Why a Reverse Proxy Belongs in Every Home Lab
Running multiple self-hosted services on a single machine creates an immediate routing problem. Without something sitting in front of your apps, you end up juggling port numbers – typing 192.168.1.100:8096 for Jellyfin, :8080 for something else, and memorizing a different combination for every service you add. Nginx Proxy Manager solves this by acting as a gatekeeper that accepts all incoming traffic on standard ports 80 and 443, then forwards requests to the right internal service based on the domain name or subdomain you configure.
The appeal of Nginx Proxy Manager specifically – over configuring raw Nginx with text files – is its web-based dashboard. You get SSL certificate management powered by Let’s Encrypt, access control lists, and proxy host configuration, all through a browser interface. No editing nginx.conf by hand, no reloading services from the command line after every change. For home lab operators and small-server administrators who want proper HTTPS without hiring a sysadmin, the tool hits a practical sweet spot between capability and complexity.
What You Need Before You Start
This setup assumes Docker and Docker Compose are already installed on your host machine. Nginx Proxy Manager runs as a containerized application, so those two tools are the only hard prerequisites. You will also need a domain name – a real one, not a local hostname – because the SSL certificate process requires Let’s Encrypt to verify ownership through a public DNS record. A domain from any registrar works fine. If you plan to expose services to the internet, your router needs to forward ports 80 and 443 to the machine running Nginx Proxy Manager. If you are keeping everything internal and using a DNS challenge instead of an HTTP challenge for certificate verification, you can skip the port forwarding step.
One more consideration before writing any configuration: decide how you want to structure your subdomains. A common pattern is to assign each service its own subdomain under a single domain – jellyfin.yourdomain.com, monitoring.yourdomain.com, reader.yourdomain.com, and so on. This approach keeps URLs clean and makes SSL certificate management straightforward, since Nginx Proxy Manager can request individual certificates per host or a wildcard certificate for the entire domain.
Installing Nginx Proxy Manager with Docker Compose
Create a directory for Nginx Proxy Manager on your server – something like /opt/npm or ~/docker/nginx-proxy-manager. Inside that directory, create a file named docker-compose.yml. The standard configuration requires two services: the Nginx Proxy Manager application itself, and a MariaDB database instance that stores all your proxy host configurations, SSL certificates, and user accounts.
Paste the following into your Compose file, adjusting the database credentials to something unique:
version: '3.8'
services:
app:
image: 'jc21/nginx-proxy-manager:latest'
restart: unless-stopped
ports:
- '80:80'
- '81:81'
- '443:443'
environment:
DB_MYSQL_HOST: "db"
DB_MYSQL_PORT: 3306
DB_MYSQL_USER: "npm"
DB_MYSQL_PASSWORD: "your_password"
DB_MYSQL_NAME: "npm"
volumes:
- ./data:/data
- ./letsencrypt:/etc/letsencrypt
depends_on:
- db
db:
image: 'jc21/mariadb-aria:latest'
restart: unless-stopped
environment:
MYSQL_ROOT_PASSWORD: "your_root_password"
MYSQL_DATABASE: "npm"
MYSQL_USER: "npm"
MYSQL_PASSWORD: "your_password"
volumes:
- ./mysql:/var/lib/mysql
Port 80 and 443 handle regular HTTP and HTTPS traffic. Port 81 is where the admin dashboard lives – keep this port off the public internet by firewall rule if you can, since it is the control plane for your entire proxy setup. Once the file is saved, run docker compose up -d from that directory. Docker will pull both images and start the containers. Give it thirty seconds, then open a browser and navigate to http://your-server-ip:81.
The default login credentials are admin@example.com as the email and changeme as the password. Nginx Proxy Manager will immediately prompt you to change both on first login – do not skip this step. After updating your credentials, the dashboard loads with three main sections across the top navigation: Proxy Hosts, Redirection Hosts, and Streams, plus a separate SSL Certificates section. Everything you need lives inside those four areas.
Adding Your First Proxy Host
Click Proxy Hosts in the dashboard, then Add Proxy Host. The dialog asks for a domain name, a scheme (HTTP or HTTPS), the forward hostname or IP, and the forward port. For the domain name, enter the subdomain you configured in DNS – for example, jellyfin.yourdomain.com. If you are running Jellyfin alongside Sonarr for media automation, the forward hostname would be your server’s local IP address and the port would be 8096, which is Jellyfin’s default.
Under the SSL tab within the same dialog, select Request a new SSL Certificate and toggle on Force SSL to redirect HTTP traffic automatically. Enter your email address for Let’s Encrypt notifications, agree to the terms of service, and click Save. Nginx Proxy Manager contacts Let’s Encrypt, completes the ACME challenge over port 80, and installs the signed certificate. The whole process takes under a minute when DNS has already propagated. Your service is now accessible at https://jellyfin.yourdomain.com with a valid certificate, no terminal work required beyond the initial setup.
Access Control and Security Settings
Nginx Proxy Manager includes a basic access control system called Access Lists. Found under the Access Lists menu, these let you password-protect proxy hosts or whitelist specific IP ranges. A common use case is restricting your admin-facing tools – dashboards, monitoring panels, or anything you do not want exposed without authentication – to your home network’s IP range while leaving media services open for external access.
To create an access list, name it, add either a username/password pair or an IP range under the respective tabs, and then assign it to a proxy host by editing that host and selecting the list from the Access List dropdown. The restriction applies at the Nginx layer, before the request ever reaches your application, which adds a meaningful barrier even for services that have their own login screens. For services that do not have any built-in authentication, this is the difference between a private tool and a publicly exposed one.
One setting worth enabling on every proxy host is Websockets Support, found in the Details tab of each host configuration. Many modern web applications – including home automation dashboards, monitoring tools, and media servers – use WebSocket connections for real-time updates. Without this toggle, those connections fail silently in ways that can look like the service itself is broken rather than the proxy configuration.
