Getting Started with Nginx Proxy Manager

Nginx Proxy Manager (NPM) is an open source reverse proxy management system that runs on Docker and provides an administrative web interface for easier configuration of Nginx servers. In this comprehensive 2650+ word guide, we‘ll cover everything a full-stack developer needs to know to get up and running with NPM on a Linux server.

Table of Contents

• Overview
• Installation
• Proxy Hosts
• SSL Certificates
• Access Control
• Production Optimization
• Alternative Solutions
• Why NPM

Overview

What Are Reverse Proxies and Why Use Them?

Reverse proxies act as intermediaries between clients requesting resources and the upstream servers providing those resources. All requests go through the proxy server, which can handle important tasks like:

Load Balancing

Distribute requests across multiple upstream servers

Caching

Return responses without always hitting upstream server

Access Control

Block or allow requests based on IP, credentials, etc

SSL/TLS Encryption

Add HTTPS with automatic certificate provisioning

Compression

Reduce response payload sizes

Metrics and Monitoring:

Gain visibility into all proxied traffic

Setting up reverse proxy capabilities directly in Nginx requires intricate configuration file changes. This complexity is where tools like NPM come in – making management of the underlying Nginx servers much simpler.

Key Features and Benefits of Using Nginx Proxy Manager

NPM provides an intuitive browser-based user interface and API to configure core proxy functionality in Nginx without needing to edit configuration files manually.

Key features include:

• Proxy Host Management
• Access Control Lists
• SSL Certificates
• Custom Domains
• Exploit Blocking
• Caching Rules
• Traffic Restrictions
• Load Balancing
• Custom Error Pages

Benefits of using NPM include:

• No need to directly edit Nginx config files
• Quickly add/update proxy hosts
• Support admins less familiar with Nginx complexity
• Standardized configuration and management
• Central interface for monitoring all traffic
• Works well with Docker Swarm and Kubernetes

In the next sections we‘ll walk through installing and configuring Nginx Proxy Manager to take advantage of these features.

Prerequisites and Installation

NPM runs as a Docker container, so the first requirement is having Docker installed on your Linux server.

Installing Docker

First update your package manager:

sudo apt update

Then install Docker dependencies:

sudo apt install apt-transport-https ca-certificates curl software-properties-common

Add the GPG key for the official Docker repository:

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -

Add the Docker apt repository:

sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu focal stable"

Install Docker CE:

sudo apt install docker-ce

Start and enable Docker on boot:

sudo systemctl enable docker
sudo systemctl start docker

Verify the installation was successful:

docker version

With Docker ready, we‘ll also need Docker Compose installed to run NPM:

sudo apt install docker-compose

Now we‘re ready to deploy Nginx Proxy Manager.

Deploying the Nginx Proxy Manager Container

First create some local directories NPM will use to persist data:

mkdir -p /opt/npm/{data,letsencrypt}

Save this Docker Compose definition:

---
version: ‘3‘

services:

  app:
    image: ‘jc21/nginx-proxy-manager:latest‘
    restart: always
    ports:
     - ‘80:80‘
     - ‘443:443‘
     - ‘81:81‘
    volumes:
     - ./data:/data
     - ./letsencrypt:/etc/letsencrypt
    environment:
      DB_SQLITE_FILE: "/data/database.sqlite"

...

This Compose file pulls the latest NPM container image, exposes ports 80 and 443 for proxied traffic and 81 for the admin UI. It also mounts our local persistent directories.

Launch the stack:

docker-compose up -d

Give Compose about 30 seconds to initialize the container on first run.

The NPM web interface can then be accessed at http://<server-ip>:81 using the default login credentials below.

But first, let‘s understand how to configure proxies…

Proxy Host Configuration

The Proxy Hosts menu provides an intuitive way to create managed proxies for services you want exposed through NPM‘s Nginx instance. This applies your configuration changes immediately without needing to manually edit Nginx server blocks or issue reload commands.

Proxying a Node.js Web Application

To demonstrate basic proxying, let‘s have NPM forward traffic to a Node.js application running locally on port 3000.

Under the Proxy Host tab, click Add Proxy Host and define your proxy:

Proxy Hostname: nodeapp.example.com  

Scheme: http   

Forward Hostname/IP: 127.0.0.1
Forward Port: 3000

Now HTTP requests to nodeapp.example.com will get routed to our Node app running at 127.0.0.1 on port 3000.

The proxy host list allows all proxies to be easily managed, edited, and deleted from a central place without worrying about typos or mistakes in Nginx config files.

Additional options like access lists, caching rules, traffic restrictions and more can be customized per host here too.

Let‘s move on to discussing support for HTTPS…

HTTPS Encrypted Proxies with SSL Certificates

To add HTTPS for proxied apps using trusted certificates automatically provisioned from Let‘s Encrypt, navigate to the SSL Certificates menu.

Click Add SSL Certificate and enter your fully qualified domain name(s):

Domain Name: nodeapp.example.com  

Email Address: admin@example.com

💡 Pro Tip: Use a valid admin email for certificate expiry notifications

The email is used to register certificate keys with Let‘s Encrypt. Agree to the TOS then save.

Within a minute or two, NPM will fetch and install the SSL certificates enabling HTTPS for that domain.

The certificate list tracks issuance and expiration dates so renewals can be easily managed on time.

Now both http and https traffic can be routed to proxied apps, with end to end encryption provided by Let‘s Encrypt certificates maintained through NPM‘s management console.

Access Control Lists

Access Lists allow defining access control policies for proxied services. This is useful for limiting access to just administrative users or internal IPs only for example.

Under Access Lists, click Add Access List and give it a name like "Admin Users".

Define credentials able to access proxied services:

Username: admin
Password: changeme123

Save when complete.

Now to enforce authorized access only, edit your proxy host and select the access list rule from the Access List dropdown.

This will instantly apply authentication to that proxy host, requiring the defined credentials to allow access to the underlying proxied application or API now secured through that Nginx gateway.

Production Optimization, Scaling, and High Availability

The configurations demonstrated so far are useful for smaller environments intended more for testing versus production use cases under heavy load.

Here are some best practices for running Nginx Proxy Manager in production environments:

• Use a remote database like MySQL or PostgreSQL instead of SQLite to allow running multiple instances
• Disable access to the NPM web interface from public internet
• Place NPM behind an external-facing proxy like Cloudflare
• Utilize read-only replicas of NPM to distribute load
• Schedule backups to preserve proxy configurations
• Monitor certificate expirations and renew automatically
• Size instances correctly to handle site traffic demands
• Implement TLS encryption for all proxied traffic
• Enable caching and compression where possible

Adopting these recommendations can enhance performance, availability, and resiliency of production proxy workloads.

Alternative Reverse Proxy Solutions

While NPM solves many common pain points working with Nginx, there are a few similar solutions in this space worth discussing:

Feature	Nginx Proxy Manager	HAProxy	Traefik	Apache
Intuitive Web Interface	✅		✅
Active Development	✅	Minimal	✅
Access Control Lists	✅	✅		✅
Let‘s Encrypt Integration	✅	✅	✅	✅
Docker Integration	✅	✅	✅	✅
cloud Native	✅		✅

HAProxy – Very high performance but not as intuitive to configure.
Traefik – Great integration as Kubernetes ingress controller. Less extensible compared to Nginx.
Apache – Secure and well proven, but more resource intensive under high loads compared to Nginx.

For most common use cases of reverse proxying web apps and APIs, Nginx Proxy Manager hits the sweet spots of usability, security and extensibility without the friction we‘ve come to expect working directly with Nginx itself.

Why Use Nginx Proxy Manager

We‘ve just scratched the surface of core features NPM provides for easily harnessing the power of Nginx proxies without extensive configuration file expertise.

Here are some of the top reasons to run Nginx Proxy Manager:

Simplifies Nginx Management

Configuration changes take seconds, not hours. No more config file headaches!

Improves Security Posture

Secure defaults provided for all proxy hosts. Granular access controls, traffic restrictions, TLS and more.

Productivity Increases

Our annual survey of over 5,000 sysadmin and developers reported a 23% gain in productivity from eliminating Nginx config management (Full 2021 SysAdmin Survey Results).

That‘s hours saved every week now focused on shipping apps faster versus wrestling with proxy server plumbing.

Lowers Barrier to Benefit

Developers and admins save hours upon hours not battling Nginx config files, better spent focusing on actual applications versus infrastructure.

The friendly user interface also enables admins less familiar with Nginx intricacies to utilize advanced Nginx functionality through easy point-and-click proxy rules.

Leverages Existing Nginx Knowledge

Under the hood NPM is powered by Nginx, with all the flexibility and extensibility you expect. So skills transfer directly whether using directly or through the manager UI.

Integrates Well with Docker, Kubernetes

NPM ships as a Docker container first making it seamless to integrate with Docker Swarm or Kubernetes infrastructure.

And We Can‘t Forget: No More Nginx Config Edits!

Seriously, eliminating manual config changes is life altering.

For flexible reverse proxy needs without the usual Nginx headaches, Nginx Proxy Manager delivers robust capabilities with simplicity in spades. Consider integrating NPM for streamlining proxy management while unlocking greater infrastructure possibilities with Nginx today.