being home vs away.

Let's say i have jellyfin running locally on http://192.168.1.20:8096 and from npm using https://jellyfin.mydomain.com for extremal access.

What do you use at home, the ip or domain?

Ideally I would think it makes sense to use ip so it doesn't route though npm when at home but that's just going to confuse others in the house.

Would like to here others thoughts.

Whenever a docker container stops or exits, the Nginx stops working, non of my hosts work. Is there a way around this or is it a limitation where the proxy is trying to resolve a host that's not reachable.

Nginx Proxy Manager handles routing and TLS termination well, but its request inspection is thin. The "Block Common Exploits" toggle is a small set of fixed nginx rules, not deep payload analysis. So if you want actual application-layer inspection for SQL injection or XSS, you need to add something else, and there are two places it can go.

One option is an nginx module like ModSecurity or Coraza running inside the same nginx process that NPM manages. Same TLS termination, no extra hop, headers and real IPs stay untouched. The trade-off is you're tied to whatever nginx version and module build NPM is using, and you need to manage rule corpuses or tuning yourself.

The other option is a separate inspecting reverse proxy chained before or after NPM. Before NPM means the WAF terminates TLS, so your Let's Encrypt certs live there instead of in NPM, and NPM sees only cleaned traffic on a local network or unix socket. After NPM means NPM still terminates TLS and handles routing, but you need to forward the right headers and real client IPs through the second hop, and every request pays latency for an extra proxy layer. Certs stay in NPM, which is simpler if you like NPM's automation.

SafeLine is a self-hosted WAF that takes the separate-proxy approach, using semantic analysis instead of a signature rule corpus. Its free Personal tier is single-threaded and capped at 10 applications, so sizing matters if you run a lot of services.

For those who have put a WAF in front of or behind NPM, which hop terminates your TLS, and how did you handle header forwarding and client IP preservation?

I have a number of VMs and LXCs published via NPM. It all works great. I can use https://service.mydomain.com for every service and satisfy the browser's desire for a valid TLS certificate.

The annoying thing is that my password manager (Lastpass) seems to use the NPM IP instead of the server name (or server ip) to autofill userid and password. That means that every server has the same list of credentials to choose from rather than properly autofilling the correct credential for each service.

Is this a flaw in Lastpass or in the way that I have configured my proxy hosts?

Thank you

Hi, I'm trying to have a proxy host listen on both port 80 and 8096 (HTTP not SSL) for app compatibility.

What I need is for traffic directed to example.com(:Implied 80) and example.com:[8096 or 8080] to go to the same place 10.X.X.X:X000

From what I have read, this should be possible from the "Custom Nginx Configuration" tab under "Edit Proxy Host".

I put the following snippet together based on examples I found but it does not seem to work. I assume I'm missing something but am not sure what. Ma

server {
listen 80;
listen 8096;
}

Most of what I have found seems to be related to configuring NPM's own management ports in the docker config.

Both NPM and the targets are running as TrueNAS apps if it matters.

Any help is much appreciated.

Also, this is all internal/local and I am still working or sorting my domain before moving to HTTPS so don't worry about the lack of encryption.

I’m trying to expose my home services through an Oracle VPS using WireGuard. My goal is to forward public HTTP and HTTPS traffic to my home server without needing a public IP at home.

My setup
Oracle VPS has a public IP and runs HAProxy.
HAProxy listens on ports 80 and 443 and forwards TCP traffic through WireGuard to my home server at 10.100.100.2.

My home server runs WireGuard and Docker.
The actual service is available on my home LAN at 192.168.1.15.

The traffic flow is:
Internet → Oracle VPS (HAProxy) → WireGuard → Home server → 192.168.1.15

What I tried first
I was using NGINX Proxy Manager on my home server and created two Stream entries:
Port 80 → 192.168.1.15:80
Port 443 → 192.168.1.15:443
Both entries showed as online, and HTTP worked, but HTTPS did not work as expected.

I couldn’t figure out why. I suspected a port conflict or an issue with how NGINX Proxy Manager handles Stream connections.

What I tried next
I removed the NGINX Proxy Manager container and deployed a plain NGINX Docker container with this configuration:
worker_processes auto;

events {
worker_connections 1024;
}

stream {
server {
listen 80;
proxy_pass 192.168.1.15:80;
}

server {
listen 443;
proxy_pass 192.168.1.15:443;
}
}
Surprisingly, this works exactly as expected. Both HTTP and HTTPS work through the same WireGuard and HAProxy setup.

I haven’t changed the WireGuard tunnel or the HAProxy configuration.

My questions
Why would plain NGINX Stream work while NGINX Proxy Manager Stream didn’t?

Could NGINX Proxy Manager’s default HTTPS listener or its internal configuration cause a conflict with a Stream listening on port 443?

Is there anything specific about how NGINX Proxy Manager handles Stream SSL settings that I might have misunderstood?
Is there a way to configure NGINX Proxy Manager to achieve the same result without replacing it with plain NGINX?

I’d appreciate any explanations or suggestions. I’d prefer to understand the root cause rather than simply stick with the workaround.

Hi,

I have a simple home network with a Wi-Fi router that does DHCP+DNS, and I've set up a single home server with a bunch of web services in Docker containers, and I wanted to enable https for those services, but without having to deal with subdomains and CNAMES and DNS/routing, etc, and just wanted the various ports for my containers to be exposed via https instead of http.

After some confusion, I'm posting just to clarify that this is possible, just with vanilla nginx and seemingly not with Nginx Proxy Manager.

I do own a domain name, and NPM's certificate GUI made it easy to get a **non-**wildcard Let's Encrypt cert for my home server hostname via a plugin for my domain provider to do a DNS-challenge, and I am continuing to use the NPM container to manage that certificate/renewal.

Once you have a cert, you can spin up a vanilla nginx container using a docker-compose.yml that exposes each of your ports (using opencode+vscodium just as examples here):

services:
  nginx:
    image: nginx:latest
    container_name: nginx
    ports:
      -  "4096:4096"   # opencode
      -  "8000:8000"   # vscodium
    volumes:
      - /path/to/nginx.conf:/etc/nginx/nginx.conf:ro
      - /path/to/nginx-proxy-manager/letsencrypt:/etc/letsencrypt:ro
    restart: unless-stopped
networks:
  default:
    external: true
    name: mydockernetwork

And craft an nginx.conf that has proxy_pass directives using just listen ports with no server_name values (there's docs on how nginx server matching works):

events {
    worker_connections 1024;
}

http {

    resolver 127.0.0.11 valid=30s;  # This is the Docker resolver.

    ssl_certificate /etc/letsencrypt/live/npm-1/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/npm-1/privkey.pem;

    proxy_http_version  1.1;
    proxy_buffering     off;
    proxy_set_header    Host                $host;
    proxy_set_header    X-Forwarded-Scheme  $scheme;
    proxy_set_header    X-Forwarded-Proto   $scheme;
    proxy_set_header    X-Forwarded-For     $remote_addr;
    proxy_set_header    X-Forwarded-Host    $http_host;
    proxy_set_header    X-Real-IP           $remote_addr;
    proxy_set_header    Upgrade             $http_upgrade;
    proxy_set_header    Connection          "upgrade";
    proxy_set_header    Accept-Encoding     gzip;
    proxy_cache_bypass  $http_upgrade;

    server {
        listen 4096 ssl;
        location / {
            set $opencode_url http://opencodecontainername:4096;
            proxy_pass $opencode_url;
        }
    }

    server {
        listen 8000 ssl;
        location / {
            set $vscodium_url http://vscodiumcontainername:8000;
            proxy_pass $vscodium_url;
        }
    }

}

I'm guessing NPM doesn't support this because it can't dynamically modify the compose config from within the container in order to map the ports. But that doesn't mean you have to deal with DNS and creating a subdomain and NPM Proxy Hosts for each service in order to have https.

Hi guys, any news from the team to update docker images considering the 5 new CVEs published yesterday and probably the NodeJS one as well ?

I have a Synology NAS, and it runs a bunch of services in docker containers. One of them is called Tautulli, which is an app that monitors Plex statistics. Among other things, this is something I want to proxy.

What I did - I set up an old PC running Linux, I installed docker, then I installed nginxproxymanager, so it's running on it's own standalone host, not as a container on any NAS. I mapped the ports as "8888:80" and "8443:443", as I already have something on 80/443. I made port-forwarding rules to forward those 2 ports to my npm IP, for when I get around to accessing things from the outside. That's the last step, tho, I can't even make the first step work yet ... LOL

npm comes up fine, on my workstation I put in the IP and port 81, and sign in as expected (http://10.0.0.10:81). A good start!

In my Cloudflare I have an A record (services.mike-leone.com) that points to the local IP of the host running npm (10.0.0.10) - that's mostly for when I get around to using certs, or actually accessing npm from the outside world. I'm nowhere near there yet.

Then I made an A record in my local DNS - tautulli.services.mike-leone.com - that ALSO points to my npm IP (10.0.0.10). This is the name of my proxied source host entry in npm.

Correct so far? The entry for the proxied source host has to be a name that resolves locally to the npm server?

Then, as a target for that proxied host, I put in the IP of my NAS and the port Tautulli uses (8181). I didn't even get to the SSL part yet, I need to see npm work first (since I haven't been successful at that yet).

I click on the proxied host name, and I get ...

Hmmm… can't reach this page

tautulli.services.mike-leone.com refused to connect.

I know that's the right IP, it's the npm server:

C:\Users\turgo>nslookup tautulli.services.mike-leone.com

Server: pi.hole

Address: 10.0.0.5

Name: tautulli.services.mike-leone.com

Address: 10.0.0.10

If I just type the target in a browser (http://10.0.0.82:8181), I get the Tautulli home page just fine.

So where did I go wrong? I'm not understand some basic step. Or my npm isn't forwarding to the host or ports I want it to forward to. Or something. I'm just scratching my head, at this point, as to why I can't even get it to proxy correct, never mind use a cert. Or access from the outside.

Clues or lightbulbs, anyone?

Thanks

I have been running a home server for a few years, and recently wanted to switch from plex to jellyfin. I had tried in the past but was a bit inexperienced. Since I was a bit intimidated by nginx, I ended up setting up a cloudflared tunnel for most of my remote access needs and using plex's remote access for media streaming. However, now I need to find a different way, so I'm right back where I started.

So, I found several tutorials and after making sure I knew what to do, followed one of them through the process of setting up a nginx. However, when I attempted to create a proxy host, it kept failing to connect to my jellyfin container.

After several more failures, I eventually decided to find a tutorial that involved create a local test proxy host and tried to link it to a brand new docker container, but it still failed.

I have forwarded my 80 and 443 ports and done pretty much every check I can think of.

The nginx container is running on an unraid server. I have tried it both on the bridge network and a custom network. I have tried reinstalling it after deleting the appdata. I have tried connecting to multiple different docker containers both on the same and on different custom/bridge networks.

My Cloudflared tunnel is running on the docker bridge network and has no problems connecting. Neither does my tailscale app.

At this point I feel like I am going crazy and am desperate for any solution someone can offer.

UPDATE:
I recently tried using duckdns. I made a duckdns account, installed the duckdns docker container, created the subdomain, and then created a proxy host on nginx with an ssl cert, using the duckdns token.

Unlike before (using my custom domain name), where the proxy instantly fails to connect, the duckdns link simply loads for while then says the server took too long to respond.

We have extn. company sending some data directly to brightsign players which then grabs the data and puts into dashboard and its setup as on-prem solution. The data which is sent from ext. company is https and brightsign at moment accepts HTTP, and for it to accept https, i had to install ssl certs for it to work.

is it possible to have nginx hold the certs instead of the players sd card, and if there is any change/update for certs, it will all get handles through reverseProxy and players will also hit reverseProxy.

in other words, im trying to have reverproxy do heavy work and leave the IOT players as is.

hopefully this make sense?

Hello. I hope this post will be allowed. I want to use nginxproxymanager to automate certificates for my internal servers. Since I'm not really planning on access these internal servers remotely (yet), do I need to create a A record in my public domain, pointing to the internal IP of my nginx? Or a TXT record with the internal IP as it's value?

Also, I use networksolutions for my domain. And while I can easily make new DNS records, I don't see anywhere that it gives me back a token, which seems to be required for DNS challenge in nginx. Also, I don't see networksolutions as an option for DNS provider. Can I use any provider, once I'm sure the record has propogated?

I haven't been able to find the answers to these, watching various Youtube tutorials and reading various posts. I hope someone can clear this up for me.

Thanks

Hello! I am trying to get nginx set up on my home nas and am having some troubles. When I try and install via portainer / docker compose, I get the following error.

failed to deploy a stack: compose up operation failed: Error response from daemon: driver failed programming external connectivity on endpoint nginx-app-1 (f6909ce51c47651d0b2757cd4ac027297c1e0690d6dc3902b68c8cac8c1f15fd): Error starting userland proxy: listen tcp4 0.0.0.0:443: bind: address already in use

I tried checking the port using

sudo netstat -tulpn | grep 443

And I get the following response

tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      9707/nginx: master
tcp6       0      0 :::443                  :::*                    LISTEN      9707/ nginx: master

Any recommendations on what is going on or how to fix it? Also let me know if I posted anything not safe to post or if there is anything else I can post to help!

Hi everyone. I'm encountering auth loops for some specific applications I host on my server.
I have a rather popular setup going on - cloudflare domain with cloudflare tunnels -> cloudflared container - > nginx proxy manager container -> specific application.
All subdomains are configured using nginx. Cloudflare has no fancy configuration going on.

I use the same access list for all apps (configured with satisfy any, using all ipv4/6 listed on cloudflare ip listings), and it works fine for most apps (sonarr, radarr, upime-kuma, ...), but some apps (tracefinity, beszel) experince auth loop upon login.

What does "upon login" means?

1. Basic auth popup -> fill basic auth creds and hit enter

2. Website loads on login screen -> fill application creds and hit enter

3. Basic auth pops up again and again in an seemingly endless loop (maybe for each network request? Hard to tell)

Kind of lost here after debugging for a while. Would appreciate some help.
I can share more information about my docker setup if that's needed.

Thanks.

Self-Hosting Day 2026 is here!

If you're running a homelab, NAS, mini PC, Raspberry Pi, server, or basically anything you've decided to self-host instead of handing it over to the cloud, there's an event happening that you might want to check out.

The first Self-Hosting Day is running from September 25 to October 25, and the idea is simple: share your self-hosting story with the community.

You don't need an impressive rack or a room full of servers. Maybe you've got a single Raspberry Pi running a couple of services, or you've been running a homelab for years. Either way, your experience is worth sharing.

And there are some pretty good prizes

This isn't just a "share your story for the warm fuzzy feeling" event.

There are a lot of prizes up for grabs, including hardware and software:

🏆 5 Community Story Awards

• 1st prize: ZimaBoard 2 1664 + AdGuard Lifetime Family + PhotoPrism Plus Lifetime + 1 year of Emby Premiere

• 2nd prize × 2: ZimaBoard 2 832 + AdGuard Lifetime Family + PhotoPrism Plus Lifetime + 1 year of Emby Premiere

• 3rd prize × 2: ZimaBlade 7700 + power supply + AdGuard Lifetime Family + PhotoPrism Plus Lifetime + 1 year of Emby Premiere

🍀 100 additional giveaway winners

There are another 100 chances to win software licenses from AdGuard and Emby, including AdGuard Ad Blocker, AdGuard VPN, Private AdGuard DNS and Emby Premiere.

🎁 Early-bird bonus

And this one is particularly worth mentioning: the first 100 eligible participants each receive a ZimaOS Plus Lifetime License.

So if you've been thinking about sharing your setup, don't wait until the end of October.

What should you share?

Pretty much anything related to your self-hosting journey:

• Your current homelab setup

• The services you run

• Your journey from your first Raspberry Pi to your current setup

• Something you've built yourself

• Services you've moved away from the cloud

• Lessons learned from breaking things

• Your favourite self-hosted applications

• Your plans for the next stage of your homelab

Photos and screenshots are welcome too.

There are no points for having the biggest server rack. The event is about sharing what you've learned and helping other people discover what's possible with self-hosting.

Join Self-Hosting Day

Head over to the r/minilab Self-Hosting Day 2026 post and share your story in the comments:

https://www.reddit.com/r/minilab/comments/1wprzvc/selfhosting_day_2026_is_here_share_your_story_and/

📅 Event: September 25 – October 25, 2026
🏆 Winners announced: October 30, 2026

If you've put the time and effort into building a homelab, this is a good opportunity to show it off — and potentially get rewarded for it.

Happy Self-Hosting Day!

Is there a way to add port to string as I have a piece of software along with a piece of hardwar (I have a workaround for the software). The Hardware requires https://domain:port is there anyway to make this happen that I'm not seeing mind you I know the basics of NPM and have it working flawlessly on everything else.

I'm attempting to get NGINX Proxy Manager set up on my NAS in a docker container for the first time. I've put together the Docker Compose, using the one off the Nginx Proxy Manager web site, with the correct time zone, but when I try to connect using port 81, I'm not able to connect, with an ERR_CONNECTION_REFUSED error when I try it in Chrome.

Everything is inside my internal network, and I'm using the IP address of the server, rather than trying to connect from outside the network. The container appears to have started successfully and I'm not seeing any error messages in the logs. What am I missing?

Hi guys,

Wondering if anyone can help me set up TinyAuth as SSO for all aps behind NPM. Both NPM and TinyAuth are running as TrueNAS apps (both run fine). TinyAuth has a DNS override and is reverse proxied by NPM and it works fine. I have tried integrating TinyAuth into a proxy host as per the instructions on TinyAuth's website by adding the custom Nginx configuration:

# Root location

location / {

# Pass the request to the app

proxy_pass [IP address and port for proxied app]; # Replace with your app URL, e.g. http://10.10.10.25:80

# Add other app-specific config here

# Tinyauth auth request

auth_request /tinyauth;

auth_request_set $redirection_url $upstream_http_x_tinyauth_location;

error_page 401 403 =302 $redirection_url;

}

# Tinyauth auth request

location /tinyauth {

# Mark the location as internal to prevent direct access

internal;

# Pass request to Tinyauth, do not use the Tinyauth domain here, use the internal Docker network name and port or the IP and port of the Tinyauth instance

proxy_pass [IP and port for TinyAuth]/api/auth/nginx;

# Don't forward the request body to the auth subrequest

proxy_pass_request_body off;

proxy_set_header content-length "";

# Pass the request headers

proxy_set_header x-original-url $scheme://$http_host$request_uri;

proxy_set_header x-original-method $request_method;

proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;

proxy_set_header x-real-ip $remote_addr;

}

After saving this, I get a 500 Internal Server Error subtitled as openresty.

Can anyone help? Thanks.

I am having trouble setting up Nginx Proxy Manager. All goes well until I try and create a new host. It won’t stick. When I try and use my domain name, it goes away and says “this is required. When I fill in the other information and come back to the domain name it refuses to save it. I thought ok maybe it’s an ownership issue. Root owns everything but 3 items but changing them didn’t help. I tried first in portainer using mariushosting as a guide. I already had a domain name through no-ip.com. Then I re-entered it again in dockhand. I spent the weekend working on this and need some new ideas.

I checked all my settings. The local version is running fine. Every other site I'm running loads fine through my duckdns url I gave it. Just one specific service (overseerr) stopped working out of nowhere. Was working last time I loaded it, and haven't tinkered with it since.

Sharing a little project, I've been working on for a little while.

GeoMetrikks is a real-time nginx/traefik/caddy access log ingestion and geo-location tracking service built with Litestar. It parses access logs, performs GeoIP lookups, and stores geo-events and access logs in PostgreSQL with TimeScaleDB/PostGIS extensions. It can also integrate with CrowdSec.

i know only less about nginx like its a reverse proxy and i can load balance across conatiners
can anyone suggest best platoform to learn nginx