As your home lab grows, you quickly find yourself hosting multiple self-hosted web applications: Home Assistant on port 8123, Portainer on port 9443, Vaultwarden on port 8080, and Jellyfin on port 8096. Memorizing arbitrary port numbers is inconvenient, and managing individual SSL/TLS certificates across separate containers is tedious. Even worse, modern web features (such as the Web Crypto API required by password managers and mobile progressive web apps) strictly refuse to operate over unencrypted HTTP.

Nginx Proxy Manager (NPM) is the ultimate visual reverse proxy solution for self-hosters. It wraps the battle-tested performance of Nginx into an intuitive, responsive web interface. With Nginx Proxy Manager, you can route domain names (like vault.yourdomain.com or home.yourdomain.com) to internal IP addresses, automate free Let's Encrypt SSL certificate generation with auto-renewal, configure WebSocket upgrades, and restrict access with IP whitelists and authentication lists.

This guide covers running Nginx Proxy Manager via Docker Compose on Raspberry Pi, configuring DNS records, setting up your first SSL-secured reverse proxy host, enabling WebSockets, and hardening your security posture.

Hardware planning and network architecture

  • Recommended Board: A Raspberry Pi 4 or Raspberry Pi 5 with 2 GB or 4 GB of RAM handles thousands of concurrent reverse proxy requests with negligible CPU usage.
  • Operating System: A 64-bit installation of Raspberry Pi OS with Docker and Docker Compose installed.
  • Network Placement: Connect your Raspberry Pi via wired Ethernet. Because Nginx Proxy Manager serves as the front door for incoming web traffic, low latency and reliable packet handling are critical.
  • Public Domain: You need a registered domain name (from Cloudflare, Namecheap, Porkbun, etc.) where you can configure DNS A or CNAME records.

Deploy Nginx Proxy Manager with Docker Compose

Nginx Proxy Manager runs cleanly inside Docker, utilizing SQLite or MariaDB for configuration storage.

Create a project directory for Nginx Proxy Manager:

BASH
mkdir -p "$HOME/nginx-proxy-manager/data" "$HOME/nginx-proxy-manager/letsencrypt"
cd "$HOME/nginx-proxy-manager"

Create a compose.yaml file:

YAML
services:
  app:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '80:80'      # Public HTTP traffic
      - '81:81'      # Admin Web Management interface
      - '443:443'    # Public HTTPS traffic
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

Launch the stack in the background:

BASH
docker compose up -d
docker compose logs -f

Open http://<YOUR_PI_IP>:81 in your browser.

The default administrative login credentials are: - Email: admin@example.com - Password: changeme

Immediately upon first login, Nginx Proxy Manager requires you to update the administrator email address and create a strong, unique password.

Router Port Forwarding and DNS Setup

To allow Let's Encrypt to verify domain ownership and route incoming web traffic to Nginx Proxy Manager:

  1. Router Forwarding:
  2. Forward external port 80 (TCP) to port 80 on your Raspberry Pi.
  3. Forward external port 443 (TCP) to port 443 on your Raspberry Pi.

  4. Never forward port 81 publicly. Keep your administrative dashboard accessible only on your local network.

  5. DNS Record Configuration: In your DNS provider dashboard (e.g. Cloudflare DNS):

  6. Create an A record pointing your domain or subdomain (e.g., lab.yourdomain.com) to your home public IP address.
  7. You can also create a wildcard record (*.lab.yourdomain.com) pointing to the same IP.

Adding your first SSL Reverse Proxy Host

Let's route vault.yourdomain.com securely to an internal Vaultwarden container running at 192.168.1.50:8080:

  1. In the Nginx Proxy Manager dashboard, click Hosts -> Proxy Hosts -> Add Proxy Host.
  2. Details Tab:
  3. Domain Names: Enter vault.yourdomain.com.
  4. Scheme: http (or https if the destination container uses a self-signed certificate).
  5. Forward Hostname / IP: Enter the internal IP (e.g., 192.168.1.50).
  6. Forward Port: Enter 8080.
  7. Enable Block Common Exploits.
  8. Enable Websockets Support (essential for real-time sync in Home Assistant, Portainer, and Vaultwarden).
  9. SSL Tab:
  10. SSL Certificate: Select Request a new SSL Certificate.
  11. Enable Force SSL (automatically redirects HTTP to HTTPS).
  12. Enable HTTP/2 Support and HSTS Enabled for enhanced speed and security.
  13. Enter your email address for Let's Encrypt expiration notifications.
  14. Accept the Let's Encrypt Terms of Service.
  15. Click Save.

Nginx Proxy Manager contacts Let's Encrypt via an automated ACME challenge, verifies your DNS record, retrieves the signed certificate, configures Nginx, and applies the configuration instantly without restarting the container.

Test by visiting https://vault.yourdomain.com in your browser. You will see a valid SSL padlock icon.

Protecting Services with Access Lists

Certain administrative tools (like Portainer or router dashboards) should never be exposed to the entire internet. Nginx Proxy Manager includes Access Lists to restrict access:

  1. Navigate to Access Lists -> Add Access List.
  2. Under Authorization, configure basic HTTP username/password credentials.
  3. Under Access, add allowed IP ranges (for example, your local subnet 192.168.1.0/24 or your office static IP), and set the default to Deny.
  4. In your Proxy Host settings, attach this Access List. Any unauthorized public request is stopped at the proxy before ever touching your application.

Cloudflare DNS-01 Challenges (No Open Port 80 Needed!)

If you do not want to forward port 80 through your router, you can issue wildcard SSL certificates using DNS-01 Challenges: 1. In Nginx Proxy Manager, navigate to SSL Certificates -> Add SSL Certificate -> Let's Encrypt. 2. Check Use a DNS Challenge. 3. Select Cloudflare and paste your Cloudflare API token. 4. Let's Encrypt verifies ownership by creating a temporary TXT record in your DNS zone via API, generating certificates without needing any open HTTP ports on your router!

Monitor Nginx Proxy Manager with Open Pi

Because Nginx Proxy Manager routes all traffic into your home network, keeping an eye on your Raspberry Pi's health is vital.

With the Open Pi mobile app on iOS and Android: - System Load & Memory: Track memory consumption and ensure background Nginx worker threads operate smoothly. - Port Status: Verify that ports 80 and 443 remain active. - Container Health: Inspect container restarts and uptime directly from your phone.

Troubleshooting Reverse Proxy Issues

  • Let's Encrypt Challenge Failed (Internal Error): Confirm that external port 80 is forwarded to port 80 on your Pi and that your DNS record has fully propagated. Let's Encrypt requires port 80 for HTTP-01 challenges.
  • 502 Bad Gateway: Nginx Proxy Manager is reachable, but the destination application at the Forward IP/Port is down or unreachable. Verify that the target service container is running and that its port is correct.
  • WebSocket Disconnects in Home Assistant: If Home Assistant displays a "Connection Lost" banner every few seconds, ensure Websockets Support is checked in the proxy host settings, or add custom Nginx headers (Upgrade $http_upgrade, Connection "upgrade").

Sources and further reading

Open Pi logo
Monitor your Raspberry Pi from your phone

Check real-time CPU, RAM, temperature, and service health for your networking projects with Open Pi for iOS and Android. Local-first, private, and no cloud account required.

Explore Open Pi App StoreGoogle Play
About this guide

Researched and validated against official project documentation and community standards on September 11, 2026. Review your board model, storage, and current release notes before deploying.