You have services running on your server with ugly addresses like 192.168.1.50:8080. Nginx Proxy Manager turns them into clean names like app.yourdomain.com with free HTTPS, using a simple web panel instead of hand-written config files.
A reverse proxy sounds like advanced networking, but the job is simple: one door for all your services. Visitors type a normal domain name, Nginx Proxy Manager (NPM) receives the request and passes it to the right internal service. In this guide you will install NPM with Docker Compose, fix the one login step everyone gets wrong, create your first proxy host, and switch on a free Let's Encrypt certificate. Work through it in order and your first service will be online over HTTPS today.
Three things must exist before NPM can work. First, a Linux server or PC with Docker and Docker Compose installed — NPM runs as a container, not a normal program. Second, a domain name whose DNS you can edit, because every service gets its own subdomain. Third, your router or cloud firewall must be able to forward ports 80 and 443 to this machine. On a home connection behind CGNAT, port forwarding cannot work at all — the honest answer then is a tunnel tool or a small rented VPS instead. Do not skip this check; half of all 'NPM does not work' stories are really 'the ports never reached the server' stories.
Make a folder for NPM and save the compose file shown in the panel above inside it as docker-compose.yml. The image name is jc21/nginx-proxy-manager:latest — that is the official community image. The restart: unless-stopped line brings NPM back automatically after a reboot. The two volume lines matter more than everything else combined: ./data:/data holds the database with all your proxy hosts, and ./letsencrypt:/etc/letsencrypt holds your certificates. Lose those two folders and you lose the whole setup, which is why a later guide in this series is only about backing them up.
From inside that folder, run docker compose up -d. Docker downloads the image and starts the container in the background. Check it with docker ps — you should see the container listed with ports 80, 443 and 81. On a small server the first start takes a minute or two while the database is created. If the container keeps restarting, docker compose logs shows the reason in plain language; nine times out of ten it is a port already used by something else on the host, usually an old web server still running.
Open http://your-server-ip:81 in a browser on your own network. On older NPM builds there is a well-known default administrator login printed in every public guide, and the software forces you to replace it with your own email and a strong password at first sign-in — do that immediately, before creating anything else, because anyone on the internet who finds port 81 first owns your proxy. Newer builds removed the default account completely: the first person to open the admin page creates the administrator. That makes the same rule even more serious — set up your account the moment the container starts, and never leave port 81 publicly reachable while you 'finish it later'.
app.yourdomain.com to your server's public IP — and wait until it resolves.app.yourdomain.com. Scheme: http for most home and office apps.192.168.1.50. Forward Port: the service's real port, for example 8080.Open the subdomain in your browser. If the service answers, the proxy works. There is a full field-by-field guide in this series if any single field is unclear.
Edit the same proxy host, open the SSL tab, choose Request a new SSL Certificate, agree to the Let's Encrypt terms, and save. NPM talks to Let's Encrypt, proves you own the domain, downloads the certificate and installs it — no files to copy, no commands to run. Then turn on Force SSL so the plain HTTP address redirects to HTTPS, and HTTP/2 Support. Certificates are valid for 90 days and NPM renews them automatically before expiry. That is the whole job — the padlock most people pay for, done free, forever, as long as port 80 stays reachable for renewals.
The full install — Docker Compose file, first login and the first proxy host — is shown live in the video. Watch it once and this page becomes a checklist instead of a puzzle.
▶️ Watch Full VideoYes. NPM is free open-source software, and the Let's Encrypt certificates it requests are also free. Your only costs are the server itself and a domain name, which most people already have.
Two reasons. Visitors can only reach the service if the name points at your server, and Let's Encrypt checks that the name resolves to your machine before issuing a certificate. No DNS, no certificate — that order is fixed.
Yes, anywhere Docker runs, including a Pi. Just remember the machine must stay switched on — when it sleeps, every proxied service goes offline with it.