Introduction to Nginx Proxy Manager
As a senior proxy expert, I have managed hundreds of servers. While raw Nginx configuration files are powerful, they are prone to syntax errors and tedious to update for dynamic environments. Nginx Proxy Manager (NPM) bridges this gap. It sits on top of the Open Resty Nginx bundle, providing a RESTful API and a Vue.js frontend that allows you to manage proxies, redirects, and streams without ever touching a terminal command line for configuration edits.
In 2025, NPM remains the de-facto standard for homelab enthusiasts and small-to-medium enterprise (SME) hosting environments because it drastically lowers the barrier to entry for setting up secure, SSL-enabled web services.
---
Part 1: Initial Setup and Deployment
Prerequisites
Before deploying NPM, ensure you have: 1. A Server: A VPS (DigitalOcean, Vultr, AWS) or a local homelab server. 2. A Domain: You need a domain (e.g., myproxy.com) pointed to your server's public IP address via A Records. 3. Docker: NPM is best run in a Docker container to ensure isolation and ease of updates.
Docker Compose Deployment
The most efficient way to deploy NPM is using docker-compose. Create a file named docker-compose.yml with the following configuration:
version: '3'
services: app: image: 'jc21/nginx-proxy-manager:latest' restart: unless-stopped ports: - '80:80' # Public HTTP - '81:81' # Admin Web Interface - '443:443' # Public HTTPS environment: DB_SQLITE_FILE: "/data/database.sqlite" DISABLE_IPV6: 'true' volumes: - ./data:/data - ./letsencrypt:/etc/letsencrypt # Optional: Database for production scale # db: # image: 'jc21/mariadb-aria:latest' # ...
Run docker-compose up -d. Once running, navigate to http://.
Default Credentials:
- Email:
admin@example.com - Password:
changeme
---
Part 2: How to Create a Proxy Host (The Core Task)
This is the "how-to" heart of NPM. A Proxy Host tells Nginx, "When a user visits domain X, serve them the content running on backend Y."
Step-by-Step Guide
1. Navigate to Hosts: Click the "Hosts" menu item and select "Proxy Hosts". 2. Add Proxy Host: Click the "Add Proxy Host" button. 3. The 3 Critical Fields: * Domain Names: Enter the public domain you want to use (e.g., home.myproxy.com). * Scheme: Select http or https (this refers to the connection *between* NPM and your backend app). * Forward Hostname / IP: Enter the internal IP address or Docker container name of your target service (e.g., 192.168.1.50 or http://home-assistant:8123). * Forward Port: Enter the port of the backend service.
SSL Automation (Let's Encrypt)
In the SSL tab of the Proxy Host configuration: 1. Select "Request a new SSL Certificate". 2. Select "Force SSL" (this redirects HTTP to HTTPS automatically). 3. Agree to the Let's Encrypt Terms of Service. 4. Use "DNS Challenge" if your ports 80/443 are blocked by your ISP, otherwise stick to the HTTP verification method.
---
Part 3: Advanced Configuration
How to Nginx Proxy Manager to a Subfolder (Subpath)
A common question from the PAA data is how to route to a subfolder. By default, NPM handles root domains well. However, hosting an app at myproxy.com/app requires specific handling because many web apps (like Home Assistant) don't know they are running in a subfolder and will load assets relative to the root (/), causing 404 errors.
The Solution: You must use Custom Locations in NPM to rewrite paths.
1. Set up the Proxy Host for the main domain (e.g., myproxy.com). 2. Click the "Advanced" tab inside the Proxy Host editor. 3. Click "Custom Locations". 4. Location: /app 5. Scheme: http 6. Forward Host: 192.168.1.50 7. Forward Port: 8080
Critical Technical Detail: You must also ensure your backend application supports base URL configuration, or you must use Nginx rewrites to strip the path before it hits the backend.
In the Custom Nginx Configuration box within the Advanced tab, you can inject:
location /app {
proxy_pass http://backend_ip:port/; rewrite ^/app/(.*) /$1 break; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; }
Security: Access Lists and CrowdSec
What does Access List do on Nginx Proxy Manager?
The Access List tab allows you to restrict who can access your Proxy Host.
1. Basic Auth: Username and password protection. Useful for staging sites. 2. Allow List: Whitelist specific IP addresses. Extremely useful for admin dashboards (e.g., /admin) to ensure only your office IP can access the login page.
Integrating CrowdSec (The 2025 Standard)
To prevent brute-force attacks on your proxies, integrating CrowdSec is highly recommended. While NPM doesn't have a native "CrowdSec" button, you can use the Nginx Bouncer.
Since NPM allows you to inject custom Nginx configuration, you can configure the CrowdSec remediation directive in the Custom Nginx Configuration tab:
Include the CrowdSec decision configuration
include /etc/nginx/crowdsec.conf;
This requires installing the CrowdSec bouncer inside the NPM Docker container (which can be complex due to container restarts overwriting changes) or mounting the bouncer config as a volume.
---
Part 4: Troubleshooting Common Errors
1. dns_probe_finished_nxdomain
This is the most common error seen by users. It is not an NPM error. It is a DNS error.
Diagnosis:
myproxy.com points.Fix: Run dig +short myproxy.com from your terminal. If it doesn't return your server's IP, fix your DNS records before touching NPM.
2. Bad Gateway (502)
Diagnosis:
Forward Hostname/IP is correct.3. Connection Refused on Port 443
Diagnosis:
---
Conclusion
Nginx Proxy Manager transforms the arduous task of reverse proxy management into a simple dashboard experience. By mastering the Proxy Host creation, leveraging Custom Locations for subfolder deployments, and utilizing Access Lists for security, you can expose your internal services to the web safely and securely in 2025.