Overview: Support for the Nginx Proxy Manager (NPM) Official docker container

Docker: https://hub.docker.com/r/jc21/nginx-proxy-manager

Github: https://github.com/jc21/nginx-proxy-manager

 

This is the official Nginx Proxy Manager container. Its advantage compared to the version of jlesage / Djoss is the support of IPv6 on ports 80 and 443.*

 

Donate? 🤗

 

*jlesage's docker has an open issue regarding this.

 

 

FAQ

 

Solving SSL Certificate issues

To obtain valid Let's Encrypt certificates, you need to forward / open the port 80 in your router. Port 80 is used for loading "http://" URLs from your server. So if you are suffering from errors while generating a new certificate, try to open the following URL through a mobile device which is NOT in your local Wi-Fi (like cellular mobile data):

http://unraid.yourdomain.com/.well-known/acme-challenge/

 

This must return the following 404 error of NPM:

 

If you instead receive a 5xx / timeout error, your domain could have a wrong IP in the DNS/DDNS database or your internet provider does not provide a real IPv4. You can test this by opening your public IPv4 with the same mobile device outside of your Wi-Fi:

http://11.22.33.44/

 

This must return the welcome page of NPM:

 

If not, then port 80 is probably closed or your IPv4 is not public reachable.

 

Only if this requirements are met, Let's Encrypt is able to reach your NPM container and verify the SSL certificate. Note: This is automatically repeated every 90 days to re-verify the certificate, so port 80 must stay open!

Debug Server Errors 5xx

 

Sometimes you get an 5xx error after loading your domain and now you wonder how to solve this issue. Follow these steps to find the problem:

 

1.) Does the NPM container work?

If you can not open NPM's WebUI, then your container is not properly setup. Check your container's logs to find out what's wrong.

 

2.) Is NPM online?

Obtain your public IPv4/IPv6 through a website like https://www.top10vpn.com/tools/what-is-my-ip/. If you have a public IPv4, you can now enter it in your browser starting with "http://" (not "https://"!). For example "http://80.70.60.50". Now you must see a status page of NPM:

 

For IPv6 you need to obtain the Public IPv6 of your NPM container. Open the Unraid WebTerminal and execute the following command:

docker inspect "Nginx-Proxy-Manager-Official" --format='{{range .NetworkSettings.Networks}}{{.GlobalIPv6Address}}{{end}}'

 

This time you need to enter "http://[8888:7777:6666:5555]" (the square brackets are important and again do not use "https://"!).

 

If this works for you, then your NPM container can be reached through the internet through Port 80. If not, then you have a problem with your port release / forwarding on your router or your container is not running properly.

 

You could even try "https://<ip>", but you won't see a status page. Instead it will ask you (depending on your browser) if you like to accept an invalid SSL certificate and finally it shows an HTTP protocol error. This is correct as NPM has no valid SSL certificate for direct IP access. So even if you get this error, this means your router does forward Port 443 correctly to NPM:

 

Only if you get an connection time out error, then you have a problem with your port release:

 

3.) Does your target container work?

Let's say you added the container "plex" with the scheme "http" and the IP address "192.168.178.8" and the port "32400":

 

Are you able to open this container through your browser? Open http://<container-ip>:<port>/ to test it. As long your container does not work stand-alone, it won't work with NPM in front, of course.

 

4.) Does NPM reach your target container?

Maybe you get an 5xx error if you open "http://plex.example.com". This happens usually if NPM is not able to reach the target container. You can verify this by NPM's container's console and entering the following commands:

curl -sS http://<container_ip>:<port>/ >/dev/null && echo "Container is reachable"

 

As you can see in my example, NPM is not able to reach the target IP:Port

 

This could be because of your selected networks. For example a container which uses the br0 network, is not able to reach a container which uses the bridge network:

 

Another reason could be, that you selected the wrong scheme. For example you used "http", but your target container only supports incoming connections through the scheme "https". Or you used the wrong ports. So double check your proxy host settings!

 

There could be other reasons as well. Feel free to post your test results in this thread and I try to help you to find the problem. But please add screenshots, so I can retrace which steps you already tried.

 

 

IPv6 Setup

 

This is the only reliable way to use NPM through IPv6:

 

1.) Change Unraid's HTTP and HTTPS ports to 5000 and 5001:

 

2.) Install NPM by using the host network:

 

3.) Open the ports 80 and 443 in your router:

 

4.) Open the NPM WebGUI and after changing the login, you can add a proxy host (see next post for Plex as an example).

 

5.) If you only want to type "tower" in your browser to reach your Unraid WebGUI, add this Redirection Host in NPM:

 

Further explanation:

IPv6 does not need port forwarding and many routers don't support it. So it's often not possible to forward internet traffic from port 443 (http) to a custom port like 8443. By that we have two options: Run NPM in the br0/custom network with a fixed ip address or run it in the host network (bridge has IPv6 disabled). I tried everything, but br0/custom isn't reliable as its not possible to define a fixed IPv6 without passing the IPv6 prefix and if your provider assigns a new IPv6 prefix, the container is offline and stays offline until we manually change the containers IPv6. And changing the IPv6 alone does not work as the "old" IPv4/IPv6 combination is internally reserved from the docker service. So its not only needed to change the IPv6 of the container, we additionally need to restart to entire Docker service itself.

Single Minecraft Server (or other Gaming Servers)

 

If you host a single Minecraft Server (MCS) you need to add a Stream Host, which listens to port 25565 (default Minecraft Port) and forwards all traffic to your MCS container's IP and Port. In my case the Minecraft Server Container uses the bridge network and listens to port 25575:

 

In NPM add a stream host with the incoming Port 25565 and the containers IP and Port 25575 as its target:

 

Open the TCP Port 25565 in your router:

 

Now setup a domain with your public IP address (DDNS).

 

Note: No container is allowed to listen to a Port which is defined as an incoming Stream port in NPM.

 

 

Multiple Minecraft Servers (or other Gaming Servers which support SRV records)

 

If you host multiple Minecraft Servers (MCS) you need to add multiple Stream Hosts which listen on different ports. For two servers it could be 25565 and 25566 while the MCS containers listen to 25575 and 25576:

 

In NPM add two stream hosts which listen to 25565 and 25566 and forward the traffic to the container's IPs and Ports accordingly:

 

Open both ports in your router:

 

Now the most important step:

You need a domain or DDNS (dynu.com, noip.com, etc) provider which supports custom SRV records. After you registered your domain, you add an SRV record as follows:

Type: SRV
Service: minecraft
Protocol: tcp
TTL: 120
Priority: 0
Weight: 5
Target: minecraft.example.com (your DDNS address)

 

Especially for dynu.com you need to enter "_minecraft._tcp" in the "Node Name" field (the Dot is important!):

 

Finally you should check the entry as follows (set your DDNS address):

https://mxtoolbox.com/SuperTool.aspx?action=srv%3a_minecraft._tcp.minecraft.example.com&run=toolpage

 

If you now connect to your minecraft server through minecraft.example.com, your client will automatically check for the existence of this SRV record and use the different Port 25566 instead of the default 25565.

 

The same method is support by:

• Valheim

 

Note: No container is allowed to listen to a Port which is defined as an incoming Stream port in NPM.

 

 

Plex

 

1.) Choose "bridge" as network:

 

2.) Plex Settings > Remote Access > Disable Remote Access (this forces Plex to use https://plex.example.com/ instead of https://49-243-220-22.48abf8487edc9d743c.plex.direct:32400/ )

 

3.) Plex Settings > Network > Set your domain and your unraid server IP as your "Own URLs" (use https and http as needed!):

 

By that your own domain is used for external access and your unraid server ip is used for local access (and https://local-ip.xxx.plex.direct/ of course).

 

4.) Add a new proxy host in Nginx Proxy Manager for your domain which targets the fixed IP of your Plex container and enable Websockets:

 

5.) Request an SSL certificate and force SSL:

 

 

A nginx.conf generated by Nginx Proxy Manager

 

Some people are maybe interested in how a nginx.conf looks like, that was generated from Nginx Proxy Manager. If you add a proxy host with the following settings:

• domain unifi.example.com
• scheme https
• IP 192.168.178.8
• port 8443
• enable Websocket Support
• select Let's Encrypt SSL
• force SSL
• add something to the Advanced Config

 

the final config would look like this:

# ------------------------------------------------------------
# unifi.example.com
# ------------------------------------------------------------

server {
  set $forward_scheme https;
  set $server         "192.168.178.8";
  set $port           8443;
  listen 80;
  listen [::]:80;
  listen 443 ssl http2;
  listen [::]:443;
  server_name unifi.example.com;

  # Let's Encrypt SSL
  include conf.d/include/letsencrypt-acme-challenge.conf;
  include conf.d/include/ssl-ciphers.conf;
  ssl_certificate /etc/letsencrypt/live/npm-2/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/npm-2/privkey.pem;

  # Force SSL
  include conf.d/include/force-ssl.conf;

  # Websockets Support
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $http_connection;
  proxy_http_version 1.1;

  # Logs
  access_log /data/logs/proxy-host-3_access.log proxy;
  error_log /data/logs/proxy-host-3_error.log warn;

  # Rules added through the Advanced Tab
  listen 8080;
  server_name *.example.net;

  location / {

    # Websockets Support
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_http_version 1.1;

    # Proxy
    add_header       X-Served-By $host;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Scheme $scheme;
    proxy_set_header X-Forwarded-Proto  $scheme;
    proxy_set_header X-Forwarded-For    $remote_addr;
    proxy_set_header X-Real-IP          $remote_addr;
    proxy_pass       $forward_scheme://$server:$port;

  }
}

 

Maybe this is helpful to decide which rules could be missing for your use case.

Hi @mgutt, what is the reason for using MariaDB instead of SQLite? I am running jc21 and SQLite works great.

16 hours ago, Mentox said:

what is the reason for using MariaDB instead of SQLite?

No joke: I missed this part in the docs:

Quote

 

# If you would rather use Sqlite uncomment this

      # and remove all DB_MYSQL_* lines above

      # DB_SQLITE_FILE: "/data/database.sqlite"

 

 

I will update the container and remove the external DB. SQLite is the easier option for the user.

On 7/5/2021 at 2:38 AM, mgutt said:

will update the container and remove the external DB. SQLite is the easier option for the user.

 

Looking forward to have the SQLITE as default in your NPM Docker.

 

All the best,

 

Lucas

 

 

 

 

 

Edited July 8, 20214 yr by DrLucasMendes

On 7/4/2021 at 4:04 PM, Mentox said:

SQLite

 

2 hours ago, DrLucasMendes said:

SQLITE

 

Done 😉

31 minutes ago, mgutt said:

 

 

Done 😉

 

Perfect, was waiting for this.

 

I'm going to migrate over to the official docker container this weekend (time permitting)

Appreciate you putting this together for us. 

What is the difference between this container and the jlesage and djoss? 

4 hours ago, Tucubanito07 said:

What is the difference between this container and the jlesage and djoss? 

It can listen on Port 80 and 443 which is a requirement for IPv6.

13 hours ago, CorneliousJD said:

Perfect, was waiting for this.

 

I'm going to migrate over to the official docker container this weekend (time permitting)

Appreciate you putting this together for us. 

 

Likewise 

 

Thank you @mgutt !!!

 

Working like a charm!!!

On Sunday I will migrate all the hosts.

Thank you again!!!

 

 

 

 

Ty for creating this!

 

I attempted to migrate from previous docker, expected my custom nginx configuration to work (not overly custom).  One aspect is geoip2 but I am getting error in logs saying geoip directive is not recognized.  Thought it was for the most part all using the same source?

 

UPDATE: Decided to look at the dockerfile and can see they both use different repositories and docker build files.  

Edited July 9, 20214 yr by Wingede
Update

1 hour ago, Wingede said:

geoip2

Wouldn't it be possible to add the allowed IP ranges through the advanced settings of a proxy host?

Very interested in this..

 

does this do the same as Swagg but using a UI?

 

if so how hard would it be migrating from swagg to this docker? I already have a custom network set-up and have 6-7 sub domains set-up that point to various containers on my server.

Edited July 14, 20214 yr by enigma27

3 hours ago, enigma27 said:

does this do the same as Swagg but using a UI?

In most parts. NPM does not have plugins like geo IP blocking. Feel free to test it with a new subdomain.

If you wanted to use the MariaDB option still, you can remove the `DB_SQLITE_FILE` variable and re-add the variables: `DB_MYSQL_HOST`,  `DB_MYSQL_PORT`, `DB_MYSQL_USER`, `DB_MYSQL_PASSWORD`, `DB_MYSQL_NAME`. I just set this up (I already had MariaDB setup for other things and wanted to keep everything in one place) and so far it's working.

Can you update the instructions without the MariaDB piece?

Not getting this to actually work with my hosts, getting a 502 Bad Gateway openresty error. Had it working fine previously with the other NPM Docker.

 

edit: Fixed it, for some reason my dockers were not talking to each other, had to disable then reenable the setting under Docker.

Edited July 25, 20214 yr by Candle

Reverse Proxy Docker container (Bitwarden) in network bridge on port 8080 not working. 

 

Dear friends, I finally was able to migrate. I was having a huge problem with Bitwarden (from: vaultwarden/server). 

I still don't know if it is something on my system or on NPMO.

 

My Docker in BW is set on bridge and NPMO is in network br0.

NPMO is using SQLite

 

 

When I added my proxy settings, as below, however it did not work. (it used to work with jlesage version). (I changed my real domain to mydomain.com for the screenshots).

 

 

 

 

 

 

To make it work, I had to add "bridge" network as Post Arguments in the advanced view of NMPO. And  had to use the internal IP of BW and port 80.

 

 

 

 

My question is:

 

Am I missing some somthing on my UNRAID server to make NMPO in br0 to have access to the 192.168.100.250:8080 or is something wrong with NPMO that it does not accept port 8080 as the Forward Port? 

 

Thank you in advance,

 

Lucas

 

 

 

 

 

 

26 minutes ago, DrLucasMendes said:

Reverse Proxy Docker container (Bitwarden) in network bridge on port 8080 not working. 

 

Dear friends, I finally was able to migrate. I was having a huge problem with Bitwarden (from: vaultwarden/server). 

I still don't know if it is something on my system or on NPMO.

 

My Docker in BW is set on bridge and NPMO is in network br0.

NPMO is using SQLite

 

 

When I added my proxy settings, as below, however it did not work. (it used to work with jlesage version). (I changed my real domain to mydomain.com for the screenshots).

 

 

 

 

 

 

To make it work, I had to add "bridge" network as Post Arguments in the advanced view of NMPO. And  had to use the internal IP of BW and port 80.

 

 

 

 

My question is:

 

Am I missing some somthing on my UNRAID server to make NMPO in br0 to have access to the 192.168.100.250:8080 or is something wrong with NPMO that it does not accept port 8080 as the Forward Port? 

 

Thank you in advance,

 

Lucas

 

 

 

 

 

 

This is the fix (I had the same issue).

 

Stop all your dockers.

Go to settings > dockers > enable "no"

 

Wait for that to turn off

 

Change "Host access to custom networks:" to off. Apply

Change "Host access to custom networks:" to On. Apply

 

Turn docker back on, try again.

 

 

 

Yes @Candle, you are right!!

Now that you pointed to the right direction, I found this:

 

Thank you!!!

 

 

2 hours ago, Candle said:

Change "Host access to custom networks:" to On. Apply

This is something which will be removed in future Unraid versions. My suggestion: Run NPM as host and run all other containers as bridge.

 

3 minutes ago, mgutt said:

This is something which will be removed in future Unraid versions. My suggestion: Run NPM as host and run all other containers as bridge.

 

Why? Why don't you guys just fix it instead of making it more difficult?

3 hours ago, Candle said:

just fix it instead of making it more difficult?

There is no easy fix possible as this is a limitation of docker itself:

https://stackoverflow.com/a/51973512/318765

 

 

Hello,

I hope I am on the right thread, if not, free to move me around.

I am new to NPM, however, I have made 7 proxy hosts already and most of them are working including all web server redirects using "A" or "CNAME".

I have a problem to set up proxy for camera streaming.

I was successful streaming an old Foscam camera by simply set the IP and port XXX. For all newer cameras or nvrs where http webserver and the image streaming (in onvif or rtsp format), I am not getting it. I am using an app called "IP CAM Viewer" and in that, I could easily view the camera by defining the http port(port forwarding and ddns), id and password to view the cameras. With the reverse proxy server, I can define the dn and port 80 to be redirected for the Foscam Camera, however, when I tried to do the same for others, I do not get the steams. 

 

Any help is appreciated.

Edited August 2, 20214 yr by jackwan1