[{"data":1,"prerenderedAt":190},["ShallowReactive",2],{"seo-verification":3,"blog-deploy-your-applications-with-nginx-proxy-manager-on-a-vps-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"slugs":9,"title":12,"excerpt":13,"readTime":14,"views":15,"isPinned":16,"publishedAt":17,"category":18,"categories":23,"featuredImage":25,"bgImage":26,"posterImage":27,"relatedSolution":25,"intro":28,"sections":29,"ctaTitle":143,"ctaBody":144,"ctaButton":145,"ctaUrl":146,"relatedPosts":147},37,"deploy-your-applications-with-nginx-proxy-manager-on-a-vps",{"fr":10,"en":8,"ar":11},"deployer-avec-nginx-proxy-manager","انشر-تطبيقاتك-باستخدام-nginx-proxy-manager-على-خادم-vps","Deploy your applications with Nginx Proxy Manager on a VPS","Manage domains, SSL and reverse proxy for several services on a VPS with Nginx Proxy Manager: installation, Docker networks, 502 troubleshooting and configuration.",10,0,false,"2026-05-14T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":21},3,"Deployment","deploiement","bg-success\u002F10 text-success",[24],{"id":19,"name":20,"slug":21,"color":22,"icon":21},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fdeployer-avec-nginx-proxy-manager-poster.svg","Nginx Proxy Manager (NPM) places a clear web interface on top of Nginx to manage reverse proxies, domains and SSL certificates without editing a single configuration file. As soon as you host more than one application on a VPS — an API, a Gitea instance, a Portainer, an n8n — you need a reliable HTTP routing layer. This guide takes you from the Docker installation through advanced settings: isolated networks, access lists, wildcard SSL and troubleshooting common errors.",[30,34,45,48,82,85,89,92,100,140],{"type":31,"title":32,"body":33},"h2","Why a reverse proxy on your VPS","A VPS exposes a single public IP address. Behind that IP, you can run five, ten or twenty services on different internal ports. Without a reverse proxy, exposing each service on a public port means opening those ports in the firewall, manually managing TLS certificates for each one, and communicating each port to every user. A reverse proxy solves all three problems at once: it receives all traffic on ports 80 and 443, identifies the requested domain, and forwards the request to the correct internal container. Nginx Proxy Manager adds a graphical interface layer to this mechanism: no conf file to write, no manual reload, and Let's Encrypt certificates are managed in a few clicks. This is particularly suited to agencies hosting several client applications on the same server, or to independent developers running multiple projects in parallel.",{"type":35,"title":36,"items":37},"ul","NPM versus manual Nginx configuration: 7 concrete advantages",[38,39,40,41,42,43,44],"No configuration file: each proxy host is created from the web interface, without any Nginx syntax to memorize.","Automatic Let's Encrypt certificates: NPM requests, installs and renews certificates without intervention. Wildcard possible via DNS challenge.","Centralized management: all your domains, subdomains and redirects in a single screen, instead of a dozen files in `\u002Fetc\u002Fnginx\u002Fsites-enabled\u002F`.","Built-in Access Lists: protect a service by IP or by password without touching each app's configuration.","Per-host logs viewable in the interface: identify a 502 error or abuse without SSH-ing into the container.","HTTP to HTTPS redirects and custom 404 pages configurable visually.","Discovery by Docker container name: target `portainer:9000` rather than an unstable internal IP that changes on restart.",{"type":31,"title":46,"body":47},"Measured prerequisites before installing NPM","NPM only routes traffic, so it is lightweight. A VPS with 1 GB of RAM and 1 vCPU is sufficient if NPM is the only notable service. If you also host the applications behind it, size according to the sum of their needs. Plan for 15 GB of SSD disk (certificates, SQLite database, logs). Required software: Docker 24+ and the Compose v2 plugin (`docker compose`, not the old `docker-compose` command). Network: ports 80 and 443 must be free on the VPS — NPM is the sole occupant. Port 81 is reserved for the administration interface; it must never be exposed directly on the Internet. DNS: point your A records to the VPS IP before requesting certificates. For a wildcard `*.your-domain.com`, you need an API key from your DNS provider (Cloudflare, OVH, etc.).",{"type":49,"title":50,"steps":51},"steps","Installation and initial configuration of Nginx Proxy Manager",[52,55,58,61,64,67,70,73,76,79],{"title":53,"body":54},"Install Docker on the VPS","On a Debian\u002FUbuntu server: `curl -fsSL https:\u002F\u002Fget.docker.com | sh`. Then verify: `docker --version` and `docker compose version`. If the Compose plugin is not present, install the `docker-compose-plugin` package via apt.",{"title":56,"body":57},"Create the working directory and Compose file","Create `\u002Fopt\u002Fnpm` on the VPS. In that directory, create a `docker-compose.yml` file. Declare the NPM service with the image `jc21\u002Fnginx-proxy-manager:latest`, map the ports `80:80`, `443:443` and `81:81`, and define two volumes: `.\u002Fdata:\u002Fdata` and `.\u002Fletsencrypt:\u002Fetc\u002Fletsencrypt`.",{"title":59,"body":60},"Start the container","From `\u002Fopt\u002Fnpm`, run `docker compose up -d`. Check that the container is running: `docker compose ps`. The administration interface is accessible at `http:\u002F\u002FVPS_IP:81` within thirty seconds.",{"title":62,"body":63},"First login and admin account security","Log in with the default credentials: email `admin@example.com`, password `changeme`. NPM immediately prompts you to change both values. Do so before any other action: this account gives full access to your routing infrastructure.",{"title":65,"body":66},"Create a shared Docker network","For NPM to reach your application containers by name, they must share the same Docker network. Create an external network: `docker network create proxy`. In your NPM `docker-compose.yml`, declare this network as external. Do the same in the Compose file of each application to be proxied.",{"title":68,"body":69},"Add a first Proxy Host","In the interface: Proxy Hosts then Add Proxy Host. Enter the domain (e.g. `app.your-domain.com`), the Forward Hostname (container name or internal IP) and the application port. Check Block Common Exploits. If the application uses WebSockets, enable Websockets Support.",{"title":71,"body":72},"Enable Let's Encrypt SSL","In the SSL tab of the Proxy Host, choose Request a new SSL Certificate, accept the Let's Encrypt terms and check Force SSL. NPM contacts the ACME servers, validates the domain via HTTP-01 and installs the certificate. Your service is on HTTPS within seconds. Renewal is automatic.",{"title":74,"body":75},"Secure the administration interface (port 81)","Close port 81 in your firewall (`ufw deny 81`). Then create a dedicated Proxy Host — e.g. `npm.your-domain.com` pointing to `localhost:81` — with SSL and an Access List restricted to your management IP. You can then access the interface via HTTPS without exposing port 81 to the rest of the world.",{"title":77,"body":78},"Wildcard certificate via DNS challenge","To cover all your subdomains with a single certificate, use the DNS challenge. In the SSL tab, select Use a DNS Challenge, choose your provider (Cloudflare, OVH, etc.) and enter the API key. NPM creates a TXT record in your DNS zone, validates domain ownership and obtains the `*.your-domain.com` certificate.",{"title":80,"body":81},"Test the complete chain","From a terminal: `curl -I https:\u002F\u002Fapp.your-domain.com`. Expect a `200` code or your application response code. Also check the HTTP redirect: `curl -I http:\u002F\u002Fapp.your-domain.com` should return a `301` to the HTTPS version.",{"type":31,"title":83,"body":84},"Advanced configuration","NPM exposes in its interface several features that go beyond simple reverse proxying. **Access Lists** allow restricting access to a host by IP range, by HTTP Basic Auth credentials, or a combination of both — useful for protecting a backoffice without adding authentication in the application itself. **Streams** handle TCP\u002FUDP proxying for non-HTTP protocols (remote MySQL, game servers, MQTT, etc.). The **Redirections** section creates permanent (301) or temporary (302) rules from a domain or path to another URL, without any service needed behind it. The **Advanced tabs** of each proxy host allow injecting raw Nginx configuration when the interface does not cover a particular case (custom security headers, extended `proxy_read_timeout` for long upload requests, etc.).",{"type":86,"title":87,"body":88},"tip","Hardening: rate limiting in the Advanced tab","NPM does not expose a rate limiting control in its base interface, but you can inject the Nginx directive in the Advanced tab of the proxy host concerned. Declare a shared zone in the custom configuration: `limit_req_zone $binary_remote_addr zone=api:10m rate=30r\u002Fm;` then apply it: `limit_req zone=api burst=10 nodelay;`. This limits each IP to 30 requests per minute with a burst of 10, which is enough to cut off scraping or brute-force attempts on a login form without blocking legitimate users.",{"type":31,"title":90,"body":91},"Troubleshooting common errors","Here are the five most frequent problems encountered after an NPM installation, with their direct diagnosis.",{"type":35,"title":93,"items":94},"Common errors and their causes",[95,96,97,98,99],"**502 Bad Gateway**: NPM cannot reach your container. First check that the application container is running (`docker ps`) and that it is on the same Docker network as NPM (`docker network inspect proxy`). Then verify that the Forward Hostname exactly matches the service name declared in the application Compose file.","**SSL certificate pending or ACME error**: Let's Encrypt must be able to reach your server on port 80 via the declared domain. Check that the DNS A record points to the correct IP, that port 80 is not blocked by the VPS firewall or an upstream network filter, and that the domain resolves from outside (`dig app.your-domain.com`).","**Container unreachable via Docker DNS name**: if you target `myapp:3000` and get a resolution error, the myapp container is not on the same network as NPM. Add the proxy network in the application Compose file and recreate the containers (`docker compose up -d --force-recreate`).","**Infinite HTTP to HTTPS redirect loop**: this happens when the application itself performs its own HTTPS redirect on top of NPM. Add in the Advanced tab: `proxy_set_header X-Forwarded-Proto $scheme;` so the application knows the actual protocol.","**Administration interface inaccessible after restart**: make sure the NPM service has the `restart: unless-stopped` directive in your Compose file. Without it, Docker will not restart the container after a VPS reboot.",{"type":101,"title":102,"headers":103,"rows":107},"comparison","Nginx Proxy Manager versus Traefik",[104,105,106],"Criterion","Nginx Proxy Manager","Traefik",[108,112,116,120,124,128,132,136],[109,110,111],"Configuration","Visual web interface, no file to edit","YAML files and Docker labels",[113,114,115],"Learning curve","Low, accessible without Nginx experience","Steeper, DevOps-oriented",[117,118,119],"Let's Encrypt SSL","Automatic via the interface, wildcard possible","Automatic via configuration",[121,122,123],"Service discovery","Manual (container name or IP:port)","Automatic via Docker labels",[125,126,127],"Ideal for","A few manually managed services, clear setup","Dynamic environments with many containers",[129,130,131],"RAM consumption","Very low","Low",[133,134,135],"Logs per host","Viewable in the interface","Via external log stack",[137,138,139],"Access management","Built-in Access Lists (IP, password)","Middlewares to configure",{"type":31,"title":141,"body":142},"When to consider Traefik or Caddy","NPM is perfectly suited for a stable pool of services whose number remains manageable. As soon as you manage dynamic deployments — containers that appear and disappear automatically, as in Kubernetes environments or with CI\u002FCD pipelines that create previews on the fly — Traefik becomes more appropriate: its service discovery via Docker labels avoids returning to the interface for each new container. Caddy is a good alternative if you want file-based configuration simplicity with automatic certificates, without a web interface. In all cases, NPM can coexist with Traefik or Caddy on the same VPS, each managing a portion of the traffic — provided no two proxies occupy the same ports 80 and 443. If your infrastructure grows to the point where you manage several dozen services across different teams, a service mesh (Consul Connect, Linkerd) advantageously replaces a stack of proxies.","Centralize your domains with Nginx Proxy Manager","A ServOrbit Cloud VPS ready with Docker lets you install Nginx Proxy Manager as a single HTTPS entry point and route all your services with automatic SSL.","Choose my Cloud VPS","\u002Fvps-cloud",[148,161,174],{"id":149,"slug":150,"slugs":151,"title":154,"excerpt":155,"readTime":14,"views":15,"isPinned":16,"publishedAt":156,"category":157,"categories":158,"featuredImage":25,"bgImage":26,"posterImage":160,"relatedSolution":25},33,"deploy-your-applications-with-caprover-on-a-vps",{"fr":152,"en":150,"ar":153},"deployer-avec-caprover","انشر-تطبيقاتك-باستخدام-caprover-على-خادم-vps","Deploy your applications with CapRover on a VPS","Complete CapRover guide: installation, captain-definition, GitHub Actions CI\u002FCD, multi-node cluster, backups and troubleshooting 502, build failed and Docker API errors.","2026-05-18T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":21},[159],{"id":19,"name":20,"slug":21,"color":22,"icon":21},"\u002Fblog\u002Fcovers\u002Fdeployer-avec-caprover-poster.svg",{"id":162,"slug":163,"slugs":164,"title":167,"excerpt":168,"readTime":19,"views":15,"isPinned":16,"publishedAt":169,"category":170,"categories":171,"featuredImage":25,"bgImage":26,"posterImage":173,"relatedSolution":25},34,"deploy-your-applications-with-dokku-on-a-vps",{"fr":165,"en":163,"ar":166},"deployer-avec-dokku","انشر-تطبيقاتك-باستخدام-dokku-على-خادم-vps","Deploy your applications with Dokku on a VPS","Deploy your apps with Dokku, the smallest PaaS on the market: git push, Heroku buildpacks and automatic SSL on a lightweight VPS.","2026-05-17T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":21},[172],{"id":19,"name":20,"slug":21,"color":22,"icon":21},"\u002Fblog\u002Fcovers\u002Fdeployer-avec-dokku-poster.svg",{"id":175,"slug":176,"slugs":177,"title":180,"excerpt":181,"readTime":19,"views":15,"isPinned":16,"publishedAt":182,"category":183,"categories":184,"featuredImage":25,"bgImage":26,"posterImage":186,"relatedSolution":187},35,"deploy-your-applications-with-portainer-on-a-vps",{"fr":178,"en":176,"ar":179},"deployer-avec-portainer","انشر-تطبيقاتك-باستخدام-portainer-على-خادم-vps","Deploy your applications with Portainer on a VPS","Manage Docker visually with Portainer on your VPS: containers, stacks, volumes and networks managed from a clear web interface.","2026-05-16T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":21},[185],{"id":19,"name":20,"slug":21,"color":22,"icon":21},"\u002Fblog\u002Fcovers\u002Fdeployer-avec-portainer-poster.svg",{"categorySlug":188,"appSlug":189},"application-deployment-devops","portainer",1787580995545]