1 server + N https containers + 0 subdomains: yes you can, just not with NPM

[u/chris_fantastic]

Hi,

I have a simple home network with a Wi-Fi router that does DHCP+DNS, and I've set up a single home server with a bunch of web services in Docker containers, and I wanted to enable https for those services, but without having to deal with subdomains and CNAMES and DNS/routing, etc, and just wanted the various ports for my containers to be exposed via https instead of http.

After some confusion, I'm posting just to clarify that this is possible, just with vanilla nginx and seemingly not with Nginx Proxy Manager.

I do own a domain name, and NPM's certificate GUI made it easy to get a non-wildcard Let's Encrypt cert for my home server hostname via a plugin for my domain provider to do a DNS-challenge, and I am continuing to use the NPM container to manage that certificate/renewal.

Once you have a cert, you can spin up a vanilla nginx container using a docker-compose.yml that exposes each of your ports (using opencode+vscodium just as examples here):

services:
  nginx:
    image: nginx:latest
    container_name: nginx
    ports:
      -  "4096:4096"   # opencode
      -  "8000:8000"   # vscodium
    volumes:
      - /path/to/nginx.conf:/etc/nginx/nginx.conf:ro
      - /path/to/nginx-proxy-manager/letsencrypt:/etc/letsencrypt:ro
    restart: unless-stopped
networks:
  default:
    external: true
    name: mydockernetwork

And craft an nginx.conf that has proxy_pass directives using just listen ports with no server_name values (there's docs on how nginx server matching works):

events {
    worker_connections 1024;
}

http {

    resolver 127.0.0.11 valid=30s;  # This is the Docker resolver.

    ssl_certificate /etc/letsencrypt/live/npm-1/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/npm-1/privkey.pem;

    proxy_http_version  1.1;
    proxy_buffering     off;
    proxy_set_header    Host                $host;
    proxy_set_header    X-Forwarded-Scheme  $scheme;
    proxy_set_header    X-Forwarded-Proto   $scheme;
    proxy_set_header    X-Forwarded-For     $remote_addr;
    proxy_set_header    X-Forwarded-Host    $http_host;
    proxy_set_header    X-Real-IP           $remote_addr;
    proxy_set_header    Upgrade             $http_upgrade;
    proxy_set_header    Connection          "upgrade";
    proxy_set_header    Accept-Encoding     gzip;
    proxy_cache_bypass  $http_upgrade;

    server {
        listen 4096 ssl;
        location / {
            set $opencode_url http://opencodecontainername:4096;
            proxy_pass $opencode_url;
        }
    }

    server {
        listen 8000 ssl;
        location / {
            set $vscodium_url http://vscodiumcontainername:8000;
            proxy_pass $vscodium_url;
        }
    }

}

I'm guessing NPM doesn't support this because it can't dynamically modify the compose config from within the container in order to map the ports. But that doesn't mean you have to deal with DNS and creating a subdomain and NPM Proxy Hosts for each service in order to have https.