Set up Nginx Proxy Manager, Docker networking and HTTPS

Nginx Proxy Manager routes traffic to applications and manages certificates. It does not install those applications for you.

1. Check prerequisites

Prepare Docker and Compose using the official instructions:

bashsudo docker compose version
sudo ss -lntp

This example requires free ports 80/443. Do not stop an existing hosting panel blindly to free them.

2. Create the Compose project

Create /opt/npm/compose.yaml:

yamlservices:
  proxy:
    image: jc21/nginx-proxy-manager:2.15.1
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "127.0.0.1:81:81"
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
    networks:
      - proxy_net
networks:
  proxy_net:
    name: proxy_net

This version follows the official setup example; review release notes when installing.

bashcd /opt/npm
sudo docker compose config
sudo docker compose up -d
sudo docker compose logs --tail 50

3. Access administration privately

From your computer:

bashssh -N -L 8181:127.0.0.1:81 root@SERVER_IP

Open http://localhost:8181 and complete your version's first-user flow. Do not rely on an old tutorial's default password.

4. Connect the application network

Add networks: [proxy_net] to the application service and this top-level definition to its Compose file:

yamlnetworks:
  proxy_net:
    external: true
    name: proxy_net

The top-level definition alone does not attach a service. Confirm persistent data mounts before recreating it.

Use the application service name and internal port, as described in the network guide. Localhost inside the proxy container refers to the proxy, not another container.

5. Add the domain

Point DNS at the proxy, add a Proxy Host and enter the target protocol, service name and port. Enable WebSocket support when the application needs it.

Validate HTTP first, then request a Let’s Encrypt certificate and enable forced HTTPS. HTTP validation requires public reachability on port 80.

6. Diagnose and back up

A 502 needs checking the upstream process, network and port. Certificate errors need checking DNS, validation access and any CAA restrictions. Back up data and letsencrypt together during a consistent maintenance snapshot; application data needs a separate backup.

Continue with DNS records and Docker deployment.