Nginx Proxy Manager Gives Your Homelab a Domain Name and HTTPS in Three Clicks

February 2026, Nginx Proxy Manager shipped v2.14.0 with 33.7k GitHub stars. May 2026, the project was closing in on 500 million Docker pulls. June 2026, v2.15.1 tightened the bolts. Meanwhile, thousands of homelabs were still routing http://192.168.1.42:8096 through browser bookmarks — because reverse proxies sound scary. Nginx Proxy Manager proves they shouldn’t be.

A reverse proxy is the hub of any serious homelab. Without one, every self-hosted service lives on its own port, unencrypted, at an IP address nobody remembers. With one, Jellyfin becomes media.yourdomain.com, Home Assistant answers at home.yourdomain.com, and every subdomain carries an auto-renewing Let’s Encrypt certificate. The distance between a network hack and a credible infrastructure comes down to this one piece.

One reverse proxy, three clicks, zero config files

Nginx Proxy Manager (NPM) is the work of Jamie Curnow (jc21), who summed it up in a line that’s become famous in the project’s README: “it had to be so easy that a monkey could do it”. The project takes Nginx — the web server and reverse proxy powering a third of the internet — and wraps it in a web interface built on Tabler. The result: a reverse proxy configured entirely with a mouse, no nginx.conf file in sight.

The principle is radical. Open the admin interface on port 81, fill in three fields — domain name, target container IP, service port — and click Save. NPM generates the full Nginx configuration, enables SSL via Let’s Encrypt if you checked the box, and reloads the server without interruption. What takes twenty minutes in a text config file takes thirty seconds in NPM. And it’s reproducible: a proxy host can be duplicated, modified, or deleted from the same interface.

Installation fits in a twelve-line docker-compose.yml:

services:
  app:
    image: 'jc21/nginx-proxy-manager:2.14.0'
    restart: unless-stopped
    ports:
      - '80:80'
      - '81:81'
      - '443:443'
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

Three ports — 80 (HTTP), 443 (HTTPS), 81 (admin UI) — and two volumes for data and certificates. No external database to configure: NPM embeds SQLite internally. The container starts, the interface is live, and you’re adding your first proxy host moments later.

Automatic Let’s Encrypt — the real game changer

The feature that elevates NPM from nice-to-have to essential is the native Let’s Encrypt integration. Check a single box in the proxy host form: NPM obtains a certificate via certbot, auto-renews it before expiry, and redirects HTTP to HTTPS if you ask it to. No cron job, no renewal script, no monitoring required.

DNS challenge is supported for wildcard domains (*.yourdomain.com) across a dozen DNS providers — Cloudflare, DuckDNS, Route53, Porkbun, OVH, among others. You paste your API token into the certificate settings, and NPM handles the TXT record validation. A production wildcard Let’s Encrypt certificate in under three minutes flat.

For custom certificates — a purchased wildcard, a private CA cert — NPM accepts manual upload with the private key. Auto-renewal doesn’t apply in this case, but the interface displays the expiry date and warns you as it approaches.

TCP/UDP streams, access lists, and custom locations

NPM isn’t limited to HTTP/HTTPS proxying. The Streams section handles TCP and UDP forwarding — useful for exposing a Minecraft server (tcp/25565), an MQTT broker (tcp/1883), or a WireGuard endpoint (udp/51820) behind your public IP without touching router configuration beyond the initial port forwarding.

Access Lists add a layer of granular security. You create a list with rules — allow this IP, deny that subnet, satisfy basic HTTP authentication — and apply it to one or more proxy hosts. An access list restricting admin.yourdomain.com to your LAN IPs takes three clicks. The same logic applied to a publicly exposed service is an effective barrier against automated scanning.

Custom Locations open the full power of Nginx for those who need it. You define a location — a specific URL path — and inject advanced Nginx configuration as free text: custom headers, cache rules, WebSocket proxying, CORS, rate limiting. The field is a code editor with syntax highlighting, and NPM validates the configuration before reloading.

Multi-user management sets NPM apart from single-file reverse proxies. You create accounts with granular permissions — administrator, manager of their own proxy hosts, read-only — and an audit log records every change. In a shared homelab or a small team, blame is an underrated feature.

NPM vs Traefik vs Caddy — picking your camp without regrets

The self-hosted reverse proxy market has three major players in 2026. Each has its paradigm, and the choice depends more on your relationship with configuration than on raw performance.

Traefik is the Swiss Army knife. Written in Go, it auto-discovers your Docker containers via labels on each service, reconfigures routes in real time as containers start and stop, and provides extensible middleware — rate limiting, circuit breakers, OAuth authentication, rewrites. The learning curve is real: Traefik is configured in YAML or TOML, Docker labels have their own syntax, and a proper traefik.yml easily exceeds a hundred lines before you expose a single service. It’s the ideal tool for a Docker Swarm cluster or Kubernetes — and overkill for a three-container homelab on a Raspberry Pi.

Caddy is minimalist elegance. A single binary, a Caddyfile that reads like prose (media.example.com { reverse_proxy localhost:8096 }), and automatic HTTPS with zero configuration — Caddy obtains a Let’s Encrypt certificate the moment a domain name is detected. No port mapping, no manual DNS challenge setup. The limit is that Caddy remains a text-first tool: no graphical interface, no multi-user management, no mouse-driven access lists. For a developer who lives in the terminal, it’s perfect. For someone who just wants things to work without reading documentation, it’s one more config file to maintain.

Nginx Proxy Manager occupies a precise niche: GUI-first. Where Traefik demands you learn a DSL and Caddy asks you to write files, NPM replaces both with forms. The trade-off is flexibility: no container auto-discovery, no dynamic reconfiguration without a reload, no programmable middleware. What you lose in power, you gain in accessibility — and for 90% of homelabs, NPM’s feature set already covers every need.

What NPM doesn’t do — and why it’s fine

NPM has limits worth stating honestly. It doesn’t do container auto-discovery: every exposed service must be configured manually in the interface. If you’re spinning containers up and down twenty times a day, Traefik will save you time. There’s no native dynamic reload when a target container’s IP changes — NPM reloads Nginx, which takes a fraction of a second but constitutes a micro-outage. High availability is out of scope: NPM is designed for a single instance, and the documentation recommends running it on the same host as your services.

These limits are the flip side of its philosophy. NPM isn’t trying to be Netflix’s reverse proxy — it’s trying to be the one that makes a beginner say “I have my own domain name with an HTTPS padlock, and I spent less time setting it up than choosing the domain name.”

Verdict

The question isn’t “which is the best reverse proxy” — it’s “where are you on your journey.”

You’re starting a homelab or want to expose your first services behind a domain name. Install Nginx Proxy Manager. The graphical interface eliminates the config-file barrier, Let’s Encrypt is one checkbox away, and you’ll have a working reverse proxy before the Traefik tutorial finishes explaining entrypoints. Assume you’ll replace NPM when you hit its limits — and for the majority of homelabs, that day never comes.

You’re running a Docker Swarm cluster, Kubernetes, or a fleet of dynamic containers. Traefik is your tool. Auto-discovery and hot reconfiguration become critical at that scale, and NPM wasn’t designed for it.

You’re comfortable on the command line and want the fewest moving parts. Caddy is the most elegant choice. One binary, a ten-line file, automatic HTTPS. But you give up the graphical interface and multi-user management.

Nginx Proxy Manager pulls off a rare trick in self-hosting: lowering the barrier to entry without neutering the power of the tool it wraps. Under the hood, it’s Nginx — the same engine serving billions of requests a day. But instead of asking you to learn its syntax, it gives you forms. Your homelab deserves domain names and HTTPS. NPM gives them to you in three clicks — and that changes everything.

References

• Nginx Proxy Manager — Official Site
• Nginx Proxy Manager GitHub — NginxProxyManager/nginx-proxy-manager
• Nginx Proxy Manager v2.14.0 Release Notes — February 2026
• Nginx Proxy Manager — Quick Setup Guide
• Nginx Proxy Manager — Full Documentation
• Traefik — Official Site
• Caddy — Official Site
• selfh.st — Self-hosted content and software