r/nginxproxymanager

I've been trying (and failing) to set up a minecraft server and in that process I attempted to create a VM on TrueNas Community Edtn. I was then successful in the setup of a network bridge and VM by following the tutorials by Servers@Home and various others.

Unfortunately after successfully setting up the bridge and vm, my NPM proxies no longer work. I get the error when trying to connect to a website: "Err_Connection_Timed_Out". So now all of my proxy HTTPS urls no longer work. Additionally, I feel like the whole network is slower and that is with the VM on or off. I am really unsure what to do.

This is the container log for NGINX.

My network settings

I would appreciate any help or suggestions.

Hi all! I am looking to add an auth server to my homelab, problem is, I’ve seen that I will need to change Nginx Proxy Manager to the host network mode to make this work.

Problem is, I correctly have it in multiple bridge networks, each connected to one container for some sense of semi isolation. This allows me to just use the container name and port when setting up where to direct the host in NPM. When switching to host mode, this no longer works. I could be wrong, but that seems like I would then need to expose ports to access them if I can’t access them by their container name.

I know it’s not a black and white issue, but what is generally safer, requiring exposed ports but having an auth proxy, or no exposed ports but no auth proxy?

I could 100% be wrong about any of my assumptions, let me know if I am. Any help would be greatly appreciated

I’m trying to determine whether this is a Sophos WAF config issue or if I’m missing something.
Architecture: client -> Sophos WAF -> Nginx Flask API. Here’s what I’ve observed: the application works perfectly when accessed directly on the internal network, GET and the CORS OPTIONS preflight reach Nginx successfully, but the actual PATCH/Post with formdata request never reaches Nginx (no access log entry). The browser receives a 403 Forbidden with a generic Apache error page, so I suspect the Sophos WAF is rejecting it before forwarding.

Questions: has anyone seen Sophos WAF block PATCH requests by default or via protection policy?
Which logs or settings should I check to identify the exact rule causing the block, and is there a way to temporarily put the WAF policy into monitor only to confirm it’s the WAF rejecting it?

So I just recreated npm after factory resetting my nas, I created the following container and when I go to localhost:8080 and enter the correct listed credentials I cannot login. I am on a ugreen nas I'm unsure if there's anything special that needs to be done with this system but I could really use the help.

services:
 nginx-proxy-manager:
  image: jc21/nginx-proxy-manager
  container_name: Nginx-Proxy-Manager
  healthcheck:
      test: timeout 10s bash -c ':> /dev/tcp/127.0.0.1/81' || exit 1
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 90s
  volumes:
    - /volume1/docker/npm/letsencrypt:/etc/letsencrypt:rw
    - /volume1/docker/npm/data:/data:rw
    - /volume1/docker/npm/config.json:/app/config/production.json
  environment:
    TZ: America/New_York
    INITIAL_ADMIN_EMAIL: email
    INITIAL_ADMIN_PASSWORD: password
  ports:
    - 443:443
    - 81:81
    - 80:80
  restart: on-failure:5

I am having some issue understanding how to forward traffic to a container from NPM (Nginx Proxy Manager). Understanding the docker networking layer is giving me some trouble, and I hope I might get some feedback and suggestion on my current setup.

I had been running a grimmory container without issue, setup with docker-compose and behind a static nginx reverse proxy. A few weeks ago I discovered that the advertised ports for the service had been bound to 0.0.0.0, making the service available on the public IP and any DNS entries for the server on that port.

Unhappy with this setup, I have been trying to learn how to route all traffic to docker services through the reverse proxy. I don't want to expose any more ports that necessary to minimise the attack surface on the server. Thus I've been looking at NPM on the suggestion of other posts.

I have been able to set NPM up and forward the management port so it's no longer exposed and get SSL certs for the sub-domain . Now I am having difficulty in getting traffic forwarded from NPM to the grimmory service without binding a port to 0.0.0.0 on the docker host.

I have done some reading on the docker networking layer, and found that it's default behaviour is to bind to the host, as I saw earlier. I have also read that creating different docker networks and isolating your containers is an important security measure. I have thus created two networks in docker;

• Proxy: for the NPM service
• grimmory_stack: For grimmory and the database container.

I have added the grimmory service to the proxy network and the grimmory_stack network so both can talk with each other, with the database service not on the proxy network. I have confirmed this network connectivity, the output of docker network inspect proxy below;

        {
            "Name": "proxy",
            "Id": "d0538741facec1f19adfeef5ce64738c8bfa0e6e21b24df4ec73e260fd3ddef4",
            "Created": "2026-08-06T13:30:45.066391048Z",
            "Scope": "local",
            "Driver": "bridge",
            "EnableIPv4": true,
            "EnableIPv6": false,
            "IPAM": {
                "Driver": "default",
                "Options": {},
                "Config": [
                    {
                        "Subnet": "172.18.0.0/16",
                        "Gateway": "172.18.0.1"
                    }
                ]
            },
            "Internal": false,
            "Attachable": false,
            "Ingress": false,
            "ConfigFrom": {
                "Network": ""
            },
            "ConfigOnly": false,
            "Options": {},
            "Labels": {},
            "Containers": {
                "4051b0bb567a39fb8409ef3df5560378a8b0341777559cd795a2df8f14eaf0a4": {
                    "Name": "grimmory",
                    "EndpointID": "195d4eb46a62af397448bbe1143740e3c89b384238e8598bf7fd960330036188",
                    "MacAddress": "de:1e:4e:9b:20:dc",
                    "IPv4Address": "172.18.0.3/16",
                    "IPv6Address": ""
                },
                "e341a2cb9e9b8a79840c6aaf6c06be700375f4a8aa45557af55bb6882f3bc0bb": {
                    "Name": "nginx-proxy-app-1",
                    "EndpointID": "7de5753d1734d3ed3d02c206c43eaf86e9c92a6705b0733d5631be3cc56f83df",
                    "MacAddress": "e2:2e:16:c4:de:67",
                    "IPv4Address": "172.18.0.2/16",
                    "IPv6Address": ""
                }
            },
            "Status": {
                "IPAM": {
                    "Subnets": {
                        "172.18.0.0/16": {
                            "IPsInUse": 5,
                            "DynamicIPsAvailable": 65531
                        }
                    }
                }
            }
        }
    ]

Please also see the docker-compose files for both the NPM and Grimmory docker services;

    services:
      app:
        image: 'jc21/nginx-proxy-manager:latest'
        restart: unless-stopped
        networks:
          - proxy
        ports:
          # These ports are in format <host-port>:<container-port>
          - '80:80' # Public HTTP Port
          - '443:443' # Public HTTPS Port
    #      - '81:81' # Admin Web Port #Forwarded through 443, should not be exposed.
          # Add any other Stream port you want to expose
          # - '21:21' # FTP
    
        environment:
          TZ: "GMT"
    
          # Uncomment this if you want to change the location of
          # the SQLite DB file within the container
          # DB_SQLITE_FILE: "/data/database.sqlite"
    
          # Uncomment this if IPv6 is not enabled on your host
          # DISABLE_IPV6: 'true'
    
        volumes:
          - ./data:/data
          - ./letsencrypt:/etc/letsencrypt
    
    networks:
      proxy:
        external: true


    services:
      grimmory:
        image: grimmory/grimmory:latest
        # Convenience tag:
        # image: grimmory/grimmory:<release-version>
        # Alternative: ghcr.io/grimmory-tools/grimmory:<release-version>
        # To build from source instead: comment out 'image' and uncomment below
        # build: .
        container_name: grimmory
        environment:
          - USER_ID=${APP_USER_ID}
          - GROUP_ID=${APP_GROUP_ID}
          - TZ=${TZ}
          - DATABASE_URL=${DATABASE_URL}
          - DATABASE_USERNAME=${DB_USER}
          - DATABASE_PASSWORD=${DB_PASSWORD}
          - API_DOCS_ENABLED=${API_DOCS_ENABLED}
          - DISK_TYPE=${DISK_TYPE}
        depends_on:
          mariadb:
            condition: service_healthy
    #    ports:
    #      - "6060:6060"
        expose:
          - "6060"
        volumes:
          - ./data:/app/data
          - ./books:/books
          - ./bookdrop:/bookdrop
        healthcheck:
          test: wget -q -O - http://localhost:6060/api/v1/healthcheck
          interval: 60s
          retries: 5
          start_period: 60s
          timeout: 10s
        restart: unless-stopped
        networks:
          - proxy
          - grimmory_stack
    
      mariadb:
        image: lscr.io/linuxserver/mariadb:11.4.5
        environment:
          - PUID=${DB_USER_ID}
          - PGID=${DB_GROUP_ID}
          - TZ=${TZ}
          - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
          - MYSQL_DATABASE=${MYSQL_DATABASE}
          - MYSQL_USER=${DB_USER}
          - MYSQL_PASSWORD=${DB_PASSWORD}
        volumes:
          - ./mariadb/config:/config
        restart: unless-stopped
        healthcheck:
          test: ["CMD", "mariadb-admin", "ping", "-h", "localhost"]
          interval: 5s
          timeout: 5s
          retries: 10
        networks:
          - grimmory_stack
    
    networks:
      grimmory_stack:
        name: grimmory_stack
        internal: true
    
      proxy:
    	external: true

I have played with the docker network drivers some what. I know i need the proxy network to be a bridge and externally accessible on ports 80 and 443 to intercept web traffic. Ideally I would like the grimmory_stack and grimmory service to be an internal network, though my reading suggests the grimmory service needs to be on the same network as the NPM service, so both are in the proxy network.

In NPM I have tried a few different destinations, such as

• The IP of the grimmory container in the docker network
• The name of the container (set to grimmory in the docker compose file)
• grimmory.network
• localhost:6060

None of the above connect to the service, though I often get a 504 error which suggests the traffic is reaching my server, but not getting forwarded to the correct destination.

In the docker compose file for grimmory, I have tried a few different network settings but to no avail. In the Grimmory docker-compose.yml I have exposed port 6060 hoping the would open the port on the container and not the docker host, but it appears to not have worked either.

I would be very grateful if anyone can point out where I have gone wrong in my understanding, or point me to some reliable resources, ideally aimed at 5 year olds, with lots of colourful diagrams, and maybe jingly keys as well.