Installing Nginx Proxy Manager on VPS

What we are setting up and why

In the modern world, where a single server often hosts many web services — from websites and blogs to API servers and project management systems — there is a need for centralized access management. This is precisely the problem that a reverse proxy server solves. It acts as an intermediary between the internet and your internal services, directing incoming requests to the correct application based on the domain name or URL path.

Nginx Proxy Manager (NPM) is a powerful tool that significantly simplifies the setup and management of Nginx as a reverse proxy. Instead of manually editing complex Nginx configuration files, NPM offers an intuitive web interface. Through it, you can easily add new proxy hosts, manage SSL/TLS certificates (including automatically obtaining them from Let's Encrypt), configure redirects, manage access, and much more.

Ultimately, upon completing this tutorial, you will have a fully configured Nginx Proxy Manager capable of routing traffic to your internal applications, while ensuring a secure HTTPS connection for each of them. This will allow you to easily add new services to your VPS without worrying about manual Nginx and SSL configuration for each. Whether it's GitLab, Mattermost, a Minecraft server with a web interface, a blockchain node, or your own SaaS project, NPM will become the central hub for publishing them to the internet.

What alternatives exist and why self-hosted on a VPS

There are several approaches to managing reverse proxies and SSL:

• Manual Nginx/Apache configuration: This is a classic method requiring deep knowledge of configuration file syntax. It offers maximum flexibility but is time-consuming and prone to errors.
• Caddy: A modern web server that automatically manages SSL certificates. Caddy is easier to configure than Nginx but may be less flexible in some complex proxying scenarios.
• Cloud-managed Load Balancers (AWS ALB, Google Cloud Load Balancer, Azure Application Gateway): These solutions offer high availability, scalability, and integrated SSL management. However, they are significantly more expensive, tie you to a specific cloud provider, and can be overkill for small to medium-sized projects.
• Other Docker-based proxies (Traefik, HAProxy): Traefik is particularly popular in the Docker ecosystem due to its ability to automatically discover and proxy services. However, its configuration can be more complex for beginners compared to NPM, which focuses on ease of use via a GUI.

Choosing a self-hosted solution, such as Nginx Proxy Manager on a VPS, has several advantages:

• Full control: You have complete control over the infrastructure and data, which is critically important for privacy and security.
• Cost-effectiveness: The cost of a VPS is often significantly lower than monthly payments for cloud Load Balancers, especially for projects with moderate loads.
• Flexibility: You can host any applications and services without being limited by the specifics of cloud platforms.
• Versatility: The same approach works on any VPS from any provider.

NPM is ideal for those who want the convenience of cloud solutions but wish to retain the control and cost-effectiveness of self-hosted infrastructure. It's an excellent choice for developers, solo founders, gamers, and crypto enthusiasts managing their own servers.

What VPS configuration is needed for this task

Nginx Proxy Manager itself is quite lightweight, as it is essentially a convenient wrapper around Nginx and Certbot. The main resource requirements will depend on the number of proxied services, traffic volume, and the complexity of Nginx configurations. However, for most tasks where NPM acts as a single entry point for several web applications, the requirements will be moderate.

Minimum requirements (for 1-5 small services, low traffic):

• CPU: 1 vCPU (modern processor, 2.5+ GHz)
• RAM: 1 GB (for NPM, Docker, and basic OS)
• Disk: 25-30 GB SSD (for OS, Docker images, and NPM data)
• Network: 100 Mbps (minimum, with unlimited traffic or sufficient limit)

Recommended VPS plan (for 5-20 services, moderate traffic, including light applications):

• CPU: 2 vCPU
• RAM: 2-4 GB
• Disk: 50-80 GB SSD
• Network: 1 Gbps (with sufficient traffic volume, e.g., 1-2 TB/month)

Such a configuration will ensure comfortable operation of NPM and several containers with your applications. For example, a VPS with the specified characteristics will be a good choice for most tasks described in this guide. When choosing a provider, pay attention to the possibility of quickly scaling resources if your project starts to grow actively.

When a dedicated server is needed, not a VPS

A dedicated server may be required if:

• You plan to host a very large number of services (hundreds) with high traffic.
• Your applications require maximum CPU or RAM performance that a VPS cannot provide (e.g., high-load databases, game servers with many players).
• You need specialized hardware resources, such as GPUs or RAID arrays.
• Complete isolation from other provider clients is required for maximum security or compliance with strict regulatory requirements.

For most scenarios described in this guide, a VPS is more than sufficient and significantly more cost-effective.

Location: what it affects

The choice of VPS location affects:

• Latency: The closer the server is to your target audience, the lower the latency and faster page loading. For a European audience, it's better to choose servers in Europe; for an American audience, in North America.
• Legal compliance: Data placement in certain jurisdictions may be a requirement for your project (e.g., GDPR in the EU).
• Cost: VPS prices may vary slightly depending on the region.

It is generally recommended to choose a location that is geographically closer to your main user base.

Server Preparation

Before installing Nginx Proxy Manager, you need to perform basic setup and security for your fresh VPS. We will use Ubuntu 24.04 LTS, which will be relevant in 2026 and is a stable and widely supported operating system.

1. SSH Connection

Connect to your server via SSH using the credentials provided by your provider (usually root login and password).

ssh root@YOUR_VPS_IP_ADDRESS

2. System Update

First, update all packages to their latest versions. This will ensure you have all security patches and up-to-date software versions.

sudo apt update -y         # Update package list
sudo apt upgrade -y        # Upgrade installed packages
sudo apt autoremove -y     # Remove unused packages

3. Creating a new user with sudo privileges

Working as the root user is insecure. Create a new user and grant them sudo privileges.

adduser YOUR_USERNAME          # Create a new user
usermod -aG sudo YOUR_USERNAME # Add user to the sudo group

Log out of the root session and log in as the new user:

exit
ssh YOUR_USERNAME@YOUR_VPS_IP_ADDRESS

4. Configuring SSH Key Authentication (recommended)

SSH key authentication is significantly more secure than password authentication. If you don't already have an SSH key pair, generate one on your local computer:

ssh-keygen -t ed25519 -b 4096 # Create a new SSH key (locally)

Then copy the public key to your VPS. Replace YOUR_USERNAME and YOUR_VPS_IP_ADDRESS with your actual data.

ssh-copy-id YOUR_USERNAME@YOUR_VPS_IP_ADDRESS # Copy public key

After this, you can disable password authentication in the /etc/ssh/sshd_config file to enhance security. Find the lines PasswordAuthentication yes and PermitRootLogin yes and change them to no.

sudo nano /etc/ssh/sshd_config

Change:

#PasswordAuthentication yes
PasswordAuthentication no
PermitRootLogin no

Restart the SSH service:

sudo systemctl restart sshd

5. Firewall Configuration (UFW)

UFW (Uncomplicated Firewall) is a simple interface for managing iptables. We will configure it to allow only necessary connections.

sudo apt install ufw -y              # Install UFW
sudo ufw allow OpenSSH               # Allow SSH (port 22)
sudo ufw allow 'Nginx Full'          # Allow HTTP (80) and HTTPS (443)
sudo ufw enable                      # Enable firewall
sudo ufw status verbose              # Check firewall status

You will be prompted to confirm enabling UFW, as this may interrupt existing SSH connections. Enter y and press Enter.

6. Installing Fail2Ban

Fail2Ban helps protect against brute-force attacks by automatically blocking IP addresses from which failed login attempts originate.

sudo apt install fail2ban -y         # Install Fail2Ban
sudo systemctl enable fail2ban       # Enable autostart
sudo systemctl start fail2ban        # Start the service

By default, Fail2Ban is already configured to protect SSH. You can create a local configuration file for fine-tuning:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

In the jail.local file, you can change parameters such as bantime (ban duration), findtime (period for detecting attempts), and maxretry (maximum number of attempts). Make sure the [sshd] section is active (enabled = true).

[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
maxretry = 3
bantime = 1h

After any changes, restart Fail2Ban:

sudo systemctl restart fail2ban

Your server is now ready for Docker and Nginx Proxy Manager installation.

Software Installation — Step-by-step

Nginx Proxy Manager runs as a Docker container, so the first step will be to install Docker and Docker Compose on your VPS.

1. Installing Docker Engine

Remove old Docker versions, if any, to avoid conflicts:

for pkg in docker.io docker-doc docker-compose docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin; do sudo apt remove $pkg; done

Install the necessary packages to install Docker over HTTPS:

sudo apt update -y
sudo apt install ca-certificates curl gnupg -y

Add Docker's official GPG key:

sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

Add the Docker repository to APT sources:

echo \
  "deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
  "$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

Update the package list and install Docker Engine (version current as of 2026, e.g., 26.x):

sudo apt update -y
sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin -y

Verify that Docker is installed and running:

sudo docker run hello-world # Run a test container

Add your user to the docker group to avoid using sudo with every Docker command:

sudo usermod -aG docker $USER # Add current user to the docker group
newgrp docker                 # Apply changes for the current session

Now you can execute Docker commands without sudo.

2. Installing Nginx Proxy Manager with Docker Compose

Create a directory for Nginx Proxy Manager and navigate into it:

mkdir nginx-proxy-manager
cd nginx-proxy-manager

Create the docker-compose.yml file. This is the main configuration file for Docker Compose, which describes services, networks, and volumes.

nano docker-compose.yml

Insert the following content into the file. Note that we are using the current version of NPM (e.g., 2.15.0 as of 2026) and a MariaDB database. We also map ports 80, 443, and 81 to the host machine so that NPM can handle HTTP/HTTPS traffic and provide its web interface.

version: '3.8'
services:
  app:
    image: 'jc21/nginx-proxy-manager:2.15.0' # Current NPM version as of 2026
    restart: always
    ports:
      - '80:80'    # HTTP port
      - '443:443'  # HTTPS port
      - '81:81'    # NPM web interface port
    environment:
      DB_MYSQL_HOST: 'db'
      DB_MYSQL_PORT: 3306
      DB_MYSQL_USER: 'npm'
      DB_MYSQL_PASSWORD: 'npm_password_secure' # Replace with a strong password
      DB_MYSQL_NAME: 'npm'
    volumes:
      - ./data:/data # Save configuration and SSL data
      - ./letsencrypt:/etc/letsencrypt # Save Let's Encrypt certificates
    depends_on:
      - db
  db:
    image: 'mariadb:11.3' # Current stable MariaDB version as of 2026
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD: 'root_password_secure' # Replace with a strong password
      MYSQL_DATABASE: 'npm'
      MYSQL_USER: 'npm'
      MYSQL_PASSWORD: 'npm_password_secure' # Must match DB_MYSQL_PASSWORD above
    volumes:
      - ./data/mysql:/var/lib/mysql # Save database data

Important: Be sure to replace npm_password_secure and root_password_secure with your own strong passwords. Use different passwords for the NPM user and the MariaDB root user.

3. Starting Nginx Proxy Manager

Save the file (Ctrl+O, Enter, Ctrl+X) and start the Docker Compose containers:

docker compose up -d # Start containers in the background

This command will download the necessary Docker images (Nginx Proxy Manager and MariaDB), create the containers, configure the network, and start them. The process may take several minutes depending on your internet connection speed.

4. Checking Container Status

Ensure that both containers are running:

docker compose ps

You should see an Up status for both services (app and db).

Nginx Proxy Manager is now installed and ready for initial configuration via its web interface.

Configuration

After successfully installing Nginx Proxy Manager, it's time to configure it to manage your web services and SSL certificates. The entire process will take place through a convenient web interface.

1. First Login to Nginx Proxy Manager

Open your web browser and go to http://YOUR_VPS_IP_ADDRESS:81. You will see the Nginx Proxy Manager login page.

Default credentials for first login:

• Email: [email protected]
• Password: changeme

After logging in, the system will immediately prompt you to change these details. Immediately change them to your own, more secure login and password. Also, provide your real name.

2. Setting Up the First Proxy Host

Now let's configure your first proxy host. This will allow you to access an internal service (e.g., a web server running on port 3000 on the same VPS) via a domain name with an SSL certificate.

Suppose you have the domain example.com, and you want your service to be accessible via app.example.com. Ensure that the A DNS record for app.example.com points to your VPS's IP address.

1. In the NPM web interface, go to "Hosts" -> "Proxy Hosts".
2. Click the "Add Proxy Host" button.
3. "Details" Tab:
   • Domain Names: Enter app.example.com (or your domain/subdomain).
   • Scheme: Select http (if your internal service does not use SSL) or https (if it does).
   • Forward Hostname / IP: Enter 127.0.0.1 (if the service is on the same VPS) or the internal IP address of another server.
   • Forward Port: Enter the port on which your internal service is running (e.g., 3000).
   • Block Common Exploits: Recommended to enable for additional security.
   • Websockets Support: Enable if your service uses websockets (e.g., chats, real-time applications).
4. "SSL" Tab:
   • SSL Certificate: Select "Request a new SSL Certificate".
   • Force SSL: Enable to automatically redirect all HTTP requests to HTTPS.
   • Email Address for Let's Encrypt: Enter your valid email address.
   • I Agree to the Let's Encrypt Terms of Service: Check this box.
   • Use a DNS Challenge (optional): If you cannot open ports 80/443 for NPM or want to use wildcard certificates, select this method. For most cases, HTTP Challenge is sufficient.
5. Click "Save".

NPM will contact Let's Encrypt, obtain, and install an SSL certificate for your domain. This may take a few seconds. After successful certificate issuance, the host status will change to "Online" with a green padlock icon.

3. Verifying Functionality

Now you can test your service by navigating to https://app.example.com (replace with your domain) in your browser. You should see the content of your internal service, as well as a green padlock in the address bar, confirming the presence of a valid SSL certificate.

You can also use curl to verify:

curl -I https://app.example.com # Check HTTP headers

You should see headers indicating a redirect (if Force SSL is enabled) and a successful HTTPS connection.

4. Advanced Settings (Optional)

Custom Nginx Directives

If you need specific Nginx settings that are not available in the web interface, you can add them on the "Advanced" tab when editing a proxy host. For example, to increase the limit for uploaded file sizes:

client_max_body_size 100M;

These directives will be inserted into the server block for this proxy host.

Access Lists

NPM allows you to create access lists to restrict access to your services by IP address or require basic HTTP authentication. This is useful for internal tools or testing environments.

1. Go to "Access Lists".
2. Click "Add Access List".
3. Configure rules (e.g., "Allow" for specific IPs, "Deny" for all others) or add "Basic Auth" credentials.
4. Apply the access list to the desired proxy host on the "Advanced" tab.

After configuring each proxy host, NPM automatically updates the Nginx configuration and reloads it, ensuring immediate application of changes.

Backups and Maintenance

Backups and regular maintenance are critically important aspects for any production system, including Nginx Proxy Manager. Loss of configuration or SSL certificates can lead to downtime for all your web services.

1. What to Back Up

For Nginx Proxy Manager, the following components must be backed up regularly:

• ./data Directory: Contains all NPM configuration (SQLite database, if you use it, or data for connecting to an external DB) and Let's Encrypt data. This is the most important.
• ./letsencrypt Directory: Contains all your SSL certificates. Although they can be reissued, having a backup speeds up recovery.
• docker-compose.yml File: Contains the description of your Docker services and their configuration.

In our case, since we use MariaDB in a separate container, the database data is stored in ./data/mysql. All critically important data is already covered by the backup of the ./data directory.

2. Simple Auto-Backup Script

Let's create a simple script that will create an archive with the necessary data and save it.

Create the file backup_npm.sh in your user's home directory:

nano ~/backup_npm.sh

Insert the following content. This script will stop NPM containers (to avoid database corruption during backup), create an archive, and then restart them.

#!/bin/bash

# Directory where your docker-compose.yml for NPM is located
NPM_DIR="/home/$USER/nginx-proxy-manager"
BACKUP_DIR="/var/backups/npm" # Directory for storing backups
DATE=$(date +%Y%m%d%H%M%S)
BACKUP_FILE="${BACKUP_DIR}/npm_backup_${DATE}.tar.gz"

echo "Starting Nginx Proxy Manager backup at ${DATE}..."

# Create backup directory if it doesn't exist
sudo mkdir -p ${BACKUP_DIR}
sudo chown $USER:$USER ${BACKUP_DIR} # Ensure the user has write permissions

# Navigate to NPM directory
cd ${NPM_DIR} || { echo "Error: NPM directory not found!"; exit 1; }

# Stop NPM services for a consistent backup
echo "Stopping NPM services..."
docker compose stop

# Create archive with NPM and letsencrypt data
echo "Creating backup archive..."
tar -czf ${BACKUP_FILE} data docker-compose.yml

# Start NPM services back up
echo "Starting NPM services..."
docker compose start

# Delete old backups (e.g., older than 7 days)
echo "Cleaning up old backups..."
find ${BACKUP_DIR} -type f -name "npm_backup_*.tar.gz" -mtime +7 -delete

echo "Backup complete: ${BACKUP_FILE}"

Make the script executable:

chmod +x ~/backup_npm.sh

Test the script by running it manually:

~/backup_npm.sh

Verify that the backup file is created in /var/backups/npm/.

3. Setting up Cron for Automatic Backups

Add the script to the Cron task scheduler so that it runs automatically (e.g., daily at 3:00 AM).

crontab -e

Add the following line to the end of the file. It will run the script every day at 3:00 AM.

0 3 * * * /home/YOUR_USERNAME/backup_npm.sh >> /var/log/npm_backup.log 2>&1

Replace ВАШЕ_ИМЯ_ПОЛЬЗОВАТЕЛЯ with your username.

4. Where to Store Backups (External Storage)

Storing backups on the same server as the original data is risky. If the server fails, you will lose both data and backups. It is recommended to use external storage:

• Object Cloud Storage (S3-compatible): AWS S3, Backblaze B2, DigitalOcean Spaces, MinIO. These are reliable and scalable solutions. You can use utilities like rclone for automatic synchronization of local backups with the cloud.
• Separate VPS: You can set up a second, small VPS and use rsync or scp to copy backups there.
• Local NAS/PC: If your VPS has a public IP, you can set up a VPN tunnel and copy backups to a home NAS or PC.

Example of rclone integration into the backup script (after the line echo "Backup complete: ${BACKUP_FILE}"):

# Sync with S3-compatible storage (assuming rclone is already configured)
echo "Syncing backups to remote storage..."
rclone copy ${BACKUP_DIR} remote:npm-backups --min-age 1d

5. Updates: rolling vs maintenance window

Regular updates of Nginx Proxy Manager and MariaDB Docker images are important for new features, bug fixes, and security patches.

• Rolling updates: For NPM, this is not exactly "rolling" as it's a single instance. But you can update it at any time.
• Maintenance window: It is recommended to schedule updates during times of lowest user activity, as an update will entail a short downtime (several seconds to a minute) while the old container stops and a new one starts.

Update process:

Navigate to the nginx-proxy-manager directory:

cd ~/nginx-proxy-manager

Stop and remove old containers and download new images:

docker compose down             # Stops and removes containers
docker compose pull             # Downloads the latest versions of images (specified in docker-compose.yml)
docker compose up -d            # Starts new containers

If you want to update only one service (e.g., NPM, but not MariaDB), you can specify its name:

docker compose pull app
docker compose up -d app

Always make a backup before major updates or configuration changes.

Troubleshooting + FAQ

Various issues may arise during the setup of Nginx Proxy Manager. Here we will cover the most common ones and provide recommendations for their resolution.

What to do if the Nginx Proxy Manager web interface is unavailable on port 81?

First, ensure that the NPM container is running. Connect via SSH to your VPS and execute the command docker compose ps in the nginx-proxy-manager directory. If the status of the app container is not Up, check the logs with the command docker compose logs app for errors. Make sure that port 81 is not occupied by another application on your VPS and that UFW allows incoming connections to this port (sudo ufw status verbose).

Why is no SSL certificate being issued by Let's Encrypt?

The most common reasons are:

• Incorrect DNS records: Ensure that the A type DNS record for your domain (e.g., app.example.com) points to the public IP address of your VPS. Check this using dig app.example.com.
• Firewall: Ports 80 and 443 must be open on your VPS (UFW should allow 'Nginx Full'). Let's Encrypt uses these ports for domain ownership verification (HTTP-01 challenge).
• NPM cannot communicate with Let's Encrypt: Ensure that your VPS has internet access and DNS resolution is working correctly.
• Let's Encrypt rate limit exceeded: If you made many failed attempts, you might have temporarily exceeded Let's Encrypt's limits. Wait a few hours and try again.
• Invalid email: Ensure that you have provided a valid email address in the SSL settings.

My proxy host is configured, but the service does not open or returns a 502 Bad Gateway error.

A 502 error usually means that Nginx Proxy Manager could not connect to your internal service. Check the following:

• Forward Hostname / IP and Forward Port: Ensure that these parameters in the proxy host settings are correct. If the service is on the same VPS, use 127.0.0.1 or the Docker container name (if they are in the same Docker network).
• Internal service availability: Ensure that your internal service is actually running and listening on the specified port. You can check this from the VPS using curl http://127.0.0.1:SERVICE_PORT.
• Firewall on VPS: If your internal service is running in a separate Docker container or on a different port, ensure that its port is accessible to NPM (Docker usually manages its internal network, but it's worth checking).

How to update Nginx Proxy Manager?

To update NPM to the latest version specified in your docker-compose.yml, execute the following commands in the nginx-proxy-manager directory:

docker compose down
docker compose pull
docker compose up -d

Always make a backup before updating!

What is the minimum suitable VPS configuration?

For a basic installation of Nginx Proxy Manager and a few lightweight services (e.g., a small website, Mattermost for 5-10 people, a Bitcoin node), a VPS with 1 vCPU, 1 GB RAM, and 25-30 GB SSD will be sufficient. This will be enough for stable NPM operation and handling moderate traffic. However, if you plan to run more resource-intensive applications or a large number of services, it's better to consider a configuration with 2 vCPU and 2-4 GB RAM.

What to choose — VPS or dedicated for this task?

For most users and scenarios described in this guide (developer, solo founder, gamer, crypto enthusiast), a VPS is the optimal choice. It offers sufficient performance, flexibility, and significantly lower cost compared to a dedicated server. A dedicated server should only be considered in cases of very high load (hundreds of thousands of requests per second, dozens of high-load services), the need for specialized hardware (GPU, large amount of RAM or disk, RAID arrays), or strict requirements for complete isolation.

How to configure HTTP to HTTPS redirection?

Nginx Proxy Manager does this automatically. When creating or editing a proxy host, on the "SSL" tab, simply enable the "Force SSL" option. NPM will add the necessary Nginx directives to redirect all HTTP traffic to HTTPS.

Conclusions and Next Steps

Congratulations! You have successfully installed and configured Nginx Proxy Manager on your VPS, and learned how to manage reverse proxies and SSL certificates through a convenient web interface. Now your server is ready for deploying and publishing various web services, be they personal projects, team tools, or commercial applications, with confidence in security and ease of management.

Here are a few steps you can take next to maximize the use of your new Nginx Proxy Manager:

1. Deploying new services: Now that you have a centralized proxy, you can easily add new Docker containers with your applications (GitLab, Mattermost, WordPress, Nextcloud, etc.) and quickly publish them on the internet by configuring proxy hosts in NPM.
2. Server monitoring: Install monitoring tools such as Prometheus + Grafana, Netdata, or Zabbix to track the status of your VPS, resource usage by Docker containers, and Nginx Proxy Manager performance.
3. Additional security: Consider using Cloudflare (or a similar CDN/WAF) in front of Nginx Proxy Manager for additional protection against DDoS attacks, content caching, and performance improvement. Also, explore the possibility of using more complex access control lists or integrating with Single Sign-On (SSO) systems.