Installer Nginx Proxy Manager

What you'll build

Nginx Proxy Manager (NPM) puts a clean web UI on top of Nginx and Let's Encrypt. Instead of editing config files, you add "proxy hosts" through a dashboard and get automatic HTTPS certificates with a few clicks. It's the friendliest reverse proxy for beginners.

Prerequisites

• Docker and Docker Compose.
• A domain name with DNS you can edit.
• Ports 80 and 443 forwarded to your server (for public services).

Step 1: Deploy NPM

Create compose.yaml:

services:
  npm:
    image: jc21/nginx-proxy-manager:latest
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "81:81"     # admin UI
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

Start it:

docker compose up -d

Step 2: Log in and secure the account

Open http://your-server-ip:81. The default credentials are:

• Email: admin@example.com
• Password: changeme

Change both immediately on first login. This account controls how traffic reaches your services.

Step 3: Add your first proxy host

Go to Hosts → Proxy Hosts → Add Proxy Host:

1. Domain Names: jellyfin.example.com
2. Scheme: http
3. Forward Hostname / IP: the internal IP of the service, e.g. 192.168.1.10
4. Forward Port: e.g. 8096
5. Enable Block Common Exploits and Websockets Support (needed by many apps).

Point that subdomain's DNS A record at your public IP before continuing.

Step 4: Add a free TLS certificate

On the SSL tab of the proxy host:

1. Choose Request a new SSL Certificate.
2. Enable Force SSL and HTTP/2.
3. Agree to the Let's Encrypt terms and save.

NPM validates the domain and installs the certificate. Your service is now reachable over HTTPS with automatic renewal.

Step 5: DNS challenge for wildcard or internal certs

If you'd rather not expose port 80, or you want a wildcard certificate (*.example.com), use a DNS Challenge. On the SSL tab choose "Use a DNS Challenge", pick your provider (e.g. Cloudflare), and paste an API token. This works even for services you never expose to the internet.

Step 6: Add access control

For sensitive dashboards, create an Access List (Hosts → Access Lists) with username/password or IP allow-lists, then attach it to the proxy host. This adds a login prompt in front of apps that lack their own authentication.

Security checklist

• Never expose the admin UI (port 81) to the internet.
• Use Force SSL on every host.
• Add access lists to admin panels.
• Keep the container image updated.
• Combine with Fail2ban and, ideally, a VPN for internal-only tools.

Troubleshooting

• Certificate request fails — DNS isn't pointing at your IP yet, or port 80 is blocked.
• Bad Gateway — wrong forward IP/port, or the target service is down.
• App loses connection / live features break — enable Websockets Support on the proxy host.

Next steps

Once your public services are proxied, review the broader secure remote access guide to decide what should be public versus VPN-only.