Every self-hosted service deserves a name and a valid certificate. A reverse proxy gives you both, plus a single place to enforce access control. Uptime SLA: five nines, right up until the vacuum cleaner meets the power strip.
The parts
- nginx-proxy-manager (NPM). Point a hostname at a service, get Let's Encrypt certificates and clean URLs. Adding a service becomes a 30-second job.
- Auth layer. A lightweight SSO/OIDC provider (pocket-id, Authelia, tinyauth) in front of admin panels and dashboards — one login instead of eight.
- Edge passthrough. When the public entry is a VPS or tunnel, an haproxy/SNI passthrough forwards TLS untouched to the real proxy — no double termination, certificates stay on your terms.
Patterns that work
- Split horizon DNS. Public DNS points at your edge; LAN DNS points the same names at internal IPs. Traffic never leaves the house when it doesn't have to.
- Wildcard certificates. One DNS-01 challenge covers every subdomain; new services get TLS instantly.
- Least privilege by default. Anything with a docker socket, admin UI, or database gets the auth wall. Public gets only what's meant to be public.
Good habits
- When you move or rename a backend, change it through the proxy's API/UI — hand-edited configs get regenerated from state, and stale upstreams cause "mysterious" 502s.
- Keep an export of proxy config in backups; it's the map of your whole setup.
- Set HSTS once a host is stable — but only once, because it sticks.