Skip to content

NGINX Proxy Manager

NPM is the single reverse proxy in my setup. It serves two kinds of names from the same instance:

  • <SERVICE>.<YOUR_LOCAL_DOMAIN> for the LAN: AdGuard Home points the wildcard at NPM, and NPM serves a certificate from a private root CA (mkcert) that the LAN devices trust.
  • <SERVICE>.<YOUR_DOMAIN> for outside: the Cloudflare tunnel delivers every public hostname to NPM, behind Cloudflare Access. See Tunnel + NPM.

Because it's on the only path in from outside, NPM updates are reviewed by hand rather than automerged.

  • Internal TLS (private CA)

    HTTPS for LAN-only names with an mkcert root CA: creating the CA, installing it on clients and containers, wildcard certs in NPM, renewal.

  • Cloudflare Tunnel + NPM (Wildcard)

    Compose file, wildcard Let's Encrypt cert, and publishing a site through the tunnel.

  • Pi-hole NPM + Pi-hole

    Running NPM alongside Pi-hole without port conflicts (reference, no longer used).