Nginx Proxy Manager

Nginx Proxy Manager is a Docker container that puts a web dashboard in front of Nginx, so pointing a domain at something on your network and getting a valid HTTPS certificate never touches a line of Nginx configuration. Add a proxy host, request a Let’s Encrypt certificate, flip on Force SSL, and jellyfin.yourdomain.com becomes reachable from anywhere with real HTTPS in front of it instead of a bare IP and port. It’s usually the first reverse proxy a homelabber runs: the barrier to entry is genuinely low, and the project’s own stated goal, in the maintainer’s words, is a setup “so easy that a monkey could do it.”

Why use it instead of configuring Nginx by hand

Hand-editing nginx.conf for every new subdomain, then running certbot separately for each certificate, is exactly the kind of repetitive, typo-prone work that keeps self-hosters from putting more than one or two services behind real HTTPS. Nginx Proxy Manager collapses that into a form: hostname, forward IP, forward port, a toggle for SSL. It requests and renews the Let’s Encrypt certificate itself, no separate cron job or renewal hook to maintain. That matters more once a homelab grows past a couple of containers; our homelab setup guide for beginners covers the hardware this typically runs on. By five or six services each wanting their own subdomain, a hand-written Nginx block with a typo in it is a real outage risk, not just an inconvenience. NPM doesn’t replace understanding what a reverse proxy does. It just gets the syntax out of the way.

Installing Nginx Proxy Manager with Docker

This is the SQLite configuration from the project’s own setup documentation, the one most homelabs start with. A MySQL or MariaDB backend is documented separately for larger deployments, but isn’t necessary for a first install.

services:
  app:
    image: 'jc21/nginx-proxy-manager:2.15.1'
    restart: unless-stopped
    ports:
      - '80:80'
      - '443:443'
      - '81:81'
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

1. Install Docker if it isn’t already on the host, save the file above as docker-compose.yml, and run docker compose up -d.
2. Forward ports 80 and 443 on your router to this machine. Leave port 81 closed to the outside world, that’s the admin dashboard, not something Let’s Encrypt or a visitor needs to reach.
3. Give it a minute or two on first run while JWT keys generate and the database initializes.
4. Open http://your-server-ip:81 and log in with the default account, and changeme, the same on every fresh install.

docker compose up -d
docker compose logs -f app

Adding a proxy host and enabling SSL

Once logged in, the setup wizard prompts for a new admin name, email, and password before anything else. Replace the defaults here, not later.

1. Point your domain’s DNS A record, or a CNAME for a subdomain, at your public IP, or use a dynamic DNS provider like DuckDNS if that IP changes.
2. In the dashboard, go to Hosts, then Proxy Hosts, then Add Proxy Host.
3. Enter the domain name, then the internal IP address and port of whatever you’re exposing, Jellyfin on 8096, for instance, or any other service already running on the network.
4. Switch to the SSL tab, request a new Let’s Encrypt certificate, and enable Force SSL and HTTP/2.
5. Save. Nginx Proxy Manager issues the certificate and reloads Nginx on its own; no manual restart needed.

Nginx Proxy Manager vs Traefik and Caddy

All three do the same core job: terminate HTTPS and forward traffic to the right container. Nginx Proxy Manager’s whole pitch is the dashboard, every proxy host, certificate, and access list is a form, which is why it’s usually the first reverse proxy someone runs. Caddy skips the UI for a handful of lines in a Caddyfile and requests certificates automatically, appealing once typing a short config file feels faster than clicking through one. Traefik targets Docker-heavy setups: point it at the Docker socket, add labels to each container, and it discovers new services on its own, worth it once you’re running a dozen containers, overkill for three. Both get their own dedicated fiches on selfhostlab soon.

• Web dashboard for hosts, certificates, and access lists, no Nginx syntax required
• Automatic Let’s Encrypt issuance and renewal, including wildcard certificates via DNS challenge
• Multi-arch image (amd64, arm64) with an active release cadence
• MIT-licensed and free for any use, no feature paywall

• The admin UI itself is a second attack surface that needs locking down separately
• No automatic service discovery; every proxy host is added by hand, unlike Traefik’s Docker labels
• Default credentials are identical on every fresh install until changed

Reaching a self-hosted service like Jellyfin from outside the house is one of the most common reasons homelabbers set up a reverse proxy in the first place. Our Jellyfin remote access guide walks through this setup end to end, and weighs it against Tailscale and WireGuard, which expose a full private network instead of one HTTPS subdomain at a time.

FAQ

Is Nginx Proxy Manager free and open source?

Yes. It’s MIT-licensed, free for any use including commercial, and maintained as a community project rather than a company product.

What’s the default login for Nginx Proxy Manager?

and changeme, identical on every fresh install. Change all three, name, email, password, the moment you first log in.

Do I need a domain name to use Nginx Proxy Manager?

For a real Let’s Encrypt certificate, yes, or a subdomain via a free dynamic DNS provider like DuckDNS. A self-signed certificate works locally without one, but browsers flag it as untrusted.

Can Nginx Proxy Manager run on a Raspberry Pi?

Yes. The image is built for amd64 and arm64. armv7 support was dropped in version 2.14 because Node.js stopped supporting armhf, so older 32-bit Pi boards need the 2.13.7 image tag specifically.

Is Nginx Proxy Manager safe to expose to the internet?

The proxy ports, 80 and 443, are meant to be internet-facing, that’s the point. The admin dashboard on port 81 is not: keep it on the local network or behind its own VPN, replace the default login immediately, and update the image on a regular schedule.

For a single service or two, Nginx Proxy Manager is usually the fastest path from docker compose up to a real HTTPS address anyone can open in a browser. Once manually adding every container feels tedious, that’s the point where Traefik’s label-based discovery starts earning its steeper setup, covered in its own fiche soon.