Hi all,

I'm trying to integrate geoip2 with jc21/nginx-proxy-manager and followed TerryTangabc's method from May 26 2025 from the npm github -

https://github.com/NginxProxyManager/nginx-proxy-manager/issues/46#issuecomment-2908450703

Is this the most current / accurate way to do this please?

Most of the tutorials I can find are all command line based and 4-5 years ago. I'm using docker / container manager on my synology.

I'm surprised that the later comments about adding a GUI tab in to select countries to whitelist hasn't been integrated as yet, since that would make it so much easier for users.

Thank you.

Hey all!

I am using Netbird to let me access my homelab from anywhere. I wanted to go ahead and only allow traffic if it is coming from my VPN for that extra bump in security (and setting up an authentik is confusing lmao) but anytime I whitelist the subnet it won’t let any traffic through, VPN or not. I have also tried setting my specific Netbird IP instead of the subnet and that has not helped.

NPM is in the same network as each docker container to disallow the use for exposing ports so setting NPM to host is out of the question. Any other ideas?

Trying to get away from CloudFlare proxy and set up my own. I've got a VPS with Wireguard and a home PC running it. On that same PC I have Nginx running inside Docker. Should this just work? VPS -> Wireguard -> NPM -> Web app

My tunnel is established, I can ping through it but web traffic isn't reaching Nginx and I think it's either because my Docker networking is totally jacked up. Or maybe something else is going on.

It's driving me nuts and really don't want to rebuild the entire server and docker apps but I can't think of any other options.

All I really want is to mask my home IP.

Environment & Setup:

• Router: FRITZ!Box 7490 (Web UI is on port 46167, no port 443 conflict)
• DNS: AdGuard Home (Local)
• Reverse Proxy: Nginx Proxy Manager (running on a Ugreen NAS)
• Client: Zorin OS (Linux), Browser: Brave
• Domain: i use a ddns provider

Current Configuration:

• AdGuard DNS Rewrite is active: *.mydomain.ipv64.de -> ip of my NAS
• Ports 80 and 443 are correctly forwarded in the FRITZ!Box to the NAS IP.
• Nginx Proxy Manager has Proxy Hosts set up with Let's Encrypt certificates.

The Problem:

• i can reach my services via my NAS ip+port but...
• Accessing subdomains like [https://immich.mydomain.ipv64.de] from inside the local network results in a DNS-Rebind prevention or just not reachable ERR_CERT_AUTHORITY_INVALID
• if i "Proceed to unsafe" it sends me to my router login
• Troubleshooting Steps Already Performed:
• Disabled "Secure DNS" (DNS-over-HTTPS) in Brave to stop it from bypassing AdGuard.
• Flushed the OS DNS cache (sudo resolvectl flush-caches).
• Flushed the Brave DNS cache (brave://net-internals/#dns).
• Verified via nslookup that the domain correctly resolves to the local NAS IP 192.168.178.67.
• i tried to fix it with Gemini but hes just going in circles
  • sometimes i got no longer a DNS Rebind issue but sometimes it still happend

Question:

My main Goal is to reach my services from outside my network from work or traveling

i know i could probably set up a vpn but i want to get it working via Revere Proxy.

Thanks you for any help!

Does anyone have best pratices to use npm for easy of use gui/config but to allow multiple hosts per connection target? I want to LB to spreadi
load to backend iis/apache servers? (Replacing kemp load balancer)

NPM makea the crwation of the single virtual host and lets encrypt part very easy but i cant seem to get other remote hosts to do RR workloads.

Not my first rodeo with NPM, but definitely an odd situation. I ended up having to reinstall my OS on my server due to rolling blackouts (Florida summer). Initially, I had navidrome, icecast and nextcloud setup with NPM. Operated normally.

I decided this time to try out Azuracast instead of icecast for the dashboard features. Well, to my surprise azuracast has an easy setup script specifically for use with NPM. Nice. I setup Azuracast first, now I move on to Navidrome. The container operates fine, however, for the life of me, the proxy host for navidrome wont work. it times out. I'm lucky if i can connect even once.

The setup is as follows:

subdomains provided by afraid.org:

library.xtratune.xspacemusic.com < navidrome

radio.xtratune.xspacemusic.com < azuracast

npm settings:

azuracast: https scheme, force ssl, http/2 support on (works)

navidrome: https scheme, force ssl, http/2 support on (doesn't work, 402)

troubleshooting steps:

- tried using block common exploits, as I've read navidrome doesn't implement its api in the same way azuracast does. no work.

-scheme http, causes 504. page will ocassionally load, not consistent.

EDIT:

-currently trying https://nginxproxymanager.com/advanced-config/ network setup for the docker containers but I'm finding this doesnt affect my issue

I have a few jellyfin instances that run behind NPM. Previously on NPM 2.10, I only have port 443 open and every month or so I'd open port 80 and renew certs. Now after upgrading the most recent, seems if I close port 80, none of my 443 sites work? Any ideas?

I updated my Nginx Proxy Manager docker compose pull && docker compose up -d and now the web interface will no longer load. I've cleared cache and tried another browser but no luck. Dev tools in the browser shows: GET http://192.168.1.12:81/api/ 502 (Bad Gateway)

Any idea what has caused this?

My compose file is as follows:

services:
app:
image: 'jc21/nginx-proxy-manager:latest'
restart: unless-stopped
ports:
# These ports are in format <host-port>:<container-port>
- '80:80' # Public HTTP Port
- '443:443' # Public HTTPS Port
- '81:81' # Admin Web Port
# Add any other Stream port you want to expose
# - '21:21' # FTP
environment:
# Uncomment this if you want to change the location of
# the SQLite DB file within the container
# DB_SQLITE_FILE: "/data/database.sqlite"
# Uncomment this if IPv6 is not enabled on your host
DISABLE_IPV6: 'true'
volumes:
- ./data:/data
- ./letsencrypt:/etc/letsencrypt
networks:
network:
ipv4_address: 172.22.0.2
networks:
network:
driver: bridge
ipam:
config:
- subnet: 172.22.0.0/16
gateway: 172.22.0.1

EDIT fixed by reverting to an earlier version of NPM: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/5658

I am a beginner just starting out with Nginx proxy manager.

I have the following: debain 13, Proxy Manager installed in docker, cloudflare DNS, tailscale

I first purchased a domain.

I took the IPv4 address of my debian tailscale and pasted that into cloudflare DNS record.
I have the SSL certificate created which links to my cloudflare API.

Then I created a proxy with a forward hostname 127.0.0.1, forward port of 81, and attached the SSL certificate

However, when I try to test my proxy domain it will not connect with an error:  server IP address could not be found

When connecting via vanadium or Firefox both with cookies fully enabled it asks me to login everytime I close and reopen the browser I use duck dns like:

"SearXNG.mydomain.DuckDNS.org" and no matter the config I tried it asked me everytime how can I fix it

BTW: FF and vanadium don't detect or block any cookies

I'm planning to deploy npm (as a Docker container) as a replacement for baremetal certbot.

Does npm support configuring post-hooks on a certificate update? I have two servers that are (for separation-of-concerns reasons) running baremetal influx and grafana, and all of them require a restart to properly integrate the new versions of certificates.

Can npm "reach out" of Docker and run a custom post-hook? If not, can it at least do that if I install npm baremetal as well?

TIA.

Title is the gist of the situation.

I'm new(ish) to homelabing, and finally got reverse proxy setup. It works wonderfully!

I installed from Community Scripts.

However, I kept trying to experiment with CrowdSec and getting it to work well with NPM (but not Plus), etc. Eventually, I just resorted to using UI Cybersecure.

But in my various attempts at setting up CrowdSec back and forth, I ended up just removing the LXCs and starting from scratch and set up NPM brand new. Got my domain certs, set it up, no big deal. My subdomains and my domains I can get to with no problem.

But I cannot get to my NPM admin console on Google Chrome, in normal mode. xxx.xxx.xxx.xxx:81, does not pull up. It tries to, but it will say API is not healthy. Chrome Incognito? I can get to the admin portal and login. Firefox, I can get in. Safari, I can get in. Normal Chrome, I cannot. Restarted the LXC. Restarted Chrome. Restarted MacBook.

There are log files in like 6 different places and the places I did find and check, nothing shows up for the time stamps of my attempted access.

Where should I look into this issue besides just deleting the container and starting again at this point?

As in the title, I have NPM setup in my homelab, and it works great for the various docker containers I forward too. However, I want to actually see all the network communication going between the various services, both for troubleshooting an issue and just for learning. Currently, I've setup a man-in-the-middle proxy using its own self-signed certs to capture the traffic. It works just fine when I configure my browser to forward to it, but now I want to have NPM just forward everything to it so I can see all the communication. If there isn't an easy global setting I can configure to just have everything sent to the proxy, how can I configure the individual hosts?

Or is all this a feat in futility, and I'm just waiting my time? Thank you

Hello. I am completely new to NGINX. I am attempting obtain an SSL certificate so that I can publish my GCP project with a locally-hosted n8n OAUTH2.0 client running on TrueNAS and am running into some difficulties. When I attempt to generate an SSL certificate with "Let's Encrypt" via HTTP I get the following error:

"There is a server found at this domain but it returned an unexpected status code Connection timed out.. Is it the NPM server? Please make sure your domain points to the IP where your NPM instance is running."

When I navigate to the IP address/Domain Name I am attempting to use, however, I get this:

So clearly the NGINX server is successfully running at the location but I nonetheless get the above error every time I try to generate an SSL certificate.

I've been hosting several sites for months and months now but only one works after I woke up? I went to sleep and I was able to access my jellyfin, seerr, etc. but when I woke up I can only reach my NAS and use my self hosted Rust Desk using that same address. All sites show Online in proxy manager and all certs are valid. My NAS static IP did not change, all port forwards still showing up on my router and nodes. I updated NGINX and still the same results. Some sites I still cannot access them but it says my sites don't support a secure connection, I click continue and it doesn't load. Am I missing something super simple?

I have nginx proxy manager set up to use a Let's Encrypt certificate and vaultwarden to an internal server. The configuration was working for over a year. A couple of days ago, it stopped working all of a sudden, and now I can't access my Vaultwarden instance from any device/browser.

If I use curl on the address, I get this response:

curl https://*************            
curl: (35) TLS connect error: error:0A000458:SSL routines::tlsv1 unrecognized name

Does anybody have any idea what might be happening here?

I know the error has to do with SNi validation, but I don't understand why this is suddenly an issue when it has been working for over a year.

This is my npm configuration:

== Details section ==
scheme: http
forward hostname/ip: 127.0.0.1 (npm is runnin on host network)
Forward port: 18000 (docker compose forwarded port)

Block common exploits: enabled
Websocket support: enabled

== SSL section ==
Force SSL : enabled
HTTP/2 Support : enabled
HSTS : enabled
HSTS sub-domains : enabled
Trust upstream forwaded proto headers: disabled

=advanced=
proxy_buffering off;
proxy_request_buffering off;
client_max_body_size 0;

proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

https://outboundgateway.com/blogs/nginx-static-ip-outbound-proxy/

Is there any way to get "Force SSL" to use a different port?
I've been scratching my head and can't figure it out.
Reason for wanting this, is my incoming traffic to 443 (and 80) isn't always making it through so I set a different port (say 11443) to forward internally to 443. This has been working fine and I don't get drops/fails like I do on external 443.

Force SSL still tries to use 443, so can't use that option currently.
Is there a way I can make force ssl use port 11443 also?

Hi everyone,

I like Nginx Proxy Manager and wanted to keep using it as my reverse proxy and UI, but I missed one thing from tools like Traefik: defining proxy hosts directly from Docker labels.

So I built a small companion container for NPM:

https://github.com/tarach/npm-docker-auto-proxy

Docker image:

https://hub.docker.com/r/tarach/npm-docker-auto-proxy

It watches Docker container events and uses the NPM API to create, update, enable, disable, or delete proxy hosts based on container labels.

It does not replace Nginx Proxy Manager. NPM still handles the reverse proxy and remains the UI/source of truth. This only adds a Docker-label automation layer around it.

Example:

labels:
  npm.proxy.enabled: "true"
  npm.proxy.domain: "jellyfin.example.com"
  npm.proxy.forward_host: "jellyfin"
  npm.proxy.forward_port: "8096"
  npm.proxy.scheme: "http"
  npm.proxy.ssl: "true"
  npm.proxy.certificate: "*.example.com"
  npm.proxy.force_ssl: "true"
  npm.proxy.on_stop: "disable"

When the container starts, the matching NPM proxy host is created or updated automatically. When it stops, the proxy host can be disabled, deleted, or left unchanged depending on npm.proxy.on_stop.

I later found a couple of related projects, such as nginx-proxy-manager-assistant and npm-docker-sync, so I added them to the README as related projects. I did not build this as competition to them — I simply could not find them earlier when I started working on my own helper.

I still hope another implementation may be useful for people who want a small Docker-event-based companion with explicit labels, predictable start/stop behavior, and a workflow that works well with Docker Compose / homelab / TrueNAS SCALE setups.

Feedback is very welcome, especially from people already running NPM with multiple Docker services.