Nginx Proxy Manager

Last reviewed Aug 26, 2026 · 806 words

Nginx Proxy Manager is the right first reverse proxy for anyone who would rather click to HTTPS than write config, and it stays a reasonable choice long after that. The two ways people make it unsafe are both about ports: publishing the admin UI on 81 to the internet, and hurrying through the [email protected] / changeme login that it asks you to replace on first sign-in. Fix those in the compose file and the first 5 minutes, and the rest of this guide is about getting more out of it than the defaults.

80 and 443 to the world, 81 to nobody

services:
  npm:
    image: jc21/nginx-proxy-manager:latest
    ports:
      - "80:80"
      - "443:443"
      - "127.0.0.1:81:81"
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
    networks: [proxy]
    restart: unless-stopped

networks:
  proxy:
    external: true

Port 81 bound to loopback means the dashboard is reachable from the host, over SSH port-forwarding or a VPN, and from nowhere else. The two volumes hold the SQLite database (default since the 2.x line, no MariaDB needed) and every certificate; back them up together. Run docker network create proxy once before docker compose up -d, then open http://localhost:81, sign in with the default credentials, and set a real email and a long password when prompted.

Proxy hosts by container name, not IP

The habit that saves the most pain later: attach every service you publish to that same proxy network, and in the Proxy Host form set Forward Hostname to the container name and Forward Port to the port the app listens on inside the container, not the host port you happened to map. jellyfin on 8096, immich-server on 2283, vaultwarden on 80. Docker's DNS resolves the names, nothing else needs a published port, and a container's IP changing on restart never breaks anything. Tick Block Common Exploits and Websockets Support on every host; the second one is off by default and its absence is why a new app's UI half-works and drops live updates.

Wildcard certificates through the DNS challenge

The default HTTP challenge issues one certificate per hostname and needs port 80 reachable from Let's Encrypt, which fails for anything LAN-only. The DNS challenge fixes both: under SSL Certificates, choose Let's Encrypt, tick Use a DNS Challenge, pick your provider from the list of about 40 (Cloudflare, Hetzner, deSEC, Route53 and the usual registrars are there), paste an API token, and request *.example.com plus example.com. One certificate, every host, renewed automatically, and services that never touch the internet still get a padlock. Give the token the narrowest scope the provider allows, usually "edit DNS for this one zone".

The Advanced tab is where the limits show

Anything the form does not cover goes in a per-host Custom Nginx Configuration box, and that is where "limited advanced Nginx tuning" bites. Header rewrites, large upload limits (client_max_body_size 0; for Immich and Nextcloud), rate limiting, and forward authentication are all pasted snippets with no validation until nginx reloads and either accepts or rejects them. There is no service discovery: Traefik watches Docker labels and configures itself when a container starts, and NPM will always need you to fill in a form. Caddy does the same job with a 3-line site block per host and HTTPS on by default, and its config lives in git rather than a SQLite file. Upgrades of the latest tag have occasionally broken installs, so pin a version and read the release notes before pulling. The reverse proxy showdown sets the three side by side with numbers.

Authentication in front of your apps

Access Lists cover the simple case: HTTP basic auth users and an IP allow list, attached per host, which is enough to put a password on a Sonarr or a Grafana that has none. For single sign-on, Authelia or Authentik works with NPM through the forward-auth snippet in their docs, pasted into the Advanced tab of each protected host and the auth portal itself published as a normal proxy host. It is about 25 lines per host and it works; it is also the moment many people move to Caddy or Traefik, where the same thing is one directive or one label.

What I'd do

Nginx Proxy Manager, pinned to a version, on a shared Docker network, port 81 on loopback, a wildcard certificate via DNS challenge, and every app added by container name with websockets on. Access lists on anything without its own login. When you find yourself pasting the same 25-line auth snippet for the fourth time, that is your sign to try Caddy; until then, NPM at 256 MB of RAM is doing everything a homelab needs.