11 ms·

NGINX Proxy Manager

81 points by indigodaddy 4y ago

jsisto 4y ago
I prefer to use SWAG. Docker + NGINX + LetsEncrypt + fail2ban https://github.com/linuxserver/docker-swag https://github.com/linuxserver/docker-swag
spindle 4y ago
I happened to need to do this in NixOS yesterday, and look how easy it is: security.acme = { acceptTerms = true; email = "mail@whatever.net"; }; services.nginx = { enable = true; recommendedGzipSettings = true; recommendedOptimisation = true; recommendedProxySettings = true; recommendedTlsSettings = true; virtualHosts."whatever.net" = { default = true; enableACME = true; addSSL = true; locations."/".proxyPass = "http://127.0.0.1:9955/"; }; }; and then each additional proxy takes just one more line. Not quite zero boilerplate, but almost!
- nyolfen 4y ago
  here's my caddy config for a reverse proxy with TLS: sub.domain.com { reverse_proxy localhost:8080 }
  - kuschku 4y ago
    You mean sub.domain.com, sub.domain.com. { reverse_proxy localhost:8080 } ? Because caddy currently doesn’t handle DNS names correctly, so you have to duplicate every single virtual hostname config (it’s a long-standing open bug) [EDIT: Thanks to francislavoie for reminding me about the shorter syntax for this]
    - francislavoie 4y ago
      Actually, we mean: sub.domain.com, sub.domain.com. { reverse_proxy localhost:8080 } But seriously. Can you stop posting about this every single time there's even a vague mention of Caddy on HN? It's tired. You've gotten your answer before. Huge majority of people don't care about trailing dot domains. Trailing dots are complicated and really not worth the complexity it would involve to support them. See https://daniel.haxx.se/blog/2022/05/12/a-tale-of-a-trailing-dot/ https://daniel.haxx.se/blog/2022/05/12/a-tale-of-a-trailing-...
      - kuschku 4y ago
        > Can you stop posting about this every single time there's even a vague mention of Caddy on HN? It's tired It’s a genuine issue I’ve got with Caddy, and if someone recommends Caddy, I’m justified to mention the drawbacks of Caddy. In this case, a user recommended switching from nginx to Caddy, and nginx users (who expect trailing dot domains to just work) should keep this drawback in mind. Every time you compare Caddy or Traefik to nginx or apache, you should expect to also see the drawbacks of Caddy and Traefik mentioned.
        gjs278 4y ago
        mholt 4y ago
        You're not being a productive member of the community. You only complain about Caddy, instead of giving solid technical arguments for your case. We have presented ample evidence, experience, and technical reasoning to support our argument, but you continue to ignore the logical, technical, and complex arguments and instead complain to rack up fake Internet points here. We want to make a better product, but you need to convince us that your way is better than all the evidence, experience, and technical reasons we have already presented.
        kuschku 4y ago
        See that’s exactly the issue. You expect me to do work and spend time just to convince you to be standards-compliant. How can I trust caddy complies with standards in other areas if caddy isn’t willing to follow the standard (which really doesn’t take much work) in this area? It’d be different if the de facto and the de jure standard diverged, as e.g., with IRC, but that’s not the case. nginx, Apache, IIS, Google’s GWS, they all follow the standard exactly, it’s just traefik and caddy that don’t. It’s not an issue of this situation in of itself, it’s an issue of eroding trust. It’s the famous brown m&ms. P.S.: Your arguments explain why implementing this would be a lot of work (keeping the ticket open as known issue is something I’d be fine with), but they can’t justify ignoring the standard and closing it as wontfix.
    - nousermane 4y ago
      Hey, at least caddy does case-insensetive hostname match, so you don't need to repeat the domain 2^12 times </s> Seriously though - that's a pretty bizarre bug, absent from both nginx and apache httpd. And that attitude in sibling comment doesn't help either.
      - kuschku 4y ago
        It’s not just the sibling comment that has this attitude, it’s also mholt himself displaying the same attitude. This hostile opinionated approach is part of what has kept me from using Caddy for the past few years (I went back to nginx at first, and once I started using k8s I also chose nginx as ingress controller there). :/
        nyolfen 4y ago
        i have to say it is pretty weird to persistently complain about software you haven't used for years lol. i have also never used a trailing dot in a domain in 20+ years.
        kuschku 4y ago
        1. Just because I’m not running servers using caddy doesn’t mean I’m not affected by this bug, because some of my clients intentionally always postfix addresses they access with a dot to avoid internal DNS resolution. 2. I’d love to use caddy. I’m especially interested in using it for my status page, as that needs to be hosted outside my normal cluster. Ideally it should be an absolutely minimal setup (so nothing except caddy + status page, with status monitors on other servers reporting back to the status page). This would be the perfect use case for caddy, but right now I’m using an overcomplicated nginx setup because I don’t feel like I can trust caddy.
  - mholt 4y ago
    You don't even need a config file for that! $ caddy reverse-proxy --from sub.domain.com --to localhost:8080 Done :)
- tinco 4y ago
  That's super interesting. Automatic ACME is not a feature in nginx right? So the maintainers of the nginx NixOS package have built this integration themselves just to make NixOS more powerful for this use case?
  - mholt 4y ago
    > Automatic ACME is not a feature in nginx right? Correct. You need separate, less reliable tooling to use ACME with nginx.
    - jphsnsir 4y ago
      How was the Nix experience? Did you try just nix or also NixOS?
      - francislavoie 4y ago
        I think you replied to the wrong comment
        jphsnsir 4y ago
        No, I'd like to know why he called it 'less reliable'. He must have used it on nix(linux) or nix(darwin) or NixOS..
        francislavoie 4y ago
        The comment wasn't about Nix, it was about ACME clients paired with Nginx being less reliable than having the ACME client built into your server (e.g. how Caddy does it). The comment was by Matt Holt, the author of Caddy.
    - kuschku 4y ago
      Doesn’t the built-in tooling only really provide an advantage if you’re using the http or sni challenges? If you want to use wildcard certs via the dns-01 challenge (in my case via rfc2136), the entire challenge runs out of band anyway, so there’s no difference in reliability. (At least in my tests so far, though support for the RFC 2136 standard in caddy and/or plugins is quite poor afaict)
- evol262 4y ago
  This is rapidly becoming a bad joke. "You know how someone does Crossfit/is a vegan?" You know how someone uses NixOS?
  - spindle 4y ago
    Right! I even felt slightly guilty for posting it ... but I posted it anyway because it's useful.
Steltek 4y ago
I previously used Dokku and I loved how the HTTP proxy was "automatic". I've moved past Dokku but don't want the complexity of k8s for a home network. I sort of envisioned a system that could read out running container names and create "$name.$domain" proxy entries automatically. I never got around to it and my current method of automatically generating nginx.conf from a JSON file has a few tricks left, I guess. I guess one additional problem is that I have few things stacked up on a domain and under different "location" entries.
- martontoth 4y ago
  Like traefik? https://doc.traefik.io/traefik/providers/docker/ https://doc.traefik.io/traefik/providers/docker/
  - fuzzy2 4y ago
    While this can be achieved using Traefik, it requires some creative combinations of static + dynamic configuration to get my_container.example.com with HTTPS and HTTP → HTTPS redirects and Let’s Encrypt. The container labels are a PITA. I’m not sure there’s an easier solution though.
    - Shish2k 4y ago
      My setup does all of those things — HTTP->HTTPS redirect and Let’s Encrypt are handled in the global static config: https://gist.github.com/shish/f346a3102f5d690be2f64f6d1eb7d7db https://gist.github.com/shish/f346a3102f5d690be2f64f6d1eb7d7... And then only the per-container settings need to be set in the dynamic config using container labels
      - fuzzy2 4y ago
        Ah, right. In the meantime, they improved the entry point config substantially. When v2 first started, there was no HTTPS redirect and no middleware config to be found on entry points. Never bothered to upgrade my config because it still works.
    - 4y ago
radoomi 4y ago
I used NGINX Proxy Manager for ages for my VPS where I host some side projects. But recently I switched to Caddy Docker Proxy (https://github.com/lucaslorentz/caddy-docker-proxy https://github.com/lucaslorentz/caddy-docker-proxy) and I'm happy with the switch. Seems easier to set it up directly in the docker compose files rather than have an extra interface. I guess you can do more in NPM but for me it's enough.
shockeychap 4y ago
Does anybody know how this compares with other reverse proxies, like Caddy?
- Saris 4y ago
  It's very noob friendly, just click a few things on a nice webUI. But as it's a layer doing a bunch of stuff on top of nginx, letsencrypt, etc.. There's more chance of odd bugs or things not working properly. If you're familiar with Caddy, just keep using that.
Bayart 4y ago
Don't Traefik and Caddy already do exactly that with their official containers ? What makes NGINX Proxy Manager special in that instance ?
- sithadmin 4y ago
  The setup and UI for NGINX Proxy Manager is a lot more noob-friendly than Traefik. Haven't used Caddy before, so can't compare there. If you have the skills to use Traefik, there's no reason to use NGINX Proxy Manager.
- qbasic_forever 4y ago
  This has a little auth system with web UI where you can login in, create users, give them access to certain subdomains, etc. for a simple single sign on experience. Traefik and Caddy just give you the reverse proxy and auth but none of the user management or login UI.
  - francislavoie 4y ago
    As of Caddy v2.5.1, you can easily pair Caddy with Authelia to provide auth for all your services!
- ulkesh 4y ago
  Does Traefik or Caddy have UI-built-in support for Let's Encrypt? If not, then perhaps that makes this special. If so, then probably nothing else except a relatively user-friendly UI.
  - francislavoie 4y ago
    No UI in Caddy, but it's only two lines of config to set up a domain with Automatic HTTPS and a reverse proxy to one of your apps. Don't really need a UI for that.
  - drxzcl 4y ago
    I love traefik, but getting started is kinda rough if you’re not quite technical. There are like three different places to put configuration, and even getting informative error messages out of the thing it’s not exactly trivial. But once it works, it works.
penultimatename 4y ago
I stopped trusting this application when I realized my some of my self hosted services were exposed without authentication, despite the configuration being set. Apparently there had been an bug open for months that authentication didn't work. I accept it's my fault for not re-testing this often, but what a huge issue. It's vanilla Nginx or Caddy from here on out, it's not worth introducing a third-party security risk.
- zrail 4y ago
  Mine just stops renewing certificates so I stopped fighting it. Haven't replaced it with vanilla Nginx yet but that's a project on my todo list.
  - metadat 4y ago
    You might also consider using the fully OSS Traefik for a load balancer and proxy. It arrives to be friendly and approachable. https://github.com/traefik/traefik https://github.com/traefik/traefik
  - jacooper 4y ago
    You can try nginx-proxy, its similar to trafeik but based in nginx and a bit easier. https://github.com/nginx-proxy/nginx-proxy https://github.com/nginx-proxy/nginx-proxy
- KMnO4 4y ago
  I have a bug where every time my server restarts and Nginx Proxy Manager starts up, it gives all my proxy hosts incorrect SSL certificates. In order to get my services working again I have to open NPM, manually open each host, and press edit, and (without making changes), press save. This bug has existed for a year and a half in Github without any response from the developers. As much as I like NPM, I need to move onto something more reliable.
- jonasal 4y ago
  I also prefer to run Nginx as vanilla as possible, but having automatic renewal of certificates is something which is really nice. I looked around at some of the more popular solutions, but didn't like the mounting of the docker socket required by [acme-companion][1], or the lack of bootstrapping capability of [nginx-certbot][2], so I made [something][3] that solved both of those issues. A self contained Docker container that is able to populate the certificate request form what you write in your Nginx configuration files. Please check it out if you have time, and I will gladly take any feedback if you have any! [1]: https://github.com/nginx-proxy/acme-companion https://github.com/nginx-proxy/acme-companion [2]: https://github.com/wmnnd/nginx-certbot https://github.com/wmnnd/nginx-certbot [3]: https://github.com/JonasAlfredsson/docker-nginx-certbot https://github.com/JonasAlfredsson/docker-nginx-certbot
corytheboyd 4y ago
Use this on my home network to expose a couple services to the internet through a domain that I bought, works great. You do end up having to add "custom configuration" which means putting nginx configuration into a textarea without any validation. So far it's just been the occasional service that uses websockets, you need to configure nginx to handle the upgrade. Let's encrypt integration works well enough. It says it persists your Cloudflare api key for DNS validation for cert generation, but it just doesn't or I missed a volume to mount that wasn't called out through the Unraid template for NPM. Yeah sure you could just do this all yourself you smart person you, but on my home server I just... don't want to. I want a collection of dumb GUIs that get me where I want to be, and this did that for my reverse proxy need. If it stops doing that I'll find something else, but that hasn't happened yet.
- ryan29 4y ago
  My `dns_cloudflare_api_token` is in `/data/database.sqlite`.
  - corytheboyd 4y ago
    Thanks, was hoping someone would chime in on that :) I'll take a look at the database later, if I can hack it in I'll be happy, doesn't need to be pretty.
    - donmcronald 4y ago
      Assuming a container name of `nginx`, you can `grep` for it to see if it's already there. docker exec -it nginx \ grep -a 'dns_cloudflare_api_token' /data/database.sqlite
edmcnulty101 4y ago
This is dope. Is there a way to enable caching easily?
- jacooper 4y ago
  Yes, there is an option to enable caching in the UI
nimbius 4y ago
somewhat offtopic but, its sort of surprising to see just how little F5 networks has contributed to the NGINX product since its acquisition compared to the OS community.
deleted 4y ago
[deleted]
inginexsucks 4y ago
Stop building trash heaps with nginx! nginx is a poorly written, legacy application with insane defaults, bad documentation, has shitty frameworks (openresty) and language integrations (fuck js and lua), and owned by a fraudulent company (f5). Why the fuck does anyone use nginx these days? Because they hate themselves?

81 points by indigodaddy 4y ago

I prefer to use SWAG. Docker + NGINX + LetsEncrypt + fail2ban https://github.com/linuxserver/docker-swag https://github.com/linuxserver/docker-swag

spindle 4y ago

I happened to need to do this in NixOS yesterday, and look how easy it is: security.acme = { acceptTerms = true; email = "mail@whatever.net"; }; services.nginx = { enable = true; recommendedGzipSettings = true; recommendedOptimisation = true; recommendedProxySettings = true; recommendedTlsSettings = true; virtualHosts."whatever.net" = { default = true; enableACME = true; addSSL = true; locations."/".proxyPass = "http://127.0.0.1:9955/"; }; }; and then each additional proxy takes just one more line. Not quite zero boilerplate, but almost!

nyolfen 4y ago
here's my caddy config for a reverse proxy with TLS: sub.domain.com { reverse_proxy localhost:8080 }
- kuschku 4y ago
  You mean sub.domain.com, sub.domain.com. { reverse_proxy localhost:8080 } ? Because caddy currently doesn’t handle DNS names correctly, so you have to duplicate every single virtual hostname config (it’s a long-standing open bug) [EDIT: Thanks to francislavoie for reminding me about the shorter syntax for this]
  - francislavoie 4y ago
    Actually, we mean: sub.domain.com, sub.domain.com. { reverse_proxy localhost:8080 } But seriously. Can you stop posting about this every single time there's even a vague mention of Caddy on HN? It's tired. You've gotten your answer before. Huge majority of people don't care about trailing dot domains. Trailing dots are complicated and really not worth the complexity it would involve to support them. See https://daniel.haxx.se/blog/2022/05/12/a-tale-of-a-trailing-dot/ https://daniel.haxx.se/blog/2022/05/12/a-tale-of-a-trailing-...
    - kuschku 4y ago
      > Can you stop posting about this every single time there's even a vague mention of Caddy on HN? It's tired It’s a genuine issue I’ve got with Caddy, and if someone recommends Caddy, I’m justified to mention the drawbacks of Caddy. In this case, a user recommended switching from nginx to Caddy, and nginx users (who expect trailing dot domains to just work) should keep this drawback in mind. Every time you compare Caddy or Traefik to nginx or apache, you should expect to also see the drawbacks of Caddy and Traefik mentioned.
      - gjs278 4y ago
      - mholt 4y ago
        You're not being a productive member of the community. You only complain about Caddy, instead of giving solid technical arguments for your case. We have presented ample evidence, experience, and technical reasoning to support our argument, but you continue to ignore the logical, technical, and complex arguments and instead complain to rack up fake Internet points here. We want to make a better product, but you need to convince us that your way is better than all the evidence, experience, and technical reasons we have already presented.
        kuschku 4y ago
        See that’s exactly the issue. You expect me to do work and spend time just to convince you to be standards-compliant. How can I trust caddy complies with standards in other areas if caddy isn’t willing to follow the standard (which really doesn’t take much work) in this area? It’d be different if the de facto and the de jure standard diverged, as e.g., with IRC, but that’s not the case. nginx, Apache, IIS, Google’s GWS, they all follow the standard exactly, it’s just traefik and caddy that don’t. It’s not an issue of this situation in of itself, it’s an issue of eroding trust. It’s the famous brown m&ms. P.S.: Your arguments explain why implementing this would be a lot of work (keeping the ticket open as known issue is something I’d be fine with), but they can’t justify ignoring the standard and closing it as wontfix.
  - nousermane 4y ago
    Hey, at least caddy does case-insensetive hostname match, so you don't need to repeat the domain 2^12 times </s> Seriously though - that's a pretty bizarre bug, absent from both nginx and apache httpd. And that attitude in sibling comment doesn't help either.
    - kuschku 4y ago
      It’s not just the sibling comment that has this attitude, it’s also mholt himself displaying the same attitude. This hostile opinionated approach is part of what has kept me from using Caddy for the past few years (I went back to nginx at first, and once I started using k8s I also chose nginx as ingress controller there). :/
      - nyolfen 4y ago
        i have to say it is pretty weird to persistently complain about software you haven't used for years lol. i have also never used a trailing dot in a domain in 20+ years.
        kuschku 4y ago
        1. Just because I’m not running servers using caddy doesn’t mean I’m not affected by this bug, because some of my clients intentionally always postfix addresses they access with a dot to avoid internal DNS resolution. 2. I’d love to use caddy. I’m especially interested in using it for my status page, as that needs to be hosted outside my normal cluster. Ideally it should be an absolutely minimal setup (so nothing except caddy + status page, with status monitors on other servers reporting back to the status page). This would be the perfect use case for caddy, but right now I’m using an overcomplicated nginx setup because I don’t feel like I can trust caddy.
- mholt 4y ago
  You don't even need a config file for that! $ caddy reverse-proxy --from sub.domain.com --to localhost:8080 Done :)
tinco 4y ago
That's super interesting. Automatic ACME is not a feature in nginx right? So the maintainers of the nginx NixOS package have built this integration themselves just to make NixOS more powerful for this use case?
- mholt 4y ago
  > Automatic ACME is not a feature in nginx right? Correct. You need separate, less reliable tooling to use ACME with nginx.
  - jphsnsir 4y ago
    How was the Nix experience? Did you try just nix or also NixOS?
    - francislavoie 4y ago
      I think you replied to the wrong comment
      - jphsnsir 4y ago
        No, I'd like to know why he called it 'less reliable'. He must have used it on nix(linux) or nix(darwin) or NixOS..
        francislavoie 4y ago
        The comment wasn't about Nix, it was about ACME clients paired with Nginx being less reliable than having the ACME client built into your server (e.g. how Caddy does it). The comment was by Matt Holt, the author of Caddy.
  - kuschku 4y ago
    Doesn’t the built-in tooling only really provide an advantage if you’re using the http or sni challenges? If you want to use wildcard certs via the dns-01 challenge (in my case via rfc2136), the entire challenge runs out of band anyway, so there’s no difference in reliability. (At least in my tests so far, though support for the RFC 2136 standard in caddy and/or plugins is quite poor afaict)
evol262 4y ago
This is rapidly becoming a bad joke. "You know how someone does Crossfit/is a vegan?" You know how someone uses NixOS?
- spindle 4y ago
  Right! I even felt slightly guilty for posting it ... but I posted it anyway because it's useful.

Steltek 4y ago

I previously used Dokku and I loved how the HTTP proxy was "automatic". I've moved past Dokku but don't want the complexity of k8s for a home network. I sort of envisioned a system that could read out running container names and create "$name.$domain" proxy entries automatically. I never got around to it and my current method of automatically generating nginx.conf from a JSON file has a few tricks left, I guess. I guess one additional problem is that I have few things stacked up on a domain and under different "location" entries.

martontoth 4y ago
Like traefik? https://doc.traefik.io/traefik/providers/docker/ https://doc.traefik.io/traefik/providers/docker/
- fuzzy2 4y ago
  While this can be achieved using Traefik, it requires some creative combinations of static + dynamic configuration to get my_container.example.com with HTTPS and HTTP → HTTPS redirects and Let’s Encrypt. The container labels are a PITA. I’m not sure there’s an easier solution though.
  - Shish2k 4y ago
    My setup does all of those things — HTTP->HTTPS redirect and Let’s Encrypt are handled in the global static config: https://gist.github.com/shish/f346a3102f5d690be2f64f6d1eb7d7db https://gist.github.com/shish/f346a3102f5d690be2f64f6d1eb7d7... And then only the per-container settings need to be set in the dynamic config using container labels
    - fuzzy2 4y ago
      Ah, right. In the meantime, they improved the entry point config substantially. When v2 first started, there was no HTTPS redirect and no middleware config to be found on entry points. Never bothered to upgrade my config because it still works.
  - 4y ago

radoomi 4y ago

I used NGINX Proxy Manager for ages for my VPS where I host some side projects. But recently I switched to Caddy Docker Proxy (https://github.com/lucaslorentz/caddy-docker-proxy https://github.com/lucaslorentz/caddy-docker-proxy) and I'm happy with the switch. Seems easier to set it up directly in the docker compose files rather than have an extra interface. I guess you can do more in NPM but for me it's enough.

shockeychap 4y ago

Does anybody know how this compares with other reverse proxies, like Caddy?

Saris 4y ago
It's very noob friendly, just click a few things on a nice webUI. But as it's a layer doing a bunch of stuff on top of nginx, letsencrypt, etc.. There's more chance of odd bugs or things not working properly. If you're familiar with Caddy, just keep using that.

Bayart 4y ago

Don't Traefik and Caddy already do exactly that with their official containers ? What makes NGINX Proxy Manager special in that instance ?

sithadmin 4y ago
The setup and UI for NGINX Proxy Manager is a lot more noob-friendly than Traefik. Haven't used Caddy before, so can't compare there. If you have the skills to use Traefik, there's no reason to use NGINX Proxy Manager.
qbasic_forever 4y ago
This has a little auth system with web UI where you can login in, create users, give them access to certain subdomains, etc. for a simple single sign on experience. Traefik and Caddy just give you the reverse proxy and auth but none of the user management or login UI.
- francislavoie 4y ago
  As of Caddy v2.5.1, you can easily pair Caddy with Authelia to provide auth for all your services!
ulkesh 4y ago
Does Traefik or Caddy have UI-built-in support for Let's Encrypt? If not, then perhaps that makes this special. If so, then probably nothing else except a relatively user-friendly UI.
- francislavoie 4y ago
  No UI in Caddy, but it's only two lines of config to set up a domain with Automatic HTTPS and a reverse proxy to one of your apps. Don't really need a UI for that.
- drxzcl 4y ago
  I love traefik, but getting started is kinda rough if you’re not quite technical. There are like three different places to put configuration, and even getting informative error messages out of the thing it’s not exactly trivial. But once it works, it works.

penultimatename 4y ago

I stopped trusting this application when I realized my some of my self hosted services were exposed without authentication, despite the configuration being set. Apparently there had been an bug open for months that authentication didn't work. I accept it's my fault for not re-testing this often, but what a huge issue. It's vanilla Nginx or Caddy from here on out, it's not worth introducing a third-party security risk.

zrail 4y ago
Mine just stops renewing certificates so I stopped fighting it. Haven't replaced it with vanilla Nginx yet but that's a project on my todo list.
- metadat 4y ago
  You might also consider using the fully OSS Traefik for a load balancer and proxy. It arrives to be friendly and approachable. https://github.com/traefik/traefik https://github.com/traefik/traefik
- jacooper 4y ago
  You can try nginx-proxy, its similar to trafeik but based in nginx and a bit easier. https://github.com/nginx-proxy/nginx-proxy https://github.com/nginx-proxy/nginx-proxy
KMnO4 4y ago
I have a bug where every time my server restarts and Nginx Proxy Manager starts up, it gives all my proxy hosts incorrect SSL certificates. In order to get my services working again I have to open NPM, manually open each host, and press edit, and (without making changes), press save. This bug has existed for a year and a half in Github without any response from the developers. As much as I like NPM, I need to move onto something more reliable.
jonasal 4y ago
I also prefer to run Nginx as vanilla as possible, but having automatic renewal of certificates is something which is really nice. I looked around at some of the more popular solutions, but didn't like the mounting of the docker socket required by [acme-companion][1], or the lack of bootstrapping capability of [nginx-certbot][2], so I made [something][3] that solved both of those issues. A self contained Docker container that is able to populate the certificate request form what you write in your Nginx configuration files. Please check it out if you have time, and I will gladly take any feedback if you have any! [1]: https://github.com/nginx-proxy/acme-companion https://github.com/nginx-proxy/acme-companion [2]: https://github.com/wmnnd/nginx-certbot https://github.com/wmnnd/nginx-certbot [3]: https://github.com/JonasAlfredsson/docker-nginx-certbot https://github.com/JonasAlfredsson/docker-nginx-certbot

corytheboyd 4y ago

Use this on my home network to expose a couple services to the internet through a domain that I bought, works great. You do end up having to add "custom configuration" which means putting nginx configuration into a textarea without any validation. So far it's just been the occasional service that uses websockets, you need to configure nginx to handle the upgrade. Let's encrypt integration works well enough. It says it persists your Cloudflare api key for DNS validation for cert generation, but it just doesn't or I missed a volume to mount that wasn't called out through the Unraid template for NPM. Yeah sure you could just do this all yourself you smart person you, but on my home server I just... don't want to. I want a collection of dumb GUIs that get me where I want to be, and this did that for my reverse proxy need. If it stops doing that I'll find something else, but that hasn't happened yet.

ryan29 4y ago
My `dns_cloudflare_api_token` is in `/data/database.sqlite`.
- corytheboyd 4y ago
  Thanks, was hoping someone would chime in on that :) I'll take a look at the database later, if I can hack it in I'll be happy, doesn't need to be pretty.
  - donmcronald 4y ago
    Assuming a container name of `nginx`, you can `grep` for it to see if it's already there. docker exec -it nginx \ grep -a 'dns_cloudflare_api_token' /data/database.sqlite

edmcnulty101 4y ago

This is dope. Is there a way to enable caching easily?

jacooper 4y ago
Yes, there is an option to enable caching in the UI

nimbius 4y ago

somewhat offtopic but, its sort of surprising to see just how little F5 networks has contributed to the NGINX product since its acquisition compared to the OS community.

deleted 4y ago

[deleted]

inginexsucks 4y ago

Stop building trash heaps with nginx! nginx is a poorly written, legacy application with insane defaults, bad documentation, has shitty frameworks (openresty) and language integrations (fuck js and lua), and owned by a fraudulent company (f5). Why the fuck does anyone use nginx these days? Because they hate themselves?