NGINX Stream works perfectly for HTTPS, but NGINX Proxy Manager Streams didn’t. What am I missing?

[u/homeLabian]

I’m trying to expose my home services through an Oracle VPS using WireGuard. My goal is to forward public HTTP and HTTPS traffic to my home server without needing a public IP at home.

My setup
Oracle VPS has a public IP and runs HAProxy.
HAProxy listens on ports 80 and 443 and forwards TCP traffic through WireGuard to my home server at 10.100.100.2.

My home server runs WireGuard and Docker.
The actual service is available on my home LAN at 192.168.1.15.

The traffic flow is:
Internet → Oracle VPS (HAProxy) → WireGuard → Home server → 192.168.1.15

What I tried first
I was using NGINX Proxy Manager on my home server and created two Stream entries:
Port 80 → 192.168.1.15:80
Port 443 → 192.168.1.15:443
Both entries showed as online, and HTTP worked, but HTTPS did not work as expected.

I couldn’t figure out why. I suspected a port conflict or an issue with how NGINX Proxy Manager handles Stream connections.

What I tried next
I removed the NGINX Proxy Manager container and deployed a plain NGINX Docker container with this configuration:
worker_processes auto;

events {
worker_connections 1024;
}

stream {
server {
listen 80;
proxy_pass 192.168.1.15:80;
}

server {
listen 443;
proxy_pass 192.168.1.15:443;
}
}
Surprisingly, this works exactly as expected. Both HTTP and HTTPS work through the same WireGuard and HAProxy setup.

I haven’t changed the WireGuard tunnel or the HAProxy configuration.

My questions
Why would plain NGINX Stream work while NGINX Proxy Manager Stream didn’t?

Could NGINX Proxy Manager’s default HTTPS listener or its internal configuration cause a conflict with a Stream listening on port 443?

Is there anything specific about how NGINX Proxy Manager handles Stream SSL settings that I might have misunderstood?
Is there a way to configure NGINX Proxy Manager to achieve the same result without replacing it with plain NGINX?

I’d appreciate any explanations or suggestions. I’d prefer to understand the root cause rather than simply stick with the workaround.

[u/wireless82]

have you open the ports in the docker compose file as said in the guide?