I spent way too long exposing my homelab services directly on weird ports. Port 8096 for Jellyfin, 8123 for Home Assistant, 8080 for something I’ve already forgotten. Every URL felt like a ransom note. Then I found Nginx Proxy Manager, and suddenly everything was clean subdomains with real HTTPS certificates — and it took about 20 minutes to set up. That’s the Nginx Proxy Manager homelab experience in a nutshell: enterprise-grade reverse proxying with a GUI so simple it almost feels like cheating. Every nginx proxy manager homelab conversation eventually reaches SSL — these three configs are the ones that survive contact with reality.
If you’re running Docker on any server at home — Raspberry Pi, mini PC, Proxmox VM, doesn’t matter — you can have every service behind a proper domain with free Let’s Encrypt SSL by the time you finish reading this. No more remembering ports. No more browser security warnings. No more explaining to your family why the “Plex isn’t working” when they type the wrong IP.
| Symptom | Cause | Fix |
|---|---|---|
| 502 Bad Gateway after a restart | The proxied container got a new internal IP, and NPM is still pointing at the old one | Use Docker network aliases (service names) instead of raw IPs |
| Certificate renewal fails silently | Port 80 got blocked, or a DNS record changed | Check the SSL certificates tab monthly — anything yellow or red needs attention |
| Redirect loop | Both NPM’s “Force SSL” and the app behind it try to redirect to HTTPS | Enforce SSL at the proxy only, and disable the app-level redirect |
What Is Nginx Proxy Manager and Why Does Your Homelab Need It?
Nginx Proxy Manager (NPM) is a Docker container that runs a web-based UI for managing Nginx reverse proxy configurations. Instead of editing config files and fighting with Let’s Encrypt’s ACME client in the terminal, you get a clean dashboard where you point a domain (like jellyfin.yourdomain.com) to an internal IP and port, click “Request SSL,” and watch it handle everything automatically. NPM is the Nginx Proxy Manager homelab solution that makes all your services feel like real websites.
The two big wins it gives you: clean URLs (no more ports) and free HTTPS (no more browser security warnings). It also centralizes all your proxy configs in one place, so when you spin up a new Docker container, adding it to NPM takes about 30 seconds. One home lab running 18 services behind a single NPM instance is entirely normal. The container itself barely uses any RAM — under 100MB typical — so it doesn’t compete with your actual services.
What You Need Before You Start
A few prerequisites before diving into the setup:
1. A domain name. You need a real domain for Let’s Encrypt SSL to work. Namecheap and Cloudflare both have cheap options — a .com runs about $10–$15/year. You can also use DuckDNS for a free subdomain if you don’t want to spend anything. If you’re going the Cloudflare route (recommended — it adds free DDoS protection and makes DNS challenges easy), sign up here.
2. A server running Docker. This can be a Raspberry Pi, a mini PC, a Proxmox VM, or any Linux machine with Docker installed. If you’re building your first homelab server and not sure what to buy, I’d point you to a Raspberry Pi 5 Starter Kit for a low-power, capable option, or a Beelink MINI S13 Mini PC if you want more headroom for running multiple Docker services simultaneously.
3. Port forwarding on your router. You’ll need to forward TCP ports 80 and 443 from your router to the internal IP of your Docker host. This is what lets Let’s Encrypt validate your domain and what allows external HTTPS access to your services.
CanaKit Raspberry Pi 5 Starter Kit PRO (8GB)
3. Port forwarding on your router.
- 3. Port forwarding on your router. You’ll need to forward TCP ports 80 and 443 from your router to the internal IP of your Docker host. This is what lets Let’s Encrypt validate your domain and what allows external HTTPS access to your services
Current price and availability shown on Amazon.
Setting Up Your Nginx Proxy Manager Homelab With Docker Compose
Drop this into a docker-compose.yml file on your server and run docker compose up -d:
services:
app:
image: 'jc21/nginx-proxy-manager:latest'
restart: unless-stopped
ports:
- '80:80'
- '81:81'
- '443:443'
volumes:
- ./data:/data
- ./letsencrypt:/etc/letsencryptThat’s the entire config. NPM uses SQLite internally (more than enough for a homelab with under 50 proxy hosts), so there’s no database container to manage. Once it’s running, access the admin panel at http://YOUR-SERVER-IP:81. Default credentials are admin@example.com / changeme — it’ll force you to change both immediately. Good.
Adding Your First Proxy Host and Getting SSL
This is where the magic is. In the NPM dashboard, go to Proxy Hosts → Add Proxy Host. Fill in:
— Domain Names: the subdomain you want (e.g., jellyfin.yourdomain.com)
— Forward Hostname/IP: the internal IP of the machine running Jellyfin (e.g., 192.168.1.50)
— Forward Port: the port Jellyfin listens on (e.g., 8096)
Then click the SSL tab, select “Request a new SSL Certificate,” check “Force SSL” and “HTTP/2 Support,” and hit Save. NPM fires a Let’s Encrypt challenge, validates your domain, pulls the certificate, and configures Nginx — all in about 30 seconds. You’ll see the padlock. Your service is now on clean HTTPS with a real certificate that auto-renews every 90 days.
Repeat for every service. Jellyfin, Home Assistant, Vaultwarden, Portainer, Grafana — each gets its own subdomain, its own cert, and you never think about port numbers again.
The Cloudflare DNS Challenge (For Local-Only Services)
Want HTTPS on services that you don’t want exposed to the internet? That’s where Cloudflare DNS challenge comes in. Instead of Let’s Encrypt validating through HTTP (which requires your ports open externally), it validates through a DNS TXT record that NPM creates automatically using your Cloudflare API token. Your service never has to be internet-accessible to get a valid SSL cert.
Setup: In NPM’s SSL tab, select “Use a DNS Challenge,” pick Cloudflare, and paste in your Cloudflare API token (Zones → DNS → Edit permission is all it needs). NPM handles the rest. This is how you get HTTPS on your internal Proxmox dashboard, your router admin panel, or anything else you’d rather not punch through to the internet.
It also pairs perfectly with Tailscale for remote access — Tailscale keeps your services reachable over VPN, and NPM makes them accessible over clean HTTPS locally. Best of both worlds.
Beelink MINI S13 Mini PC
It also pairs perfectly with Tailscale for remote access — Tailscale keeps your services reachable over VPN, and NPM makes them accessible over clean HTTPS locally.
- It also pairs perfectly with Tailscale for remote access
- Tailscale keeps your services reachable over VPN, and NPM makes them accessible over clean HTTPS locally. Best of both worlds
Current price and availability shown on Amazon.
The Takeaway
The Nginx Proxy Manager homelab setup is one of those things that feels almost embarrassingly easy for what it gives you. Twenty minutes of setup — Docker Compose, a domain, port forwarding — and suddenly your entire homelab speaks HTTPS. Every service gets a clean subdomain. Every certificate auto-renews. And you never open a Nginx config file by hand.
If you’re new to homelabbing and haven’t set this up yet, it’s genuinely one of the first things I’d do on any new server. Build out your Docker stack, put NPM in front of it, and your homelab immediately feels like a professional operation.
What’s Your Proxy Setup?
Are you running NPM, or did you go with Traefik, Caddy, or something else? Drop your setup in the comments — especially if you’ve found a clever config or addon that changed the game for you. And if this helped you finally kill off those ugly port numbers, share it with a fellow homelabber who’s still living the :8096 life.
One last habit that separates a tidy nginx proxy manager homelab from a fragile one: back up the small config volume after every change. It’s a few megabytes holding every proxy host, cert, and access rule you’ve built — and restoring it turns a dead reverse proxy from an evening of rework into a two-minute restore.
Common Nginx Proxy Manager Mistakes (And Their Two-Minute Fixes)
Three failure patterns account for nearly every “it stopped working” thread. First, the 502 Bad Gateway after a restart: your proxied container came up with a new internal IP and NPM is pointing at the old one — use Docker network aliases (service names) instead of raw IPs and this class of failure disappears forever.
Second, certificate renewals silently failing because port 80 got blocked or a DNS record changed — NPM renews Let’s Encrypt certs automatically, but only if the challenge path still works. A monthly glance at the SSL certificates tab (anything yellow or red needs attention) beats discovering an expired cert from the browser warning your family sees first.
Third, the classic redirect loop: turning on “Force SSL” in NPM while the app behind it also tries to redirect to HTTPS. Pick one place to enforce it — the proxy is the right answer — and disable the app-level redirect. Every one of these took me longer to diagnose the first time than the fix deserves, which is exactly why they’re written down here.
And a closing thought for anyone hesitating over the DIY route: your time is a cost too. The hours spent hand-rolling nginx configs are hours not spent on the services the proxy exists to serve. NPM’s whole value proposition is making the boring-but-critical layer boring to manage — take the win and go build something on top of it.
Wildcard certs, forced HTTPS, zero renewal anxiety — all from one friendly dashboard. That’s the whole pitch, and it delivers. An nginx proxy manager homelab gives every service a clean HTTPS front door — set it up once and forget port numbers forever.
Frequently Asked Questions
What do I need before setting up Nginx Proxy Manager?
A real domain name for Let’s Encrypt SSL, a server running Docker (a Raspberry Pi, mini PC, or Proxmox VM all work), and ports 80 and 443 forwarded from your router to that Docker host.
How do I get HTTPS on a service I don’t want exposed to the internet?
Use the Cloudflare DNS challenge instead of standard HTTP validation. It proves domain ownership through a DNS TXT record rather than an open port, so a service like your Proxmox dashboard can get a valid certificate without ever being internet-accessible.
What’s the default Nginx Proxy Manager login?
admin@example.com with the password changeme. It forces you to change both immediately on first login, which is exactly what you want for anything reachable on your network.
Why am I getting a 502 Bad Gateway error after restarting a container?
The container almost certainly came up with a new internal IP, and Nginx Proxy Manager is still pointing at the old one. Using Docker network aliases (service names) instead of raw IPs in your proxy host settings makes this failure disappear for good.
Do SSL certificates from Nginx Proxy Manager renew automatically?
Yes, every 90 days — but only if the underlying challenge path still works. If port 80 gets blocked or a DNS record changes, renewal fails silently, so it’s worth glancing at the SSL certificates tab periodically.