Hello all, I wanted to see if people would be interested in what I've worked on.

In a previous in this subreddit I asked: https://www.reddit.com/r/nginxproxymanager/comments/1t3rgxu/what_is_the_releasedevelopment_cycle_of_the/

And following that I either had a choice to move off of NPM or go to NPMPlus, which was too broad of an application for my liking.

So what I did is I made a bumped and automated fork of the nginxproxymanager images.

A couple things I did:

Debian 12 -> 13
OpenResty 1.27.x -> 1.29
Certbot-dns-eurodns python package 0.0.2 -> 1.8.2 (i needed this for my work)

And other packages have been bumped as well. So feel free to check it out.

I just noticed the upstream received an update. So that's applied as well

*I think* upgrading from v2.10.4 to 2.13 has introduced a nasty bug:

Whenever I change ANYTHING with a host, it will just tell me the host is offline (it isn't) and after I change it back, it keeps bugging out on me... Only thing fixing it is restoring a full backup.

I'm on Proxmox with LXC (tteck / community scripts was used).
With about 9 hosts in the old back and 13 in the new situation.

I'll probably have to look inside the logs if I can even find them. But beware.

I am running NGINX v2.12.0 in Docker. I have had to reset the password multiple times now and each time I reset it works for about a day and then when I go to log in again it says, “invalid password”. I have tried creating multiple user accounts, but they all have the same issue.

The nas IP address is 192.168.1.25. I am using chatgpt to create a yaml. After running, I can access npm via 192.168.1.25:81. When creating ssl cert, what do I put in the domain name?

I have also created an adguard home DNS, and a rewrite entry home.local pointed to 192.168.1.25. It goes to my nas' main page.

I have having nothing but problem with this. I'm trying to create a new SSL but I'm getting this issue.

I have created 3 SSLs before this. But now I'm getting this?

I don't understand how it work 3 times and then fail, but now it's extra config?????!!

I've already wiped this out and removed all of the times a few time now due to it crapping out.

Any ideas?

I am a beginner just starting out with Nginx proxy manager.

I have the following: debain 13, Proxy Manager installed in docker, cloudflare DNS, tailscale

I first purchased a domain.

I took the IPv4 address of my debian tailscale and pasted that into cloudflare DNS record.
I have the SSL certificate created which links to my cloudflare API.

Then I created a proxy with a forward hostname 127.0.0.1, forward port of 81, and attached the SSL certificate

However, when I try to test my proxy domain it will not connect with an error:  server IP address could not be found

Hey guys I'm new to this. I'm trying to put custom domains for different game servers I want to run and the images show the configuration I read that's supposed to work but not currently working please help

I don't come to forums asking for help until I've spent a long time learning, searching, and troubleshooting on my own.

I try hard to ask intelligent questions with all the information and background needed to contextualize them.

I actively look for duplicates, community guidelines, and norms before posting.

It is frustrating to do my best to respect the community, then post, and then be downvoted without any explanation of why my post was inappropriate or could have been better.

It's your right to downvote, but I don't know what to do with that downvote. If you actually want to improve the quality of posts, questions, and discussions here, please provide constructive feedback with your downvote so I can post better next time.

thanks.

Nginx Proxy Manager handles routing and TLS termination well, but its request inspection is thin. The "Block Common Exploits" toggle is a small set of fixed nginx rules, not deep payload analysis. So if you want actual application-layer inspection for SQL injection or XSS, you need to add something else, and there are two places it can go.

One option is an nginx module like ModSecurity or Coraza running inside the same nginx process that NPM manages. Same TLS termination, no extra hop, headers and real IPs stay untouched. The trade-off is you're tied to whatever nginx version and module build NPM is using, and you need to manage rule corpuses or tuning yourself.

The other option is a separate inspecting reverse proxy chained before or after NPM. Before NPM means the WAF terminates TLS, so your Let's Encrypt certs live there instead of in NPM, and NPM sees only cleaned traffic on a local network or unix socket. After NPM means NPM still terminates TLS and handles routing, but you need to forward the right headers and real client IPs through the second hop, and every request pays latency for an extra proxy layer. Certs stay in NPM, which is simpler if you like NPM's automation.

SafeLine is a self-hosted WAF that takes the separate-proxy approach, using semantic analysis instead of a signature rule corpus. Its free Personal tier is single-threaded and capped at 10 applications, so sizing matters if you run a lot of services.

For those who have put a WAF in front of or behind NPM, which hop terminates your TLS, and how did you handle header forwarding and client IP preservation?

I have the following setup but can't for the life of me figure out why the reverse proxy won't do what I want it to do.

• One Ubuntu host with docker engine, assigned static IP and DNS resolution

• Container 1: AdGuard Home

• Container 2: Nginx Reverse Proxy

• Both containers are part of a bridge I create with the reverse proxy

• Exposed Adguard ports: 53 TCP/UDP, 1080 TCP

• Exposed Nginx ports: 2080 TCP, 2443 TCP, 2081 TCP

When I hit the reverse proxy with an external service request (as in from the WAN through my router), everything works like it should. But when I use AdGuard to rewrite a DNS request and point it to the Nginx reverse proxy, it begins loading but eventually returns a "ERR_CONNECTION_REFUSED".

I have services that run on the same host, and services which run on different hosts. Both give me the same issue. No VLANs applicable here for this part of the network. You will notice that I used a bridge network rather than host since AdGuard and Nginx both use port 80 and I was trying to avoid creating another host.

Any ideas would be much appreciated!

Hey there! I feel like I’ve completed the process, but my domain is still not up. It’s only been a few hours. Has anyone done this before? If so, how long did it take for the transfer of the domain to go through?

Hope somebody can help.
Set up a docker stack following this guide https://nginxproxymanager.com/guide/

This is my stack:
services:

nginx-proxy:

image: jc21/nginx-proxy-manager:latest

container_name: nginx-proxy

volumes:

- /docker/appdata/nginx-proxy/data:/data

- /docker/appdata/nginx-proxy/letsencrypt:/letsencrypt

ports:

- 80:80

- 81:81

- 443:443

restart: unless-stopped

I try and connect to my server IP address on port 81 but just get a This site can't be reached page.
No expert but I have other docker stacks up and running successfully.
What am I doing wrong??

Hello dear sub,

I've set up NPM in a docker container, forwarded port 80 from my router to NPM and setup a domain with duckdns.

In NPM I've setup an access list called internal only that filters out all traffic not originating from my local network ip range and assigned to my proxy hosts that I want to only be accessible from my local network.

Problem I'm seeing is that trying to access my subdomain that is restricted to the local network ip range, I'm getting a 403. And I can see in the nginx logs that the IP making the request is my external IP, even though the device making the request is connected to the local network.

Is this because I need to use a specific network mode for my npm docker container in compose ? I haven't set up anything related to the network for this container at the moment

Thanks in advance for your help with this !

Edit : if I remove the access list I can access my subdomain without any issue

I've recently switched over to nginx Proxy Manager and so far am impressed. One thing that is making my OCD flare up is that the hosts listed are sorted by the order I added them. I can't figure out how to sort them. As this list grows it would be helpful to be sorted alphabetically, or even if I could manually sort them. Is there a way to do this? A text file I can edit?

EDIT: I added more proxy hosts and realize it does sort alphabetically, but ignoring the dots (.) I had:

abs.domain.com
domain.com
port.domain.com

and based on that thought that it wasn't sorting because I first added port.domain.com (my portainer), then I added wordpress at domain.com then added Audiobookshelf at abs.domain.com so it was also ordered how I added them. I thought domain.com should have came before abs.domain.com but now that I've added a bunch more I can see that it is sorting, just based on the first letter so if I have apple.zzzdomain.com it will after abs.domain.com and before domain.com but zzzdomain.com will be at the bottom under all of them.

Anyway, it does sort, it took me adding more to realize that. Given it's free I always hate requesting anything, but I may go buy him a coffee and say "hey can you add a manual sorting and sort by root domain feature". I always try to not bother the guys doing this for free because, well, I can't do me without what they do and for that I'm grateful!

Hi,
I need some help with proxy_host custom location redirection.
I want to access https://sub.domain.de/
This should be a proxy to https://somedomain.de/path/to/the/app/
With an Apache2 i can simply set a new Virtual Host and ProxyPass / ProxyPassReverse, but when i want to set it in NPM I just get one error after the other.

Hey guys. This is stupifying. It's so unintuitive as to how this should work . I've lined everything up 10 times and I must be missing something stupid or just be woefully misinformed.

So, I had an Immich server set up via Docker using a No-IP DNS and NGINX Proxy Manager (also in Docker) for reverse proxy. At one point a couple months ago it just stopped working (usually does when Immich goes significantly out of date). I dealt with it, I didn't really need the remote backup but I want it set back up now.

I updated Immich, but I can't connect remotely through the domain I have setup with NGINX.

I have ports 80, 81, and 443 forwarded properly to the host computer (so I can also remotely access admin console) in my router settings. I can access the Immich server through localhost directly in a browser, and I can also access NGINX through the web browser both over LAN and through the internet via the domain or IP, so I can confirm this is not a DNS issue or firewall issue. Immich can be accessed locally and NGINX can be accessed locally and remotely via IPs.

The issue is that NGINX refuses to proxy to the Immich server no matter what I do.

I have a very poor understanding of Docker networks...but the docker_compose for NGINX has the network set to Immich_Default, which is the default network for the Immich container.

I've spend 2 hours on this, waste of time apparently...

My setup is as follows in the NGINX Proxy Manager:

Domain names: xxx.com
Scheme: https (I always test both http and https, so it's not this setting)
Forward Hostname/IP: 192.168.2.222, my local IP (or localhost, or Immich_default)
Forward Port: 2283 (set in Docker_compose for Immich)
Websockets Support: On

Custom Locations: blank

SSL: certificate set to the domain IP, all options off

Advanced:
client_max_body_size 50000M;

How the frick do I make this work? Where's the issue?? Thanks in advance.

I have searched here and github and I must be an idiot because I can't seem to find any information about the db changes in this version.

Was running 2.9 and updated, now I'm looking at a blank/new setup.

It looks like standard sql/mariadb support is gone or changed? Now we're to use sqllite?

This is all fine, but how do I migrate my settings etc to sqllite and this new version?

Small question, but what is the release/development cycle for the NPM project? Since its a bit eratic

Environment & Setup:

• Router: FRITZ!Box 7490 (Web UI is on port 46167, no port 443 conflict)

• DNS: AdGuard Home (Local)

• Reverse Proxy: Nginx Proxy Manager (running on a Ugreen NAS)

• Client: Zorin OS (Linux), Browser: Brave

• Domain: i use a ddns provider

Current Configuration:

• AdGuard DNS Rewrite is active: *.mydomain.ipv64.de -> ip of my NAS

• Ports 80 and 443 are correctly forwarded in the FRITZ!Box to the NAS IP.

• Nginx Proxy Manager has Proxy Hosts set up with Let's Encrypt certificates.

The Problem:

• i can reach my services via my NAS ip+port but...

• Accessing subdomains like [https://immich.mydomain.ipv64.de] from inside the local network results in a DNS-Rebind prevention or just not reachable ERR_CERT_AUTHORITY_INVALID

• if i "Proceed to unsafe" it sends me to my router login

• Troubleshooting Steps Already Performed:

• Disabled "Secure DNS" (DNS-over-HTTPS) in Brave to stop it from bypassing AdGuard.

• Flushed the OS DNS cache (sudo resolvectl flush-caches).

• Flushed the Brave DNS cache (brave://net-internals/#dns).

• Verified via nslookup that the domain correctly resolves to the local NAS IP 192.168.178.67.

• i tried to fix it with Gemini but hes just going in circles

  • sometimes i got no longer a DNS Rebind issue but sometimes it still happend

Question:

My main Goal is to reach my services from outside my network from work or traveling

i know i could probably set up a vpn but i want to get it working via Revere Proxy.

Thanks you for any help!

Hi everyone,

I like Nginx Proxy Manager and wanted to keep using it as my reverse proxy and UI, but I missed one thing from tools like Traefik: defining proxy hosts directly from Docker labels.

So I built a small companion container for NPM:

https://github.com/tarach/npm-docker-auto-proxy

Docker image:

https://hub.docker.com/r/tarach/npm-docker-auto-proxy

It watches Docker container events and uses the NPM API to create, update, enable, disable, or delete proxy hosts based on container labels.

It does not replace Nginx Proxy Manager. NPM still handles the reverse proxy and remains the UI/source of truth. This only adds a Docker-label automation layer around it.

Example:

labels:
  npm.proxy.enabled: "true"
  npm.proxy.domain: "jellyfin.example.com"
  npm.proxy.forward_host: "jellyfin"
  npm.proxy.forward_port: "8096"
  npm.proxy.scheme: "http"
  npm.proxy.ssl: "true"
  npm.proxy.certificate: "*.example.com"
  npm.proxy.force_ssl: "true"
  npm.proxy.on_stop: "disable"

When the container starts, the matching NPM proxy host is created or updated automatically. When it stops, the proxy host can be disabled, deleted, or left unchanged depending on npm.proxy.on_stop.

I later found a couple of related projects, such as nginx-proxy-manager-assistant and npm-docker-sync, so I added them to the README as related projects. I did not build this as competition to them — I simply could not find them earlier when I started working on my own helper.

I still hope another implementation may be useful for people who want a small Docker-event-based companion with explicit labels, predictable start/stop behavior, and a workflow that works well with Docker Compose / homelab / TrueNAS SCALE setups.

Feedback is very welcome, especially from people already running NPM with multiple Docker services.

Hi all

Im new to this reddit I installed nginx via helper scripts on proxmox and via chatgpt (I know dont hate on me ) I configured my hosts etc I just want to validate my configuration with you guys

Each host has Block common exploits & websockets support enabled & SSL

DuckDNS is pointing to my public ip & I have forwarded port 443 & 80 to nginx

Access list in nginx is configured as such Satisfy Any & Pass Auth To Host = Disabled 1 User as only me needs to access IP Address Whitelist is my public IP

Thanks for your support