Any downsides to using NGINX Proxy Manager vs Native NGINX? reddit / selfhosted ---------------------------------------------------------------------- Jazkyr · 2023-12-16 11:18 Hello, my fellow self-hosters! So I've been using Nginx for a bit now and I'm super used to making configuration files by hand. Even made a few scripts to make it easier. But I was looking at Nginx Proxy Manager and man... it looks so much more convenient to use. Fill in a few text boxes and life is good it seems. I want to ask you folks who have used both, what are some of the drawbacks of Nginx Proxy Manager? I'm hosting Pterodactyl which serves static files, is that kind of configuration much of a hassle when using NPM compared to native Nginx? One important note would be that I'd be hosting it via Docker; but I imagine this doesn't matter too much really. Would appreciate some feedback on this regard. ---------------------------------------------------------------------- alex_the_decent · 2023-12-16 11:27 One downside would be since Nginx Proxy Manager gets updated less often you are more likely to be running an out of date and potentially vulnerable version on your server ---------------------------------------------------------------------- ElevenNotes · 2023-12-16 11:34 Yes: You miss all the experience you would gain to properly understand what Nginx does. Just like with a lot of GUI overlays, they simplify and dumb down everything and leave a lot out. Nginx can do a 1000 things more that NPM does not even offer. ---------------------------------------------------------------------- DH10 · 2023-12-16 11:36 IMHO, I tried using NPM, but came to not like it. Why? * another login interface, can be minimized by SSO, but still. * althrough it is fancy with automatic ssl, once certbot or acme.sh or whatever is set up properly, its also easy done manually. * I don't know if it changed recently, but I felt like that it did not expose all of the settings I needed. * How often do you really need to change your reverse proxy config that it warrants an interface other than $EDITOR? * It's another thing to break. What if it breaks and you need to setup nginx without it? Are you able to? * The reverse proxy is the one piece of software that IMO needs to be upgraded soonish if a new version comes out (any other software as well if there are security patches...). Another thing that may delay timely updates - I've already decoupled me from any distro repos by using the official docker image. ---------------------------------------------------------------------- Jazkyr · 2023-12-16 11:46 Yea, that's what I'm afraid of. It honestly doesn't take much for me to make configs by hand for NGINX currently. But my use-cases are extremely simple which is why NPM appealed to me. ---------------------------------------------------------------------- Simon-RedditAccount · 2023-12-16 11:47 Also, it lacks **a lot** of features. One asked here frequently about is mTLS. ---------------------------------------------------------------------- Anejey · 2023-12-16 11:56 I have just finished transferring 60 proxy hosts to another domain through NPM, manually via the GUI. It wouldn't work if I bulk changed the nginx configs themselves, it would just result in server errors on NPM. If I was using plain nginx, it probably would've taken me a second to do the domain switch with configs alone. ---------------------------------------------------------------------- henry_tennenbaum · 2023-12-16 12:01 Caddy is _really_ simple to configure, if you're not married to NGINX. ---------------------------------------------------------------------- Simplixt · 2023-12-16 12:14 I use Nginx Proxy Manager on my "experiment" server, where I setup and remove docker container via Portainer quite frequently. It's great to setup docker container quickly with GUI only and without the need to SSH. For my productive apps, I'm using Caddy, sometimes Nginx + Certbot if it's a more complex configuration that isn't documented as well for Caddy. ---------------------------------------------------------------------- Sugardaddy_satan · 2023-12-16 12:22 try caddy its simpler ---------------------------------------------------------------------- Porculius · 2023-12-16 12:47 I'd suggest Traefik, NPM lacks fine tuning as all is configured via web. I use it with Authelia and Crowdsec. ---------------------------------------------------------------------- sk1nT7 · 2023-12-16 12:48 It's basically a clicky GUI that configures a lot of nginx settings you would typically have to understand by yourself and craft. Due to this, a lot if things happen under the hood, which you as end user are unaware of. Furthermore, it tends to not support all configuration features nginx comes with as the GUI only targets the most basic things to set up new proxy hosts really fast. Also patch management may be a problem, as it is not that actively developed and has really a lot of github issues that are not tasked by the devs. As soon as you want real controll and configure more advanced stuff, you will find yourself a lot in the advanced section and location area of NPM. You will struggle, read a lot of github issues and finally add 'random' community code into your NPM configuration in the hope that it somehow works. It's a nice project and I've used it for more then a year. However, I switched to Traefik to gain real controll and never looked back. Configuring SSO and IdP providers is so much easier in Traefik. Also having infrastructure by code via Traefik labels only. Makes it easy to backup and adjust programatically. One last note: If you have a single proxy host in NPM that is not configured properly or the underlying service is not alive during NPM startup, the whole container will fail and none of your configured proxies will be available. This is a general nginx problem, as all configs must be perfect and valid. In traefik, it doesn't care. You'll have a single error for your individually failing service but everything else is just up and running. Also load balancing is really easy in traefik. Tldr: NPM is nice for starters that do not have special needs or/and an understanding what nginx is doing and how to properly configure it. As soon as you hit expert level or habe special needs, you will want to switch really fast. ---------------------------------------------------------------------- Jazkyr · 2023-12-16 13:12 Wow, amazing response. Thank you! I figured it has some drawbacks, but now I'm really curious to try Traefik lol. I'll give it a go and maybe caddy as others have mentioned. ---------------------------------------------------------------------- LastTreestar · 2023-12-16 13:14 > NPM is nice for starters that do not have special needs So if you're not retarded, NPM is fine? ---------------------------------------------------------------------- LidgChris · 2023-12-16 13:19 There’s no better teacher like making your changes to your proxy or system in a CLI and not being able to figure out where or what you did to break it. That’s not even sarcasm. The amount i have learned by breaking things using a CLI is crazy, the stress and googling and all that is actually fun sometimes and how I’ve learned most of my skill set (which is still limited but leaps and bounds ahead of where i was a few years ago). ---------------------------------------------------------------------- CC-5576-05 · 2023-12-16 13:53 For me the biggest downside is that you can't host static websites. I get that it's a focus is on managing reverse proxies, but it's just a gui to edit nginx config files. It shouldnt be difficult to add support for static sites either through editing a html file in the gui or maybe through just giving it the link to a git repo. ---------------------------------------------------------------------- DMenace83 · 2023-12-16 14:01 > One last note: If you have a single proxy host in NPM that is not configured properly or the underlying service is not alive during NPM startup, the whole container will fail and none of your configured proxies will be available. Not true. I run NPM for a while, I have always started NPM first before starting my other services. You don't need the underlying services alive before starting NPM. NPM will just return an HTTP 500 for that one service if it's not alive. ---------------------------------------------------------------------- sk1nT7 · 2023-12-16 14:09 Hmm maybe it was faulty configs only then. Can't remember really. Thanks for clarifying. ---------------------------------------------------------------------- MyTechAccount90210 · 2023-12-16 14:13 Npm is great if you want it fast and easy. I. My experience npm has issues with the latest installs. I'm on a pretty old version but the latest installs on docker shit the bed after a couple of restarts and don't recover. Pissed me off. It's good in some ways but short in others. For my its perfect right now but I'll likely look into others at some point. ---------------------------------------------------------------------- lilolalu · 2023-12-16 14:15 I have been using nginx for years but switched to HAproxy a while ago. If you are generally ok with manually editing config files. I find HAproxy much simpler than nginx at the same time equally (or more) capable. ---------------------------------------------------------------------- MP715 · 2023-12-16 14:30 No one mentioned SWAG. Interesting. I love it. ---------------------------------------------------------------------- TheJubo · 2023-12-16 14:49 Are there any major problems with SWAG? I was looking at it as an option. ---------------------------------------------------------------------- z3roTO60 · 2023-12-16 15:03 You can use Traefik with docker compose labels and then the reverse proxy gets auto configured as the container boots up or shuts down. I’ve never seen a reverse proxy work as well with docker as Traefik ---------------------------------------------------------------------- MP715 · 2023-12-16 15:05 Can't think of anything major. It just works. Many configs for different services have been done alrrady and just need some tweaking. The whole point is for it to act as gatekeeper for exposed services. Right? ---------------------------------------------------------------------- ENgraver666 · 2023-12-16 15:20 i got NPM + mTLS running without any issues. It's not an option in the GUI but it works. ---------------------------------------------------------------------- ElevenNotes · 2023-12-16 15:38 If they are so simple why not use Traefik instead? Nginx shines when used more than just a proxy. ---------------------------------------------------------------------- CatoDomine · 2023-12-16 16:55 Honestly, the more frequently a config has to change, the less likely I am to want a GUI. ---------------------------------------------------------------------- root_switch · 2023-12-16 16:57 Save yourself some time and future proof your reverse proxy setup with something like Traefik. You get way more integrations and conf options vs npm. It’s a bit more complicated but worth it. ---------------------------------------------------------------------- TagMeAJerk · 2023-12-16 17:04 Any guide on how you configured that? ---------------------------------------------------------------------- tenekev · 2023-12-16 17:16 With traefik you can configure every service's RP entry with labels. The same docker-compose.yml is not only the service config but the reverse proxy config for that service too. Hands down, the best feature for me. ---------------------------------------------------------------------- tenekev · 2023-12-16 17:18 Yeah, everything non-docker in my HL is using HAProxy. The hypervisor, the VMs, the LXCs. And since it's part of pfsense and opnsense, the documentation is support is readily available. ---------------------------------------------------------------------- MagnaCustos · 2023-12-16 17:19 I have it but am moving away most likely towards caddy. Npm is fine and all but more for me personally I'm not running it in docker but as a service which has been hit or miss with updates and I like keeping my proxy lxc update to date ---------------------------------------------------------------------- Do_TheEvolution · 2023-12-16 17:30 Most people around love NPM, its simple with its webui and it gets work done. But if you are already at the level of having scripts for plain nginx then what exactly is the drive for the change? If looking for some simplification... I am a strong Caddy reverse proxy supporter. Its much simpler config than plain nginx and also gets things done. [Heres](https://github.com/DoTheEvo/selfhosted-apps- docker/tree/master/caddy_v2) a guide for you to have a look how one might set it up in docker and how its config differs. ---------------------------------------------------------------------- housepanther2000 · 2023-12-16 17:35 I like NGINX Proxy Manager but prefer using native NGINX. NGINX Proxy Manager helped me learn the terminology behind reverse proxying. Once I understood that, it was time for me to go native. ---------------------------------------------------------------------- Posting____At_Night · 2023-12-16 17:51 I've never used NPM, but honestly it's not very hard to set up a reverse proxy with raw NGINX. I just rebuilt my reverse proxy from scratch the other day and it took make 3 hours to go from zero to having all my services available, some behind HTTP auth, and SSL certs through LetsEncrypt. ---------------------------------------------------------------------- horus-heresy · 2023-12-16 17:54 You can rawdog nginx configs yourself ---------------------------------------------------------------------- DMenace83 · 2023-12-16 18:06 Yea, that is correct, typos and bad configs can cause the entire service to not come up. But with NPM, unless you are adding custom configs, most of what you need is just toggles, so that minimizes typos and bad configs. ---------------------------------------------------------------------- AndyMarden · 2023-12-16 19:23 I have moved to nginx from nginxpm. I found it obfuscated what is happening and with problem I couldn't well enough see what was going on. It's a bit weird how it does custom locations. I find it much easier now with nginx - I've less layer to deal with.. ---------------------------------------------------------------------- Cheap_Tumbleweed · 2023-12-16 19:41 Or more likely HTTP 502 (bad gateway) or 504 (gateway timeout) ---------------------------------------------------------------------- Jazkyr · 2023-12-16 19:57 Hi folks, after looking at all of your amazing feedback I've decided not to go with NGINX proxy manager. Additionally, I will be giving Traefik and Caddy a shot as well since many of you suggested those as an alternative. I appreciate all of you, thank you for your amazing feedback! ---------------------------------------------------------------------- forwardslashroot · 2023-12-16 20:00 I am using the NGINX that came with OPNsense ---------------------------------------------------------------------- Ejz9 · 2023-12-16 20:16 Been using NPM for a while. I was new to self hosting and heard of nginx but didn’t know how to configure and it was “too complicated” for me at the time. All I need is a simple reverse proxy for one machine though. Route services to my domain and easily manage SSL. All of which it does. Nginx is supposed to be S tier in terms of a product to (from what I read) but to each their own. Also considering everyone will fanboy over what they use its always a why not use this or that. Multiple products with different avenues for different usages and solutions. Reading posts about traefik I may give it an install as I’m curious about its webUI which hate if you want if you’re a CLI die hard. Using GUI can simplify tasks though and images are more understandable. A mix of both I find is best. Another thought could be the resources it consumes. I can’t speak completely on this but I know Nginx is lightweight. How much does NPM change from this? Not sure but I’m lazy and it works good enough. I’m not min maxing either when my CPU doesn’t exceed 15% for anything. Give it a try as you have experience with the base. It’s not like docker containers are hard to create and remove. My guess is you want like it as once you find something you could do in the “advanced interface” the simple interface becomes… inefficient. ---------------------------------------------------------------------- ENgraver666 · 2023-12-16 20:38 It's pretty easy: \- Bind mount a folder with 2 files ( e.g. "mtls.conf" and "root.pem" ) Go to the proxy host in the advanced tab and put this: `include /mtls.conf;` Inside the mtls.conf is the following: `ssl_client_certificate /root.pem;` `ssl_verify_client on;` `ssl_verify_depth 1;` `if ($ssl_client_s_dn != "CN=ENgraver,C=DE") {` `return 403;` `}` Of course adjust the CN and Country depending on your client certificate. You could also use the serialnumber or whatever. Just the regular nginx mTLS. ---------------------------------------------------------------------- DMenace83 · 2023-12-16 20:42 What if you have services that aren't docker containers? ---------------------------------------------------------------------- TagMeAJerk · 2023-12-16 20:52 So basically easier than regular nginx! Thanks ---------------------------------------------------------------------- BKallTHEway83 · 2023-12-16 20:55 You can also use Nginx's "reload" instead of restart to validate the config before restarting. ​ It's a bit harder in docker, but here's an example: ​ https://www.tines.com/blog/simple-zero-downtime-deploys-with-nginx- and-docker-compose ---------------------------------------------------------------------- tenekev · 2023-12-16 20:57 Then I use HAProxy. Everything is in a Proxmox cluster. The Docker machine, the NAS, the VPN server, the Reverse Proxy itself. Every WebUI is behind a Layer 7 TLS connection. Stuff like Proxmox needs to be proxied at Level 4. The spice stuff is on tcp too, I think. And the best part is that HAProxy config for everything is 140 lines. Adding stuff to it is very easy once you establish a pattern. ---------------------------------------------------------------------- jerwong · 2023-12-16 21:04 NGINX Proxy Manager has a pretty interface. I liked it but I found it way too limiting for my needs and eventually just went back to using straight NGINX instead. It's great for beginners and very simple environments but once you get beyond that it leaves a lot to be desired. ---------------------------------------------------------------------- maximus459 · 2023-12-16 21:57 Iirc a tech YouTuber made a video about how npm has a long outstanding issue the developer has not yet fixed.. Problems aside, npm is an awesome tool, simple and easy to work with. You can get complex if you want, npm is basically a front door nginx after all.. ---------------------------------------------------------------------- billiarddaddy · 2023-12-16 22:11 Knowing NGINX is more valuable for work experience. ---------------------------------------------------------------------- Frozen_Gecko · 2023-12-16 22:21 This, exactly this. ---------------------------------------------------------------------- junialter · 2023-12-16 22:41 You have to use a webgui, so no Ansible. ---------------------------------------------------------------------- neyfrota · 2023-12-16 23:46 I roll back to plain nginx with text files because infrastructure-as- a-code. With all the information in the files, when i do my git pull at production, all my hosts data comes together... With the proxy manager, each change i do in my tests, i need later to do in the production. Dual point and click routines . ---------------------------------------------------------------------- DMenace83 · 2023-12-17 00:14 With pure nginx, yes. But I don't think it's possible with nginx- proxy-manager. ---------------------------------------------------------------------- ismaelgokufox · 2023-12-17 02:48 Because of this and some issues on the repo that where not addressed as much as expected, I stopped using npm and now run nginx with the proxy-confs from Linuxserver. ---------------------------------------------------------------------- maomaocake · 2023-12-17 03:18 Last time I used it the downside is you cannot use it as a load balancer. ---------------------------------------------------------------------- kmisterk · 2023-12-17 05:37 ## Message Removed Harassment, abuse, insults, expletives, or other negative comments or posts *targeting a person* is absolutely not tolerated. Bigotry, excessive elitism, and intentionally-demeaning dialogue will also be removed as deemed necessary. We aim to promote an inclusive, yet constructive community that helps people group. [Message the mods](https://www.reddit.com/message/compose/?to=/r/selfh osted&subject=Removed for Rule 3&message=[Removed Post](https://www.re ddit.com/r/selfhosted/comments/18jp6k3/-/kdlvuaj/\)) ---------------------------------------------------------------------- bunk_bro · 2023-12-17 06:22 I liked NPM, but once I sorted out Traefik, I much prefer it. ---------------------------------------------------------------------- MrDag0n · 2023-12-17 08:47 Did you not just recreate the container and move the ~/NPM folder? That’s how I’ve migrated before… ---------------------------------------------------------------------- Anejey · 2023-12-17 08:50 I'm running NPM in a lxc container, not docker. Not sure what this would've achieved anyway as I needed all my proxy hosts edited to use the new domain. ---------------------------------------------------------------------- Cybasura · 2023-12-17 09:08 1. You lose control over the contents of the nginx config file 2. Nginx proxy manager suffered a pretty hefty vulnerability recently, and their codebase is pretty...messy, to say the least. Half the time it might be easier to use nginx directly ---------------------------------------------------------------------- DesertCookie_ · 2023-12-17 10:42 Does proxy-confs automatically renew SSL certificates? ---------------------------------------------------------------------- Tivin-i · 2023-12-17 10:52 Only issue I found so far is not fixing the crowded captcha plugin. But I think that it’s the minority who would need that (I’m one). Other than that SWAG is easy to run and maintain, github is active. ---------------------------------------------------------------------- xnijat · 2023-12-17 13:26 It's a simple rule: less bloat, less vulnerability. NPM is a bloat top on the ngnix. ---------------------------------------------------------------------- daedric · 2023-12-17 19:05 I've been juggling both Nginx and NPM for some years... Nginx: harder to setup, but constantly hard. Some times you get away with copyiing vhosts to another file, editing server name and you're done (wild card SSL/DNS for example). Migrating is usually copy paste of files. NPM: Nice WebUI makes it nicer and easier to setup a vhost, but makes it harder and harder to setup multiple vhosts. If you cannot use wildcard dns/ssl it makes it easier to manage those certs as well. Anything that strays outside of the regular vhosts (for example, Authelia, a Synapse server with workers) which require unorthodox configs, will always be harder (but not impossible) in NPM. ---------------------------------------------------------------------- ismaelgokufox · 2023-12-19 03:26 No just proxy. I use a combination of the linuxserver/swag container (which renews SSL/TLS certificates and reverse proxies specific services to the outside world) and linuxserver/nginx (which uses the SSL/TLS certificate from SWAG to reverse proxy all services in my local network only. All this in a single compose stack which I call “gateway”: ‘’’ yaml services: cloudflared: container_name: cloudflared image: cloudflare/cloudflared restart: unless-stopped command: tunnel --no-autoupdate run environment: - TUNNEL_TOKEN=$CF_TUNNEL_TOKEN authelia: healthcheck: disable: true restart: unless-stopped container_name: authelia environment: - PUID=$PUID - PGID=$PGID - TZ=$TZ image: authelia/authelia ports: - 9092:9091 volumes: - ./authelia:/config swag: restart: unless-stopped container_name: swag environment: - TZ=$TZ - VALIDATION=dns - DNSPLUGIN=cloudflare - PROPAGATION=30 - EMAIL=$SWAG_EMAIL - ONLY_SUBDOMAINS=false - PGID=$PGID - URL=$SWAG_URL - EXTRA_DOMAINS= - STAGING=false - PUID=$PUID - UMASK=022 - SUBDOMAINS=wildcard - CERTPROVIDER= - MAXMINDDB_LICENSE_KEY=$MAXMIND - DOCKER_MODS=linuxserver/mods:swag-auto- reload|linuxserver/mods:swag-dashboard|linuxserver/mods:swag- cloudflare-real-ip|linuxserver/mods:swag-maxmind - DHLEVEL=2048 image: lscr.io/linuxserver/swag ports: - 444:443 - 81:80 volumes: - ./swag:/config swag-local: restart: unless-stopped container_name: swag-local environment: - UMASK=022 - TZ=$TZ - DOCKER_MODS=linuxserver/mods:swag-auto- reload|linuxserver/mods:nginx-proxy-confs - PUID=99 - PGID=100 ports: - 443:443 - 80:80 image: lscr.io/linuxserver/nginx volumes: - ./swag-local:/config - ./swag/etc:/swag-ssl networks: default: name: linuxserver external: true ‘’’ ---------------------------------------------------------------------- Old-Assumption4984 · 2023-12-20 15:31 None for me, I use Apache. ---------------------------------------------------------------------- [deleted] · 2023-12-22 03:33 [removed] ---------------------------------------------------------------------- reddit_user33 · 2023-12-27 02:36 My issue with NPM is that it's predominantly a single programmer that's developing it. If they decide to not work on it or completely abandon it, then tough luck. ---------------------------------------------------------------------- atliensarereal · 2023-12-28 08:59 obv i'm ignorant of what your situation was here, but not sure how you couldn't have just used simple sed commands to change the domains in your conf files? that would have been faster than using a gui i would imagine ---------------------------------------------------------------------- Anejey · 2023-12-28 09:02 It's what I did first, but it just resulted in server errors in NPM.