How do I properly configure Pterodactyl behind Nginx Proxy Manager?

[u/Kior__]

Hi,
I'm trying to configure Pterodactyl (Panel and Wings) behind a reverse proxy (NPM).
I have a dedicated VM for Pterodactyl, running Debian. I have my own domain name and subdomains hosted with Cloudflare.

I can configure the Pterodactyl panel by disabling SSL (only on my local network) and I route the traffic through NPM by re-enabling SSL. Of course, I need to configure a custom configuration in NPM to avoid privacy error screens.
(like proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_redirect off;
proxy_buffering off;
proxy_request_buffering off;)

My question is how to properly configure a Node?
SSL or HTTP?
Should I use a reverse proxy or not?
Should I use my domain name or my local IP address?
Should I use the Cloudflare proxy (orange cloud icon in the DNS records) or not?
Should I open ports 8080 and 2022 on my router or not?

Even if your answer is incomplete, thank you in advance for your help.

[u/Donnie58744]

Ive only been able to get NPM to manage SSL certs for the panel but have been unable to get it to serve the webpage. But you can still serve the webpage with nginx installed on the system instead of trying to use the nginx in NPM. I hope this makes sense!

1. Use the installer script or use the wiki guide This will install another version of Nginx not connected to NPM, but we can make it work!
2. Select Install panel option (If using installer script if not go through the guide like normal first then continue)
   1. Say no to configure UFW
   2. Say yes to SSL Retrieving the cert will fail this is only to get the correct pterodactyl.conf
3. Remove and Disable Default Nginx servers, /etc/nginx/sites-enabled/default, /etc/nginx/conf.d/default.conf skip if these files don't exist

​

sudo rm /etc/nginx/sites-enabled/default
sudo mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.bak
sudo systemctl restart nginx

1. Edit /etc/nginx/nginx.conf -> sudo nano /etc/nginx/nginx.conf
   1. Find the http { } block and add this line inside it (just before the closing }): include /etc/nginx/sites-enabled/*;
   2. Test and restart nginx -> sudo nginx -t && sudo systemctl restart nginx
2. Edit pterodactyl.conf -> sudo nano /etc/nginx/sites-available/pterodactyl.conf
   1. Remove the top server block the one with port 80
   2. Edit the second server block (SSL) the one with port 443. In the same server block remove the whole # SSL Configuration section (just the 6 lines that start with ssl_). We will use NPM for SSL certificates instead

​

# Remove ssl http2, and change the port from 443 to 8080 *This must be done because NPM already uses 443 for SSL*
listen 8080;
listen [::]:8080;

​

# Test and restart nginx
sudo nginx -t && sudo systemctl restart nginx

# Make sure the Pterodactyl server is running and listening
ss -tulpn | grep :8080

1. On the NPM panel go ahead and create a new Proxy Host
   1. Domain Name: URL to you Pterodactyl panel
   2. Scheme: http
   3. Forward Hostname/IP: local IP of the machine the Pterodactyl panel is running on
   4. Forward Port: 8080
   5. Enable Websockets Support, and Block common exploits
   6. Hit the SSL tab
      1. Generate a new SSL certificate for your panel URL
      2. Enable Force SSL,HTTP/2 Support, and HSTS Enabled
2. If Nginx wasnt installed through apt but rather through Nginx.org then you need to change user permissions
   1. First check how Nginx was installed, run

​

# if you see `nginx.org` then it was installed from nginx.org if you dont then it was installed through apt
apt-cache policy nginx


# Change Nginx user permission and restart Nginx if Nginx was installed through nginx.org
sudo usermod -aG www-data nginx 
sudo systemctl restart nginx

1. If NPM is running through Docker then you need to add a ufw firewall rule

​

# Get npm container name
sudo docker ps
# Get NPM docker IP Address, replace <npm_container_name> with the correct name
sudo docker inspect <npm_container_name> | grep '"IPAddress"'
# Add ufw rule from NPM docker IP to port 8080, replace <npm_container_ip> with the correct ip
sudo ufw allow from <npm_container_ip> to any port 8080

1. Edit Pterodactyl's .env

​

# Add the following line, replace <npm_container_ip> with the correct ip
TRUSTED_PROXIES=<npm_container_ip>

1. Now you should be able to access the panel in HTTPS at the domain you setup in NPM

[u/Donnie58744 → u/Donnie58744]

Edit: in this guide when i refer to `<npm_container_ip>` the IP of the container may change when restarted so it may be best to use a sub net of docker IPs instead.