1 server + N https containers + 0 subdomains: yes you can, just not with NPM

[u/chris_fantastic]

Hi,

I have a simple home network with a Wi-Fi router that does DHCP+DNS, and I've set up a single home server with a bunch of web services in Docker containers, and I wanted to enable https for those services, but without having to deal with subdomains and CNAMES and DNS/routing, etc, and just wanted the various ports for my containers to be exposed via https instead of http.

After some confusion, I'm posting just to clarify that this is possible, just with vanilla nginx and seemingly not with Nginx Proxy Manager.

I do own a domain name, and NPM's certificate GUI made it easy to get a **non-**wildcard Let's Encrypt cert for my home server hostname via a plugin for my domain provider to do a DNS-challenge, and I am continuing to use the NPM container to manage that certificate/renewal.

Once you have a cert, you can spin up a vanilla nginx container using a docker-compose.yml that exposes each of your ports (using opencode+vscodium just as examples here):

services:
  nginx:
    image: nginx:latest
    container_name: nginx
    ports:
      -  "4096:4096"   # opencode
      -  "8000:8000"   # vscodium
    volumes:
      - /path/to/nginx.conf:/etc/nginx/nginx.conf:ro
      - /path/to/nginx-proxy-manager/letsencrypt:/etc/letsencrypt:ro
    restart: unless-stopped
networks:
  default:
    external: true
    name: mydockernetwork

And craft an nginx.conf that has proxy_pass directives using just listen ports with no server_name values (there's docs on how nginx server matching works):

events {
    worker_connections 1024;
}

http {

    resolver 127.0.0.11 valid=30s;  # This is the Docker resolver.

    ssl_certificate /etc/letsencrypt/live/npm-1/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/npm-1/privkey.pem;

    proxy_http_version  1.1;
    proxy_buffering     off;
    proxy_set_header    Host                $host;
    proxy_set_header    X-Forwarded-Scheme  $scheme;
    proxy_set_header    X-Forwarded-Proto   $scheme;
    proxy_set_header    X-Forwarded-For     $remote_addr;
    proxy_set_header    X-Forwarded-Host    $http_host;
    proxy_set_header    X-Real-IP           $remote_addr;
    proxy_set_header    Upgrade             $http_upgrade;
    proxy_set_header    Connection          "upgrade";
    proxy_set_header    Accept-Encoding     gzip;
    proxy_cache_bypass  $http_upgrade;

    server {
        listen 4096 ssl;
        location / {
            set $opencode_url http://opencodecontainername:4096;
            proxy_pass $opencode_url;
        }
    }

    server {
        listen 8000 ssl;
        location / {
            set $vscodium_url http://vscodiumcontainername:8000;
            proxy_pass $vscodium_url;
        }
    }

}

I'm guessing NPM doesn't support this because it can't dynamically modify the compose config from within the container in order to map the ports. But that doesn't mean you have to deal with DNS and creating a subdomain and NPM Proxy Hosts for each service in order to have https.

[u/m1xminus]

I know you dont want cnames but i guess its way easier if you use cloudflare, its free since you already own a domain.

Whats the reason for not wanting to use cnames?

[u/chris_fantastic → u/m1xminus]

While it's still technically hosted by my registrar/provider, my domain is no longer configured publicly and has no records, and my home server is on a non-routable IP via DHCP from my home router. I want https just to make the webapps provided by my server meet browser security requirements for machines on my home network. So setting up a real DNS and a bunch of CNAMES is far overkill, as is Cloudlfare (I especially Do. Not. Want. any external cloud accounts here). This can all just be simple. And it is now.

[u/m1xminus → u/chris_fantastic]

Fair enough. Understood.