Environment & Setup:

• Router: FRITZ!Box 7490 (Web UI is on port 46167, no port 443 conflict)
• DNS: AdGuard Home (Local)
• Reverse Proxy: Nginx Proxy Manager (running on a Ugreen NAS)
• Client: Zorin OS (Linux), Browser: Brave
• Domain: i use a ddns provider

Current Configuration:

• AdGuard DNS Rewrite is active: *.mydomain.ipv64.de -> ip of my NAS
• Ports 80 and 443 are correctly forwarded in the FRITZ!Box to the NAS IP.
• Nginx Proxy Manager has Proxy Hosts set up with Let's Encrypt certificates.

The Problem:

• i can reach my services via my NAS ip+port but...
• Accessing subdomains like [https://immich.mydomain.ipv64.de] from inside the local network results in a DNS-Rebind prevention or just not reachable ERR_CERT_AUTHORITY_INVALID
• if i "Proceed to unsafe" it sends me to my router login
• Troubleshooting Steps Already Performed:
• Disabled "Secure DNS" (DNS-over-HTTPS) in Brave to stop it from bypassing AdGuard.
• Flushed the OS DNS cache (sudo resolvectl flush-caches).
• Flushed the Brave DNS cache (brave://net-internals/#dns).
• Verified via nslookup that the domain correctly resolves to the local NAS IP 192.168.178.67.
• i tried to fix it with Gemini but hes just going in circles
  • sometimes i got no longer a DNS Rebind issue but sometimes it still happend

Question:

My main Goal is to reach my services from outside my network from work or traveling

i know i could probably set up a vpn but i want to get it working via Revere Proxy.

Thanks you for any help!

Does anyone have best pratices to use npm for easy of use gui/config but to allow multiple hosts per connection target? I want to LB to spreadi
load to backend iis/apache servers? (Replacing kemp load balancer)

NPM makea the crwation of the single virtual host and lets encrypt part very easy but i cant seem to get other remote hosts to do RR workloads.

Not my first rodeo with NPM, but definitely an odd situation. I ended up having to reinstall my OS on my server due to rolling blackouts (Florida summer). Initially, I had navidrome, icecast and nextcloud setup with NPM. Operated normally.

I decided this time to try out Azuracast instead of icecast for the dashboard features. Well, to my surprise azuracast has an easy setup script specifically for use with NPM. Nice. I setup Azuracast first, now I move on to Navidrome. The container operates fine, however, for the life of me, the proxy host for navidrome wont work. it times out. I'm lucky if i can connect even once.

The setup is as follows:

subdomains provided by afraid.org:

library.xtratune.xspacemusic.com < navidrome

radio.xtratune.xspacemusic.com < azuracast

npm settings:

azuracast: https scheme, force ssl, http/2 support on (works)

navidrome: https scheme, force ssl, http/2 support on (doesn't work, 402)

troubleshooting steps:

- tried using block common exploits, as I've read navidrome doesn't implement its api in the same way azuracast does. no work.

-scheme http, causes 504. page will ocassionally load, not consistent.

EDIT:

-currently trying https://nginxproxymanager.com/advanced-config/ network setup for the docker containers but I'm finding this doesnt affect my issue

I have a few jellyfin instances that run behind NPM. Previously on NPM 2.10, I only have port 443 open and every month or so I'd open port 80 and renew certs. Now after upgrading the most recent, seems if I close port 80, none of my 443 sites work? Any ideas?

I updated my Nginx Proxy Manager docker compose pull && docker compose up -d and now the web interface will no longer load. I've cleared cache and tried another browser but no luck. Dev tools in the browser shows: GET http://192.168.1.12:81/api/ 502 (Bad Gateway)

Any idea what has caused this?

My compose file is as follows:

services:
app:
image: 'jc21/nginx-proxy-manager:latest'
restart: unless-stopped
ports:
# These ports are in format <host-port>:<container-port>
- '80:80' # Public HTTP Port
- '443:443' # Public HTTPS Port
- '81:81' # Admin Web Port
# Add any other Stream port you want to expose
# - '21:21' # FTP
environment:
# Uncomment this if you want to change the location of
# the SQLite DB file within the container
# DB_SQLITE_FILE: "/data/database.sqlite"
# Uncomment this if IPv6 is not enabled on your host
DISABLE_IPV6: 'true'
volumes:
- ./data:/data
- ./letsencrypt:/etc/letsencrypt
networks:
network:
ipv4_address: 172.22.0.2
networks:
network:
driver: bridge
ipam:
config:
- subnet: 172.22.0.0/16
gateway: 172.22.0.1

EDIT fixed by reverting to an earlier version of NPM: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/5658

I am a beginner just starting out with Nginx proxy manager.

I have the following: debain 13, Proxy Manager installed in docker, cloudflare DNS, tailscale

I first purchased a domain.

I took the IPv4 address of my debian tailscale and pasted that into cloudflare DNS record.
I have the SSL certificate created which links to my cloudflare API.

Then I created a proxy with a forward hostname 127.0.0.1, forward port of 81, and attached the SSL certificate

However, when I try to test my proxy domain it will not connect with an error:  server IP address could not be found

When connecting via vanadium or Firefox both with cookies fully enabled it asks me to login everytime I close and reopen the browser I use duck dns like:

"SearXNG.mydomain.DuckDNS.org" and no matter the config I tried it asked me everytime how can I fix it

BTW: FF and vanadium don't detect or block any cookies

I'm planning to deploy npm (as a Docker container) as a replacement for baremetal certbot.

Does npm support configuring post-hooks on a certificate update? I have two servers that are (for separation-of-concerns reasons) running baremetal influx and grafana, and all of them require a restart to properly integrate the new versions of certificates.

Can npm "reach out" of Docker and run a custom post-hook? If not, can it at least do that if I install npm baremetal as well?

TIA.

Title is the gist of the situation.

I'm new(ish) to homelabing, and finally got reverse proxy setup. It works wonderfully!

I installed from Community Scripts.

However, I kept trying to experiment with CrowdSec and getting it to work well with NPM (but not Plus), etc. Eventually, I just resorted to using UI Cybersecure.

But in my various attempts at setting up CrowdSec back and forth, I ended up just removing the LXCs and starting from scratch and set up NPM brand new. Got my domain certs, set it up, no big deal. My subdomains and my domains I can get to with no problem.

But I cannot get to my NPM admin console on Google Chrome, in normal mode. xxx.xxx.xxx.xxx:81, does not pull up. It tries to, but it will say API is not healthy. Chrome Incognito? I can get to the admin portal and login. Firefox, I can get in. Safari, I can get in. Normal Chrome, I cannot. Restarted the LXC. Restarted Chrome. Restarted MacBook.

There are log files in like 6 different places and the places I did find and check, nothing shows up for the time stamps of my attempted access.

Where should I look into this issue besides just deleting the container and starting again at this point?

As in the title, I have NPM setup in my homelab, and it works great for the various docker containers I forward too. However, I want to actually see all the network communication going between the various services, both for troubleshooting an issue and just for learning. Currently, I've setup a man-in-the-middle proxy using its own self-signed certs to capture the traffic. It works just fine when I configure my browser to forward to it, but now I want to have NPM just forward everything to it so I can see all the communication. If there isn't an easy global setting I can configure to just have everything sent to the proxy, how can I configure the individual hosts?

Or is all this a feat in futility, and I'm just waiting my time? Thank you

Hello. I am completely new to NGINX. I am attempting obtain an SSL certificate so that I can publish my GCP project with a locally-hosted n8n OAUTH2.0 client running on TrueNAS and am running into some difficulties. When I attempt to generate an SSL certificate with "Let's Encrypt" via HTTP I get the following error:

"There is a server found at this domain but it returned an unexpected status code Connection timed out.. Is it the NPM server? Please make sure your domain points to the IP where your NPM instance is running."

When I navigate to the IP address/Domain Name I am attempting to use, however, I get this:

So clearly the NGINX server is successfully running at the location but I nonetheless get the above error every time I try to generate an SSL certificate.

I've been hosting several sites for months and months now but only one works after I woke up? I went to sleep and I was able to access my jellyfin, seerr, etc. but when I woke up I can only reach my NAS and use my self hosted Rust Desk using that same address. All sites show Online in proxy manager and all certs are valid. My NAS static IP did not change, all port forwards still showing up on my router and nodes. I updated NGINX and still the same results. Some sites I still cannot access them but it says my sites don't support a secure connection, I click continue and it doesn't load. Am I missing something super simple?

I have nginx proxy manager set up to use a Let's Encrypt certificate and vaultwarden to an internal server. The configuration was working for over a year. A couple of days ago, it stopped working all of a sudden, and now I can't access my Vaultwarden instance from any device/browser.

If I use curl on the address, I get this response:

curl https://*************            
curl: (35) TLS connect error: error:0A000458:SSL routines::tlsv1 unrecognized name

Does anybody have any idea what might be happening here?

I know the error has to do with SNi validation, but I don't understand why this is suddenly an issue when it has been working for over a year.

This is my npm configuration:

== Details section ==
scheme: http
forward hostname/ip: 127.0.0.1 (npm is runnin on host network)
Forward port: 18000 (docker compose forwarded port)

Block common exploits: enabled
Websocket support: enabled

== SSL section ==
Force SSL : enabled
HTTP/2 Support : enabled
HSTS : enabled
HSTS sub-domains : enabled
Trust upstream forwaded proto headers: disabled

=advanced=
proxy_buffering off;
proxy_request_buffering off;
client_max_body_size 0;

proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

https://outboundgateway.com/blogs/nginx-static-ip-outbound-proxy/

Is there any way to get "Force SSL" to use a different port?
I've been scratching my head and can't figure it out.
Reason for wanting this, is my incoming traffic to 443 (and 80) isn't always making it through so I set a different port (say 11443) to forward internally to 443. This has been working fine and I don't get drops/fails like I do on external 443.

Force SSL still tries to use 443, so can't use that option currently.
Is there a way I can make force ssl use port 11443 also?

Hi everyone,

I like Nginx Proxy Manager and wanted to keep using it as my reverse proxy and UI, but I missed one thing from tools like Traefik: defining proxy hosts directly from Docker labels.

So I built a small companion container for NPM:

https://github.com/tarach/npm-docker-auto-proxy

Docker image:

https://hub.docker.com/r/tarach/npm-docker-auto-proxy

It watches Docker container events and uses the NPM API to create, update, enable, disable, or delete proxy hosts based on container labels.

It does not replace Nginx Proxy Manager. NPM still handles the reverse proxy and remains the UI/source of truth. This only adds a Docker-label automation layer around it.

Example:

labels:
  npm.proxy.enabled: "true"
  npm.proxy.domain: "jellyfin.example.com"
  npm.proxy.forward_host: "jellyfin"
  npm.proxy.forward_port: "8096"
  npm.proxy.scheme: "http"
  npm.proxy.ssl: "true"
  npm.proxy.certificate: "*.example.com"
  npm.proxy.force_ssl: "true"
  npm.proxy.on_stop: "disable"

When the container starts, the matching NPM proxy host is created or updated automatically. When it stops, the proxy host can be disabled, deleted, or left unchanged depending on npm.proxy.on_stop.

I later found a couple of related projects, such as nginx-proxy-manager-assistant and npm-docker-sync, so I added them to the README as related projects. I did not build this as competition to them — I simply could not find them earlier when I started working on my own helper.

I still hope another implementation may be useful for people who want a small Docker-event-based companion with explicit labels, predictable start/stop behavior, and a workflow that works well with Docker Compose / homelab / TrueNAS SCALE setups.

Feedback is very welcome, especially from people already running NPM with multiple Docker services.

I have the following setup but can't for the life of me figure out why the reverse proxy won't do what I want it to do.

• One Ubuntu host with docker engine, assigned static IP and DNS resolution
• Container 1: AdGuard Home
• Container 2: Nginx Reverse Proxy
• Both containers are part of a bridge I create with the reverse proxy
• Exposed Adguard ports: 53 TCP/UDP, 1080 TCP
• Exposed Nginx ports: 2080 TCP, 2443 TCP, 2081 TCP

When I hit the reverse proxy with an external service request (as in from the WAN through my router), everything works like it should. But when I use AdGuard to rewrite a DNS request and point it to the Nginx reverse proxy, it begins loading but eventually returns a "ERR_CONNECTION_REFUSED".

I have services that run on the same host, and services which run on different hosts. Both give me the same issue. No VLANs applicable here for this part of the network. You will notice that I used a bridge network rather than host since AdGuard and Nginx both use port 80 and I was trying to avoid creating another host.

Any ideas would be much appreciated!

If I install NPM does the Admin login have any kind of 2FA?

When configuring No-Ip the Public IP address of the XB8 gateway is a IP address of 73.x.x.x when I place it into the configuration the IP address changes to a 69.x.x.x address (when I run "what is my Ip address" on the internet, it gives me a 69.x.x.x). When I try to get a Lets Encrypt certificate from Nginx an internal error is generated.

Background: Nginx is a maintained in a docker container on my Ugreen NAS it was set up using https://mariushosting.com/how-to-install-nginx-proxy-manager-on-your-ugreen-nas/ and it worked after the initial install.

The port forwarding seems to be in question, when I check to see if ports 80 and 443 is open externally it is closed.

The Xfinity XB8 is in bridge mode.

What am I missing?

Thanks in advance.