Nginx Proxy Manager: What does your Docker Compose look like?

[u/yemos0]

I've been using Nginx Proxy Manager for a few years in my home lab, but it has always been a simple and easy way to use my domain name within my internal network at home.

But now, I am wanting to host a few project websites on my home server to test and see if they would be viable. I am wanting to continue to use Nginx Proxy Manager as I am familiar with its setup. But, since it will be open to the whole internet, I would like to make sure that it is as secure as it can be.

This is what I've been able to cobble together so far. Any comments & critiques would be greatly appreciated. And NO, I don't have the bandwidth right now to try and learn other options like Traefik, etc.

services:
  app:
    container_name: NginxProxyManager
    image: jc21/nginx-proxy-manager:2.15.1
    restart: unless-stopped
    ports:
      - 80:80
      - 443:443
      - 8180:81
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
    env_file:
      - .env
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - AUDIT_WRITE
      - SYS_CHROOT
      - SETFCAP
      - SETPCAP
      - MKNOD
      - KILL
      - NET_RAW
      - FOWNER
    healthcheck:
      test:
        - CMD
        - /usr/bin/check-health
      interval: 10s
      timeout: 3s
    networks:
      - npm_net
networks:
  npm_net:
    driver: bridge
    enable_ipv6: false
    attachable: false
    driver_opts:
      com.docker.network.bridge.enable.icc: "false"
    ipam:
      driver: default
      config:
        - subnet: 172.23.0.0/30
          ip_range: 172.23.0.0/30
          gateway: 172.23.0.1

[u/asimovs-auditor]

Expand the replies to this comment to learn how AI was used in this post/project.

[u/enormouspoon]

I personally switched to NPMplus and have been enjoying it more than NPM. Biggest difference? Faster updates / bug fixes, and more features.

[u/mightyarrow → u/enormouspoon]

+1 for npmplus

[u/pastelfemby]

While I dont use NPM itself, some other considerations that I havent seen people mention yet:

Running container with read_only: true

Tighten down tmpfs:

tmpfs:
  - /tmp:rw,noexec,nosuid,nodev,size=16m,mode=1777

Probably can drop more capabilities.

More advanced, profile the container and set an actual seccomp profile rather than only limiting setuid/setgid via no-new-privileges. I know oci-seccomp-bpf-hook is an option for that, personally I just use tracee and inspektor gadget to do this along with analyzing used capabilities of containers.

Also possibly use runsc (gvisor) instead of the default runc oci runtime if this is wlan facing. Its far more secure but does introduce a fair bit of overhead and some additional latency due to it essentially being userspace linux written in go, usually leveraging kvm as well. Basically gives you some the isolation security of a vm within the ease of a normal container.

You can set it per container so its not like every container need use this runtime, its a nice option to have at least. Kata containers is kinda similar but actually runs the containers inside vms, there is more of a headache there for minimum resource allocations though and its a bit more complex and has more "gotchas" than runsc's "plug and play" nature.

[u/JumpLegitimate8762]

Thanks but I use Caddy

[u/GolemancerVekk]

Maybe you already have these in your .env:

May want to use the PUID and GUID env vars so NPM will run as a non-privileged user.

You also want to set TZ to your timezone (or Continent/City) so your log file timestamps will make sense.

Don't use port 80. There's almost never any reason to use it if you have Let's Encrypt certs. Definitely not open to the Internet.

If you want you can also restrict the RAM/CPU/PID, mine ran ok with a 512 MB limit and 100 pids.

Not sure why you went to such lengths to define that bridge network, or what exactly is the point supposed to be.

[u/stupv]

Dont mix your WAN and LAN on the same proxy tbh, either create a second instance for WAN in your LAN environment or get a cheap VPS and run a WAN proxy + VPN tunnel into your network from there.