DevOps

Nginx Proxy Manager

Reverse proxy berbasis Docker dengan UI admin, Let's Encrypt gratis, access list, dan konfigurasi host tanpa menulis Nginx dari nol.

#Nginx#Docker#DevOps#Security#Linux

Apa itu Nginx Proxy Manager?

Nginx Proxy Manager (NPM) adalah image Docker siap pakai untuk reverse proxy + SSL dengan antarmuka admin. Tujuan proyek: mem-forward domain ke service internal tanpa harus mahir Nginx/Let’s Encrypt.

Situs: nginxproxymanager.com
Repo: NginxProxyManager/nginx-proxy-manager
Image: jc21/nginx-proxy-manager

Fitur utama

UI admin (berbasis Tabler)
Proxy host, redirection, stream, 404 host
SSL gratis Let’s Encrypt atau sertifikat custom
Access Lists & HTTP Basic Auth
Advanced Nginx config (opsional)
User management, permission, audit log

Quick setup (Docker Compose)

services:
  app:
    image: 'docker.io/jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '80:80'    # HTTP
      - '81:81'    # Admin UI
      - '443:443'  # HTTPS
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

docker compose up -d
# Admin: http://127.0.0.1:81

Pola homelab / VPS

Port forward router 80/443 ke host NPM (jika di rumah)
DNS domain (Cloudflare / Route53 / DuckDNS) → IP publik
Di NPM: buat Proxy Host → domain → IP:port service internal
Aktifkan SSL (Let’s Encrypt) + Force SSL
(Opsional) Access List untuk admin panel internal

Internet → :80/:443 → Nginx Proxy Manager
                         ├─ app.example.com → 10.0.0.5:3000
                         ├─ api.example.com → 10.0.0.5:8080
                         └─ npm.example.com → admin (hati-hati expose)

NPM vs Nginx “mentah” vs Caddy

	NPM	Nginx config manual	Caddy
UI admin	Ya	Tidak	Terbatas (API/Caddyfile)
SSL otomatis	Let’s Encrypt via UI	certbot/manual	Default HTTPS (CertMagic)
Learning curve	Rendah	Sedang–tinggi	Rendah–sedang
Kontrol fine-grained	Advanced tab	Penuh	Caddyfile / JSON
Cocok untuk	Homelab, banyak service	Production ketat	TLS-first, config as code

Keamanan

Jangan expose port 81 ke internet tanpa proteksi (VPN / Cloudflare Tunnel / access list)
Aktifkan 2FA/password kuat admin
Pertimbangkan CrowdSec bouncer di depan/bersama reverse proxy
Isolasi network Docker: hanya NPM yang publish 80/443

Catatan versi

Image armv7 tidak didukung di v2.14+ (Node drop armhf); gunakan tag 2.13.7 jika perlu.

Checklist produksi kecil

Volume data + letsencrypt di-backup
DNS + SSL untuk setiap host
Healthcheck service backend
Rate limit / CrowdSec / fail2ban-like di edge
Update image secara berkala

Tautan

Setup lengkap: https://nginxproxymanager.com/setup/
Screenshots: https://nginxproxymanager.com/screenshots/
Docker Hub: https://hub.docker.com/r/jc21/nginx-proxy-manager

← Knowledge base