I have been self-hosting for a while now with Traefik. It works, but I’d like to give Nginx Proxy Manager a try, it seems easier to manage stuff not in docker.
Edit: btw I’m going to try this out on my RPI, not my hetzner vps, so no risk of breaking anything
I like NPM, it’s simple, but also allows for more complex configs as well if needed. I run it in its own LXC because I have other non-dockerized things that are exposed.
I use Traefik at home. The initial setup was more complex than others but now it’s set up it’s by far the easiest to add new routes than any other I’ve tried, just by virtue of being right there in the compose/k8s files I’m already writing. Static routes are manual of course, but so are every other proxy so that’s no different, and they’re not exactly complicated (I see another comment has examples). The config files are the same markup language as your Compose/k8s files so you’re not learning a whole new syntax and having to switch languages mentally as you switch between them.
Caddy is super easy, but the fact that the Docker labels thing was a plugin is a con to me, I’d prefer it being first party. It also isn’t as performant as Traefik, higher CPU usage while also having higher latency.
As far as I’m aware, Nginx and Nginx Proxy Manager support no such thing, you have to manually write those routes every time you create a new service. Personally I think Nginxs config syntax annoying, I’m very comfortable with it now but I much prefer TOML/YAML.
Nginx Proxy Manager is a lot like Portainer. It’s useful for people who don’t want to learn Nginx and/or just want to click a few buttons. But anything complex you’re suddenly going to be thrown into the deep end.
You’ve already set up Traefik, you’ve already done the complex bit. IMO there’s no reason to change, from this point everything else is more complicated.
We use Nginx at work but are currently in the process of switching to Traefik.
Caddy all the way!
Seconding Caddy. I’ve been using it for a couple of years now in an LXC and it’s been very easy to setup, edit and run.
but I’d like to give Nginx Proxy Manager a try, it seems easier to manage stuff not in docker.
NPM is pretty agnostic. If it receives a request for a specific address and port combination it just forwards the traffic to another specific address and port combination. This can be a docker container, but also can be a physical machine or any random URL.
It also has Let’s Encrypt included (but that should be a no-brainer).
Caddy is really simple and easy. Just werks and gives you https
Honest noob question. I currently connect to my self hosted server using Twingate. How would this be different? can you give me an Eli5 what a reverse proxy manager would make my setup better?
I mean, the basic config file for Caddy is 1 line, and gives you Let’s Encrypt by default. The entire config file for a reverse proxy can be as few as 3 lines:
my.servername.net { reverse_proxy 127.0.0.1:1234 }
It’s a single executable, and a single 3-line file. Caddy is an incredible piece of software.
When I was researching reverse proxies I first stumbled upon nginx and traefik and especially nginx seemed a bit intimidating. As someone who hadn’t done it before I was worried if I’d do it right. Then I found caddy and yeah just used a threeliner like that in config and that was that. Simple and easy to get it right.
I’ve since switched to having my stuff behind wireguard instead of reverse proxy, but I keep caddy around so I can just spin it back up if I want to access Jellyfin on someone’s tv or something.
Ive got a basic workflow for nginx proxy manager now so this isnt super useful but good god that’s exactly what i wish nginx was.
I use Synology integrated reverse proxy, stupidly simple and always works for me (only if IPv6 doesn’t fuck up itself, I can’t fallback to IPv4 because that is CGNATED), if I am missing features that other options have I would like to know :)
I’ve looked at it but never actually given the Synology proxy a go despite using their DNS server. Does it do auto certificate renewal?
Have you considered using a Cloudflare tunnel to bypass the CGNAT? You can do that into a proxy or straight into the service.
Does it do auto certificate renewal?
Yes.
Have you considered using a Cloudflare tunnel to bypass the CGNAT?
I did before when I had some free domain over there, but I don’t think there are any worthy free domains out there anymore, and even when they are cheap, I really don’t need it and don’t feel comfortable to pay for something that I can’t use in its fullest (due to CGNAT).
For example, I am aware cloudflare tunnels can’t be used for a Plex/Video streaming and that is the number 1 service that I want to be exposed to the Internet.
For now I am living with my IPv6 address and the Synology DDNS with the reverse proxy features… My personal fallback are Tailscale and Zerotier.
I am using nginx on a separate machine (VM) I have yet to try it in docker, I just have not found a reason to change it yet.
I’ve tried npm, caddy and traefik but they are always way more complicated then adding a new config file in nginx…
I feel the others add too much to the docker configs and limit what can be added to the reverse proxy. I have control of access from the nginx server, without having to change the apps configuration.
NPM is the closest to what I would like (only needing the same network in docker) if I go the docker way but for some reason it never works as it should when I configure it. So I am sticking to plain nginx.
I’ll throw in another recommendation for Caddy. I’ve been using it for years and the few problems/feature suggestions I had got implemented by the developers pretty quickly. They’re super active on their forums and I haven’t yet run into an issue where I couldn’t either figure it out myself or with help from their community forums (usually from a dev.) They’re very friendly and won’t berate you for simple mistakes like other devs.
For a while now I’ve been using either haproxy or nginx depending on my needs. I’ve hit instances with both where the functionality I want is in the paid version.
I think NGINX has the best reverse proxy
I’ve been using NPM for a few years now and can’t recommend it enough. I use it to route to both docker containers on an internal proxy network as well at other services within my networks
it seems easier to manage stuff not in docker
Read into Traefik’s dynamic configuration. Adding something outside of Docker is as easy as adding a new config file in the dynamic configuration folder. E.g.
jellyfin.yml
:http: routers: jellyfin: rule: Host(`jellyfin.example.org`) entrypoints: websecure tls: certResolver: le service: jellyfin services: jellyfin: loadbalancer: servers: - url: "http://192.168.1.5:8096/"
The moment you save that file it will be active and working in Traefik.
I’ve been mostly using Nginx Proxy Manager, but I recently set up Bunkerweb as a WAF for a couple of public services I’m hosting and I kind of like it. It does reverse proxy along with a bunch of other things (bad behavior blocking, geographic blocking, SSL cert handling, it does a lot).
Mentioning it because I didn’t see any other mention of it yet.
NPM is easy to use. Caddy sounds like something I’d like to try too now.