SHSelfHostIndex

Reverse Proxy & Gateways

Route and secure your services with self-hosted reverse proxies, gateways, and ingress managers.

121 self-hosted apps · 154 comparisons

All reverse proxy & gateways apps

Last reviewed Aug 26, 2026 · 455 words

Caddy is the right reverse proxy for most self-hosters: three lines of config per service, automatic HTTPS, a single 64 MB binary. The rest of this page covers the cases where it isn't, and the sizable slice of this category (DNS blockers, API gateways, debugging proxies) that isn't a reverse proxy at all.

How to choose a reverse proxy

Configuration model is the real differentiator, because all the serious contenders handle TLS automatically. Caddy uses a static Caddyfile you edit and reload — obvious to read, easy to version-control. Traefik inverts that: it watches Docker labels and configures itself as containers appear, which is superb once you run 15 services and opaque while you learn it. Nginx Proxy Manager puts a web UI over Nginx — click to add a proxy host, click again for a Let's Encrypt certificate — on about 256 MB. The full head-to-head between the first two is in Caddy vs Traefik.

Second axis: environment. On a single Docker host, any of the three works. On Kubernetes, Traefik is the natural fit, and Kong belongs in the conversation only when you are managing API traffic with rate limiting and auth plugins — it typically wants Postgres and brings a steep configuration curve.

Third: certificate operations, where the beginner mistakes live. Persist Caddy's /data volume, or every container recreate re-issues certificates and burns through Let's Encrypt rate limits. On Nginx Proxy Manager, the admin UI listens on port 81 with a default login of [email protected] / changeme — expose ports 80 and 443 to the internet, never 81, and change that password on first login.

Where to start

Caddy for anyone comfortable editing a text file: least config, fewest surprises, HTTP/3 included if you keep the 443/udp port mapping. Nginx Proxy Manager for anyone who wants a GUI and a certificate without reading documentation — it is the favorite first proxy in home labs for a reason. Traefik when your services live and die by docker compose and you want routing to follow automatically.

Half this category does a different job

Pi-hole and AdGuard Home are network-wide DNS ad blockers, not proxies — they sit in front of your DNS, not your web apps, and both fight systemd-resolved for port 53 on first install. mitmproxy is an interception tool for debugging HTTPS traffic, explicitly not for production. acme.sh is a certificate client for stacks that don't manage their own. Useful software, wrong shelf.

A first-timer should deploy Caddy, put two services behind it, and stop. Everything else in the category can wait until a concrete need names it.

Curated picks

Easiest Reverse Proxy & Gateways to self-hostBest API Reverse Proxy & GatewaysBest Beginner-Friendly Reverse Proxy & GatewaysBest Cross-Platform Reverse Proxy & GatewaysBest Docker Reverse Proxy & GatewaysBest Encrypted Reverse Proxy & GatewaysBest Free Reverse Proxy & GatewaysBest Kubernetes Reverse Proxy & GatewaysBest Lightweight Reverse Proxy & GatewaysBest Multi-User Reverse Proxy & GatewaysBest No-Database Reverse Proxy & GatewaysBest OAuth Reverse Proxy & GatewaysBest Plugins Reverse Proxy & GatewaysBest Real-Time Reverse Proxy & GatewaysBest SSO Reverse Proxy & Gateways

Reverse Proxy & Gateways comparisons

154 head-to-head comparisons in this category.

See all comparisons →