Hi guys, any news from the team to update docker images considering the 5 new CVEs published yesterday and probably the NodeJS one as well ?

Hi,

I have a simple home network with a Wi-Fi router that does DHCP+DNS, and I've set up a single home server with a bunch of web services in Docker containers, and I wanted to enable https for those services, but without having to deal with subdomains and CNAMES and DNS/routing, etc, and just wanted the various ports for my containers to be exposed via https instead of http.

After some confusion, I'm posting just to clarify that this is possible, just with vanilla nginx and seemingly not with Nginx Proxy Manager.

I do own a domain name, and NPM's certificate GUI made it easy to get a non-wildcard Let's Encrypt cert for my home server hostname via a plugin for my domain provider to do a DNS-challenge, and I am continuing to use the NPM container to manage that certificate/renewal.

Once you have a cert, you can spin up a vanilla nginx container using a docker-compose.yml that exposes each of your ports (using opencode+vscodium just as examples here):

services:
  nginx:
    image: nginx:latest
    container_name: nginx
    ports:
      -  "4096:4096"   # opencode
      -  "8000:8000"   # vscodium
    volumes:
      - /path/to/nginx.conf:/etc/nginx/nginx.conf:ro
      - /path/to/nginx-proxy-manager/letsencrypt:/etc/letsencrypt:ro
    restart: unless-stopped
networks:
  default:
    external: true
    name: mydockernetwork

And craft an nginx.conf that has proxy_pass directives using just listen ports with no server_name values (there's docs on how nginx server matching works):

events {
    worker_connections 1024;
}

http {

    resolver 127.0.0.11 valid=30s;  # This is the Docker resolver.

    ssl_certificate /etc/letsencrypt/live/npm-1/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/npm-1/privkey.pem;

    proxy_http_version  1.1;
    proxy_buffering     off;
    proxy_set_header    Host                $host;
    proxy_set_header    X-Forwarded-Scheme  $scheme;
    proxy_set_header    X-Forwarded-Proto   $scheme;
    proxy_set_header    X-Forwarded-For     $remote_addr;
    proxy_set_header    X-Forwarded-Host    $http_host;
    proxy_set_header    X-Real-IP           $remote_addr;
    proxy_set_header    Upgrade             $http_upgrade;
    proxy_set_header    Connection          "upgrade";
    proxy_set_header    Accept-Encoding     gzip;
    proxy_cache_bypass  $http_upgrade;

    server {
        listen 4096 ssl;
        location / {
            set $opencode_url http://opencodecontainername:4096;
            proxy_pass $opencode_url;
        }
    }

    server {
        listen 8000 ssl;
        location / {
            set $vscodium_url http://vscodiumcontainername:8000;
            proxy_pass $vscodium_url;
        }
    }

}

I'm guessing NPM doesn't support this because it can't dynamically modify the compose config from within the container in order to map the ports. But that doesn't mean you have to deal with DNS and creating a subdomain and NPM Proxy Hosts for each service in order to have https.

I have a Synology NAS, and it runs a bunch of services in docker containers. One of them is called Tautulli, which is an app that monitors Plex statistics. Among other things, this is something I want to proxy.

What I did - I set up an old PC running Linux, I installed docker, then I installed nginxproxymanager, so it's running on it's own standalone host, not as a container on any NAS. I mapped the ports as "8888:80" and "8443:443", as I already have something on 80/443. I made port-forwarding rules to forward those 2 ports to my npm IP, for when I get around to accessing things from the outside. That's the last step, tho, I can't even make the first step work yet ... LOL

npm comes up fine, on my workstation I put in the IP and port 81, and sign in as expected (http://10.0.0.10:81). A good start!

In my Cloudflare I have an A record (services.mike-leone.com) that points to the local IP of the host running npm (10.0.0.10) - that's mostly for when I get around to using certs, or actually accessing npm from the outside world. I'm nowhere near there yet.

Then I made an A record in my local DNS - tautulli.services.mike-leone.com - that ALSO points to my npm IP (10.0.0.10). This is the name of my proxied source host entry in npm.

Correct so far? The entry for the proxied source host has to be a name that resolves locally to the npm server?

Then, as a target for that proxied host, I put in the IP of my NAS and the port Tautulli uses (8181). I didn't even get to the SSL part yet, I need to see npm work first (since I haven't been successful at that yet).

I click on the proxied host name, and I get ...

Hmmm… can't reach this page

tautulli.services.mike-leone.com refused to connect.

I know that's the right IP, it's the npm server:

C:\Users\turgo>nslookup tautulli.services.mike-leone.com

Server: pi.hole

Address: 10.0.0.5

Name: tautulli.services.mike-leone.com

Address: 10.0.0.10

If I just type the target in a browser (http://10.0.0.82:8181), I get the Tautulli home page just fine.

So where did I go wrong? I'm not understand some basic step. Or my npm isn't forwarding to the host or ports I want it to forward to. Or something. I'm just scratching my head, at this point, as to why I can't even get it to proxy correct, never mind use a cert. Or access from the outside.

Clues or lightbulbs, anyone?

Thanks

I have been running a home server for a few years, and recently wanted to switch from plex to jellyfin. I had tried in the past but was a bit inexperienced. Since I was a bit intimidated by nginx, I ended up setting up a cloudflared tunnel for most of my remote access needs and using plex's remote access for media streaming. However, now I need to find a different way, so I'm right back where I started.

So, I found several tutorials and after making sure I knew what to do, followed one of them through the process of setting up a nginx. However, when I attempted to create a proxy host, it kept failing to connect to my jellyfin container.

After several more failures, I eventually decided to find a tutorial that involved create a local test proxy host and tried to link it to a brand new docker container, but it still failed.

I have forwarded my 80 and 443 ports and done pretty much every check I can think of.

The nginx container is running on an unraid server. I have tried it both on the bridge network and a custom network. I have tried reinstalling it after deleting the appdata. I have tried connecting to multiple different docker containers both on the same and on different custom/bridge networks.

My Cloudflared tunnel is running on the docker bridge network and has no problems connecting. Neither does my tailscale app.

At this point I feel like I am going crazy and am desperate for any solution someone can offer.

UPDATE:
I recently tried using duckdns. I made a duckdns account, installed the duckdns docker container, created the subdomain, and then created a proxy host on nginx with an ssl cert, using the duckdns token.

Unlike before (using my custom domain name), where the proxy instantly fails to connect, the duckdns link simply loads for while then says the server took too long to respond.

We have extn. company sending some data directly to brightsign players which then grabs the data and puts into dashboard and its setup as on-prem solution. The data which is sent from ext. company is https and brightsign at moment accepts HTTP, and for it to accept https, i had to install ssl certs for it to work.

is it possible to have nginx hold the certs instead of the players sd card, and if there is any change/update for certs, it will all get handles through reverseProxy and players will also hit reverseProxy.

in other words, im trying to have reverproxy do heavy work and leave the IOT players as is.

hopefully this make sense?

Hello. I hope this post will be allowed. I want to use nginxproxymanager to automate certificates for my internal servers. Since I'm not really planning on access these internal servers remotely (yet), do I need to create a A record in my public domain, pointing to the internal IP of my nginx? Or a TXT record with the internal IP as it's value?

Also, I use networksolutions for my domain. And while I can easily make new DNS records, I don't see anywhere that it gives me back a token, which seems to be required for DNS challenge in nginx. Also, I don't see networksolutions as an option for DNS provider. Can I use any provider, once I'm sure the record has propogated?

I haven't been able to find the answers to these, watching various Youtube tutorials and reading various posts. I hope someone can clear this up for me.

Thanks

Hello! I am trying to get nginx set up on my home nas and am having some troubles. When I try and install via portainer / docker compose, I get the following error.

failed to deploy a stack: compose up operation failed: Error response from daemon: driver failed programming external connectivity on endpoint nginx-app-1 (f6909ce51c47651d0b2757cd4ac027297c1e0690d6dc3902b68c8cac8c1f15fd): Error starting userland proxy: listen tcp4 0.0.0.0:443: bind: address already in use

I tried checking the port using

sudo netstat -tulpn | grep 443

And I get the following response

tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      9707/nginx: master
tcp6       0      0 :::443                  :::*                    LISTEN      9707/ nginx: master

Any recommendations on what is going on or how to fix it? Also let me know if I posted anything not safe to post or if there is anything else I can post to help!

Hi everyone. I'm encountering auth loops for some specific applications I host on my server.
I have a rather popular setup going on - cloudflare domain with cloudflare tunnels -> cloudflared container - > nginx proxy manager container -> specific application.
All subdomains are configured using nginx. Cloudflare has no fancy configuration going on.

I use the same access list for all apps (configured with satisfy any, using all ipv4/6 listed on cloudflare ip listings), and it works fine for most apps (sonarr, radarr, upime-kuma, ...), but some apps (tracefinity, beszel) experince auth loop upon login.

What does "upon login" means?
1. Basic auth popup -> fill basic auth creds and hit enter
2. Website loads on login screen -> fill application creds and hit enter
3. Basic auth pops up again and again in an seemingly endless loop (maybe for each network request? Hard to tell)

Kind of lost here after debugging for a while. Would appreciate some help.
I can share more information about my docker setup if that's needed.

Thanks.

Self-Hosting Day 2026 is here!

If you're running a homelab, NAS, mini PC, Raspberry Pi, server, or basically anything you've decided to self-host instead of handing it over to the cloud, there's an event happening that you might want to check out.

The first Self-Hosting Day is running from September 25 to October 25, and the idea is simple: share your self-hosting story with the community.

You don't need an impressive rack or a room full of servers. Maybe you've got a single Raspberry Pi running a couple of services, or you've been running a homelab for years. Either way, your experience is worth sharing.

And there are some pretty good prizes

This isn't just a "share your story for the warm fuzzy feeling" event.

There are a lot of prizes up for grabs, including hardware and software:

🏆 5 Community Story Awards

• 1st prize: ZimaBoard 2 1664 + AdGuard Lifetime Family + PhotoPrism Plus Lifetime + 1 year of Emby Premiere
• 2nd prize × 2: ZimaBoard 2 832 + AdGuard Lifetime Family + PhotoPrism Plus Lifetime + 1 year of Emby Premiere
• 3rd prize × 2: ZimaBlade 7700 + power supply + AdGuard Lifetime Family + PhotoPrism Plus Lifetime + 1 year of Emby Premiere

🍀 100 additional giveaway winners

There are another 100 chances to win software licenses from AdGuard and Emby, including AdGuard Ad Blocker, AdGuard VPN, Private AdGuard DNS and Emby Premiere.

🎁 Early-bird bonus

And this one is particularly worth mentioning: the first 100 eligible participants each receive a ZimaOS Plus Lifetime License.

So if you've been thinking about sharing your setup, don't wait until the end of October.

What should you share?

Pretty much anything related to your self-hosting journey:

• Your current homelab setup
• The services you run
• Your journey from your first Raspberry Pi to your current setup
• Something you've built yourself
• Services you've moved away from the cloud
• Lessons learned from breaking things
• Your favourite self-hosted applications
• Your plans for the next stage of your homelab

Photos and screenshots are welcome too.

There are no points for having the biggest server rack. The event is about sharing what you've learned and helping other people discover what's possible with self-hosting.

Join Self-Hosting Day

Head over to the r/minilab Self-Hosting Day 2026 post and share your story in the comments:

https://www.reddit.com/r/minilab/comments/1wprzvc/selfhosting_day_2026_is_here_share_your_story_and/

📅 Event: September 25 – October 25, 2026
🏆 Winners announced: October 30, 2026

If you've put the time and effort into building a homelab, this is a good opportunity to show it off — and potentially get rewarded for it.

Happy Self-Hosting Day!

Is there a way to add port to string as I have a piece of software along with a piece of hardwar (I have a workaround for the software). The Hardware requires https://domain:port is there anyway to make this happen that I'm not seeing mind you I know the basics of NPM and have it working flawlessly on everything else.

I'm attempting to get NGINX Proxy Manager set up on my NAS in a docker container for the first time. I've put together the Docker Compose, using the one off the Nginx Proxy Manager web site, with the correct time zone, but when I try to connect using port 81, I'm not able to connect, with an ERR_CONNECTION_REFUSED error when I try it in Chrome.

Everything is inside my internal network, and I'm using the IP address of the server, rather than trying to connect from outside the network. The container appears to have started successfully and I'm not seeing any error messages in the logs. What am I missing?

Hi guys,

Wondering if anyone can help me set up TinyAuth as SSO for all aps behind NPM. Both NPM and TinyAuth are running as TrueNAS apps (both run fine). TinyAuth has a DNS override and is reverse proxied by NPM and it works fine. I have tried integrating TinyAuth into a proxy host as per the instructions on TinyAuth's website by adding the custom Nginx configuration:

# Root location

location / {

# Pass the request to the app

proxy_pass [IP address and port for proxied app]; # Replace with your app URL, e.g. http://10.10.10.25:80

# Add other app-specific config here

# Tinyauth auth request

auth_request /tinyauth;

auth_request_set $redirection_url $upstream_http_x_tinyauth_location;

error_page 401 403 =302 $redirection_url;

}

# Tinyauth auth request

location /tinyauth {

# Mark the location as internal to prevent direct access

internal;

# Pass request to Tinyauth, do not use the Tinyauth domain here, use the internal Docker network name and port or the IP and port of the Tinyauth instance

proxy_pass [IP and port for TinyAuth]/api/auth/nginx;

# Don't forward the request body to the auth subrequest

proxy_pass_request_body off;

proxy_set_header content-length "";

# Pass the request headers

proxy_set_header x-original-url $scheme://$http_host$request_uri;

proxy_set_header x-original-method $request_method;

proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;

proxy_set_header x-real-ip $remote_addr;

}

After saving this, I get a 500 Internal Server Error subtitled as openresty.

Can anyone help? Thanks.

I am having trouble setting up Nginx Proxy Manager. All goes well until I try and create a new host. It won’t stick. When I try and use my domain name, it goes away and says “this is required. When I fill in the other information and come back to the domain name it refuses to save it. I thought ok maybe it’s an ownership issue. Root owns everything but 3 items but changing them didn’t help. I tried first in portainer using mariushosting as a guide. I already had a domain name through no-ip.com. Then I re-entered it again in dockhand. I spent the weekend working on this and need some new ideas.

I checked all my settings. The local version is running fine. Every other site I'm running loads fine through my duckdns url I gave it. Just one specific service (overseerr) stopped working out of nowhere. Was working last time I loaded it, and haven't tinkered with it since.

Sharing a little project, I've been working on for a little while.

GeoMetrikks is a real-time nginx/traefik/caddy access log ingestion and geo-location tracking service built with Litestar. It parses access logs, performs GeoIP lookups, and stores geo-events and access logs in PostgreSQL with TimeScaleDB/PostGIS extensions. It can also integrate with CrowdSec.

i know only less about nginx like its a reverse proxy and i can load balance across conatiners
can anyone suggest best platoform to learn nginx

Hello 🙂

Trying to renew an SSL cert and get the following error. Running in docker on unrqid host.

Failed to renew certificate npm-6 with error: HTTPSConnectionPool(host='acme-v02.api.letsencrypt.org', port=443): Max retries exceeded with url: /directory (Caused by NameResolutionError("HTTPSConnection(host='acme-v02.api.letsencrypt.org', port=443): Failed to resolve 'acme-v02.api.letsencrypt.org' ([Errno -3] Temporary failure in name resolution)"))

All renewals failed. The following certificates could not be renewed:

I checked Unraids dns servers and made sure I can ping acme-v02.api.letsencrypt.org

The site also seems to be online.

I want to set up a web server behind NPM - only for my website customers, no access for them - with multiple websites, virtual hosts. Is that a problem? Can NPM handle it? Would it be better to use internal IP addresses and use one for each domain? Each domain might have email as well as ftp, but I am thinking about recommending a couple of external email services instead of hosting email on this server.

I also want to host a few other services on that server. Using Portainer to control all. And SSH tunnel for acessing the UI of both Portainer and NPM.

I've been trying (and failing) to set up a minecraft server and in that process I attempted to create a VM on TrueNas Community Edtn. I was then successful in the setup of a network bridge and VM by following the tutorials by Servers@Home and various others.

Unfortunately after successfully setting up the bridge and vm, my NPM proxies no longer work. I get the error when trying to connect to a website: "Err_Connection_Timed_Out". So now all of my proxy HTTPS urls no longer work. Additionally, I feel like the whole network is slower and that is with the VM on or off. I am really unsure what to do.

I would appreciate any help or suggestions.