Skip to main content
To set up Nginx Proxy Manager, create a compose.yaml that runs jc21/nginx-proxy-manager:2.16.0 with ports 80, 443 and 81, then start it with docker compose up -d. Open the admin interface on port 81, create your admin account, and add a Proxy Host for each domain with a free Let’s Encrypt certificate.

​
Before you start

  • Nginx Proxy Manager (NPM) is a reverse proxy with a web interface. A reverse proxy receives visitors on ports 80 and 443 and passes each domain to the right app, so several apps can share one server and one IP.
  • Ports 80 and 443 must be free. If Nginx, Apache or Caddy is already installed on the server, stop and disable it first, or Docker fails with address already in use.
  • Point each domain at your server with an A record (and AAAA for IPv6) before you request a certificate. See point a domain to your server.
  • Run the commands as a user in the docker group, or put sudo in front.

​
How to install Nginx Proxy Manager with Docker Compose

1

Create a shared Docker network

NPM and your apps join this network. NPM then reaches each app by its Compose service name, and the apps don’t need ports published on the server at all.
2

Create a project folder

3

Create compose.yaml

./data holds NPM’s database and settings, and ./letsencrypt holds your certificates. Both are folders next to compose.yaml.Port 81 is the admin interface. This file publishes it on 127.0.0.1 only, because Docker-published ports bypass ufw and firewalld, and the admin login should not face the internet.
4

Start NPM

The first start creates the database and keys, which can take a minute or two.

​
How to log in to the admin interface

Because port 81 listens on localhost only, open an SSH tunnel from your own computer:
Keep that window open and browse to http://localhost:8181. NPM shows Welcome! and asks you to create your admin account. Use a long, unique password.
If you publish port 81 publicly instead ("81:81"), whoever opens it first can create the admin account. Create it straight away, and switch back to 127.0.0.1:81:81 afterwards.

​
How to add a proxy host with free SSL

This example puts Uptime Kuma (Compose service uptime-kuma, port 3001) on status.example.com.
1

Connect the app to the proxy network

In the app’s compose.yaml, remove its ports: lines and add:
Run docker compose up -d in the app’s folder.
2

Add the proxy host

In NPM, open Hosts > Proxy Hosts and click Add Proxy Host. On the Details tab enter:Turn on Websockets Support if the app uses WebSockets (Uptime Kuma does) and Block Common Exploits.
3

Request the certificate

On the SSL tab, choose Request a new Certificate (with Let’s Encrypt), turn on Force SSL and HTTP/2 Support, and click Save.NPM asks Let’s Encrypt for a certificate over port 80 and renews it automatically.

​
How to check it worked

The container shows Up, and curl returns HTTP/2 200 (or a redirect your app sends). In NPM the host’s SSL column shows Let’s Encrypt.

​
How to update Nginx Proxy Manager

Change the tag in compose.yaml to the new release from the NPM releases page, then run:
NPM updates its database by itself. Back up the data and letsencrypt folders first; see back up Docker volumes.

​
Frequently asked questions

​
Why does the certificate request fail?

Let’s Encrypt must reach http://your-domain/ on port 80. Check that the domain’s A record points to this server, that port 80 is not used by another program, and that nothing in front of the server blocks it. For wildcard certificates or servers without port 80, tick Use DNS Challenge and add your DNS provider’s API credentials.

​
Can NPM proxy an app that is not in Docker?

Yes. Set Forward Hostname / IP to the server’s public or private IP and the app’s port. 127.0.0.1 points at the NPM container itself, not at the server.

​
Can I use MySQL or PostgreSQL instead of SQLite?

Yes. NPM uses SQLite by default, which suits most setups. Its setup guide shows the DB_MYSQL_* and DB_POSTGRES_* variables for an external database.

​
Should I use Nginx Proxy Manager or Traefik?

NPM is configured in a web interface, which suits beginners and small servers. Traefik reads labels from your compose.yaml files, which suits people who keep everything in code. Use one, not both, because each needs ports 80 and 443.

VPS and dedicated server guides

Every guide in this section.

Traefik with Docker

Automatic HTTPS from Compose labels.

Docker Compose tutorial

Write compose.yaml files.

Secure Docker on a VPS

Keep container ports off the internet.

Set up Uptime Kuma

An app to put behind your proxy.

Nginx reverse proxy

The same job with plain Nginx config files.
Checked against the official Nginx Proxy Manager setup guide, advanced configuration and upgrade notes on 4 November 2026; compose.yaml validated with Docker Compose v5.6.1 on Ubuntu 24.04 LTS. Menu names can change between NPM releases.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026