Set Up Nginx Proxy Manager on Raspberry Pi: Easy SSL Reverse Proxy

As you host more services on your Raspberry Pi, remembering distinct port numbers becomes tedious. Accessing your media on port 8096, your monitoring dashboard on port 3001, and your password manager on port 8080 is clunky. Worse, many modern browser features and mobile applications refuse to communicate over unencrypted HTTP.

Nginx Proxy Manager solves both problems. It provides a clean, web-based control panel to route friendly domain names like photos.home.local or vault.yourdomain.com to the correct internal port, with automated Let’s Encrypt SSL certificates.

Why use a reverse proxy on Raspberry Pi

A reverse proxy sits at the edge of your network boundary. When a client requests a service by domain name, the proxy inspects the incoming HTTP Host header and forwards the request to the appropriate internal server or container port.

Key advantages include: - Single entry point: Forward ports 80 (HTTP) and 443 (HTTPS) to your Raspberry Pi, without punching separate router holes for every individual service. - Automated SSL encryption: Acquire and auto-renew free Let's Encrypt certificates using standard HTTP-01 challenges or DNS-01 API challenges (Cloudflare, DuckDNS, etc.). - Access control lists: Restrict sensitive services to specific local IP subnets or require HTTP basic authentication before reaching your apps.

Prepare Docker and directory structure

Nginx Proxy Manager runs conveniently inside Docker. Create a project folder for your configuration and database files:

mkdir -p "$HOME/nginx-proxy-manager"
cd "$HOME/nginx-proxy-manager"
nano compose.yaml

Paste the standard Docker Compose configuration. This uses SQLite for lightweight, reliable database storage that requires minimal memory on your Raspberry Pi:

services:
  npm:
    image: jc21/nginx-proxy-manager:latest
    container_name: nginx-proxy-manager
    restart: unless-stopped
    ports:
      - "80:80"
      - "81:81"
      - "443:443"
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

volumes:
  data:
  letsencrypt:

Port 81 is the administrative control panel, while ports 80 and 443 accept inbound public or local web traffic.

Launch Nginx Proxy Manager and log in

Start the stack with Docker Compose:

sudo docker compose config
sudo docker compose up -d
sudo docker compose ps

Wait twenty seconds for the initial SQLite schema migration to initialize. Then open your web browser to http://PI_ADDRESS:81.

Log in with the default factory credentials: - Email: admin@example.com - Password: changeme

Immediately upon first login, Nginx Proxy Manager prompts you to enter your real administrator email address and create a strong, private password.

Configure your first Proxy Host

Before creating a proxy host, configure your domain name or local DNS. If you run a local DNS filter such as Pi-hole, add a Local DNS Record pointing your domain (e.g. kuma.lan) to the Raspberry Pi's IP address.

In the Nginx Proxy Manager dashboard: 1. Click Hosts → Proxy Hosts → Add Proxy Host. 2. Domain Names: Enter your desired hostname (e.g., kuma.yourdomain.com). 3. Scheme: Select http. 4. Forward Hostname / IP: Enter the IP address of your Raspberry Pi (or the Docker container name if sharing a network bridge). 5. Forward Port: Enter the application port (e.g., 3001 for Uptime Kuma or 8096 for Jellyfin). 6. Toggle on Block Common Exploits and Websockets Support.

Click Save and test navigating to your new domain in your browser.

Issue a free Let’s Encrypt SSL certificate

To enable full HTTPS encryption with automatic renewals: 1. Edit your Proxy Host and select the SSL tab. 2. In the SSL Certificate dropdown, select Request a new SSL Certificate. 3. Toggle on Force SSL, HTTP/2 Support, and HSTS Enabled. 4. Enter your email address to agree to the Let’s Encrypt Terms of Service. 5. If your Raspberry Pi is publicly reachable, click Save to complete the HTTP challenge. If your server is strictly private, toggle Use a DNS Challenge and provide your DNS provider API token (such as Cloudflare).

Nginx Proxy Manager will negotiate the cryptographic challenge, write the certificate files to /etc/letsencrypt, and automatically schedule renewals before expiration.

Secure access with Access Lists

If you want to access administrative dashboards remotely without exposing them to anyone on the internet: 1. Navigate to Access Lists → Add Access List. 2. Define username and password combinations for HTTP Basic Auth. 3. In the Access tab, specify trusted client IP ranges (such as 192.168.1.0/24 or your Tailscale network range 100.64.0.0/10) and choose Deny All for others. 4. Attach this Access List to your private proxy hosts.

Sources and further reading

• Nginx Proxy Manager Official Documentation
• Nginx Proxy Manager GitHub Repository
• Let's Encrypt Getting Started Guide

Monitor your Raspberry Pi from your phone

Check real-time CPU, RAM, temperature, and service health for your networking projects with Open Pi for iOS and Android. Local-first, private, and no cloud account required.

Explore Open Pi ↗App StoreGoogle Play