Nginx Proxy Manager Install - 2-Minute Setup Guide

What You Need Before Starting

Three things must exist before Nginx Proxy Manager (NPM) can work. First, a Linux server or PC with Docker and Docker Compose already installed and working - NPM runs as a container, not as a normal program. Second, a domain name whose DNS you can edit, because every service gets its own subdomain. Third, your router or cloud firewall must be able to forward ports 80 and 443 to this machine.

Point Your Domain DNS to the Server First

NPM routes traffic by name, and Lets Encrypt issues certificates only for names that provably point at your machine - so the name has to resolve before you build anything on it. At your registrar or DNS host, add an A record: the Name is the subdomain word only (for example app) and the Value is your server's public IP address. Every service gets its own record, and they can all point at the same IP - NPM separates the services later, by name. Set a short TTL such as 300 seconds while testing, so mistakes fade in minutes instead of hours.

Prove it before you continue: check that the name resolves to your public IP from an outside network (for example from your phone with Wi-Fi off). Requesting a certificate against broken DNS wastes Lets Encrypt attempts, and repeated failures can rate-limit you for hours. The order matters: DNS first, proxy host second, certificate third.

Create the Folder and the Compose File

Make a folder for NPM on the server and save the file below inside it as docker-compose.yml. This single file is the complete installation. The image name is the official community image. Ports 80 and 443 are the public doors, port 81 is the admin panel, and the two volumes are where your entire setup lives: ./data holds the database with all your proxy hosts, and ./letsencrypt holds your certificates. Lose those two folders and you lose the whole setup - back them up once things are running.

services:
  app:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '80:80'
      - '443:443'
      - '81:81'
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

The restart: unless-stopped line brings NPM back automatically after a reboot.

Start Nginx Proxy Manager

From inside that folder, run the start command. Docker downloads the image and starts the container in the background.

docker compose up -d

Check it is running:

docker ps

You should see the container listed with ports 80, 443 and 81. On a small server the first start takes a minute or two while the database is created. If the container keeps restarting, the logs show the reason in plain language:

docker compose logs

Nine times out of ten a restart loop is a port already used by something else on the host - usually an old web server still running.

First Login - Secure the Admin Account Immediately

Open the admin panel in a browser on your own network:

http://your-server-ip:81

Do this in the first minute. Depending on the build, NPM either asks you to replace the well-known first-login administrator details with your own email and a strong password, or - on newer builds with no default account - the first person to open the admin page creates the administrator. Either way the rule is the same: set up your own admin account the moment the container starts, before creating anything else, and use a real mailbox - NPM emails that address about certificate problems.

Create Your First Proxy Host

In NPM open Hosts → Proxy Hosts → Add Proxy Host and fill the form as one sentence - "this name goes to that internal service":

Domain Names: app.yourdomain.com - the exact public name from Step 2, which must already resolve to your server.
Scheme: http for most home and office apps. Scheme describes the connection between NPM and the internal service, not what visitors use - NPM handles the public encryption at the door. Choose https here only when the internal app itself serves HTTPS.
Forward Hostname / IP: the internal address of the service, for example 192.168.1.50.
Forward Port: the port the service actually listens on, for example 8080 - not 80 or 443; those are NPM's doors, not the service's.

Turn on Block Common Exploits, then Save. Test immediately by opening the name in a browser - ideally from your phone with Wi-Fi off, so you test the real public path.

Get the Free Lets Encrypt HTTPS Certificate

Only do this after the plain host from Step 6 already works - HTTPS on a broken host gives you a broken host with a certificate, and twice the places to look for the fault. Open the same proxy host, go to the SSL tab, set SSL Certificate to Request a new SSL Certificate, enable Force SSL and HTTP/2 Support, agree to the Lets Encrypt Terms of Service, and Save. Reload the site - the browser should now show the padlock on https.

How it works: Lets Encrypt proves you control the name by asking your server, over the public internet on port 80, to show a one-time token (the HTTP-01 challenge). That is why DNS pointing at you and a reachable port 80 are non-negotiable - fail either one and the request fails, and the error is in the setup, never in Lets Encrypt. Force SSL redirects every http visitor to https automatically; without it the unencrypted door stays open beside the encrypted one.