jrandombytes/nginx-proxy-manager repository overview

⁠jrandombytes/nginx-proxy-manager

⁠What is this?

Nginx Proxy Manager is a self-hosted reverse proxy with a web UI that just works. Route your domains to your services, get automatic SSL, and never write an nginx config file again.

If you're running multiple services on your own server — whether that's a homelab, a VPS, or an on-premise machine — this is the missing piece that ties everything together.

⁠Who it's for

• Developers hosting multiple Docker containers on a single server
• Homelab enthusiasts who want real domains and real SSL on their self-hosted apps
• Small teams managing internal tools without a dedicated ops person
• Anyone tired of remembering which service runs on which port

⁠Why it works

No config files. Add a proxy host, point it at a service or container, and you're done. What used to take hours of nginx editing takes under a minute.

Docker-friendly out of the box. Running ten containers on ten different ports? Map each one to a clean subdomain — app.yourdomain.com instead of yourdomain.com:8080. No port juggling, no awkward URLs.

SSL that manages itself. Let's Encrypt certificates are issued and renewed automatically. Set it up once, forget about it.

More than just HTTP. Proxy TCP and UDP streams alongside your web services — all from the same interface.

Runs anywhere, depends on nothing. Fully self-hosted, air-gap capable, no cloud account required. Your infrastructure stays yours.

Grows with you. When you need it — access lists, basic auth, rate limiting, custom nginx directives — it's all there.

⁠Best paired with Cloudflare

Nginx Proxy Manager handles routing and SSL at your server. Cloudflare's free tier covers everything in front of it — DDoS protection, CDN, edge caching, and a basic WAF — with no extra cost or complexity.

Together, they give you a production-grade stack that punches well above its weight:

• Cloudflare — protects and accelerates traffic before it reaches your server
• Nginx Proxy Manager — routes that traffic to the right service once it arrives

Neither replaces the other. They do different jobs, and they do them well together.

⁠When it makes sense

⁠Why this fork?

The official image (jc21/nginx-proxy-manager) bundles OpenResty and depends on upstream for CVE patches — which can lag weeks or months behind disclosure. This fork owns the entire chain from nginx.org apt → base image → app image, so CVEs can be patched the same day they are disclosed.

⁠Key differences from the official image

⁠Quick start

services:
  npm:
    image: jrandombytes/nginx-proxy-manager:latest
    restart: unless-stopped
    ports:
      - "80:80"
      - "81:81"
      - "443:443"
    volumes:
      - npm_data:/data
      - npm_letsencrypt:/etc/letsencrypt
    environment:
      PUID: 1000
      PGID: 1000

volumes:
  npm_data:
  npm_letsencrypt:

Access the admin UI at http://<your-server>:81

⁠Environment variables

⁠Database backends

SQLite is the default. MySQL/MariaDB and PostgreSQL are also supported via environment variables.

⁠Ports

⁠Security fixes in this fork

• CVE-2026-42945 (NGINX Rift, CVSS 9.2) — nginx ≤ 1.30.0 heap overflow RCE in rewrite module. Own base image uses nginx 1.31.0 mainline.
• CVE-2025-6965 (SQLite < 3.50.2) — Memory corruption. better-sqlite3 upgraded to bundle SQLite 3.52.0.
• Timing oracle — Login always runs bcrypt even for unknown users, preventing email enumeration.
• Shell escape RCE — DNS provider credentials correctly escaped with POSIX '\'' idiom.
• Schema injection — Pattern constraints on user-supplied fields prevent nginx config injection.
• Per-host rate limiting — limit_req_zone / limit_req with UI controls (rate req/s, burst, nodelay).
• Cloudflare Turnstile — Opt-in bot protection on the login page (Settings UI). Includes secret key redaction, nonce replay protection, and CSP headers for the widget.
• Login + 2FA rate limiting — express-rate-limit on /api/tokens (10 failed/15 min) and /api/tokens/2fa (10/5 min).
• Cloudflare IP restriction — Global toggle (Settings UI) that silently drops (return 444) any proxy host request not from a Cloudflare edge IP. Protects origins from bypass attacks when all traffic flows through Cloudflare.
• Session token security — JWT is no longer stored in window.localStorage. Any XSS in the official image yields a full session token via localStorage.getItem("authentications") — no further exploit needed, ~24 h access. This fork moves the token to an HttpOnly + SameSite=Strict cookie (npm_session) that JavaScript cannot read. A CSRF double-submit token (npm_csrf) prevents cross-site request forgery now that the credential is cookie-bound. Token rotated on login, 2FA, impersonation, and logout; preserved on 5-minute refresh to avoid in-flight 403 races. Bearer Authorization header still accepted for API clients and CI pipelines. Set FORCE_SECURE_COOKIES=true when the admin UI is behind a TLS-terminating edge (e.g. Cloudflare).
• Per-host log viewer (admin-only) — Triage 5xx and unexpected 4xx responses from the admin UI without SSHing into the container. New "Logs" tab on the proxy-host, dead-host, and redirection-host modals shows the tail of /data/logs/{type}-{id}_{access,error}.log via a bounded seek-from-end reader (256 KiB chunk, 1000-line max). Hidden from non-admin users. Every read is audit-logged. Path-traversal proof — host_type is on a closed allow-list, id is asserted positive integer, stream is access|error only.
• Logrotate enforcement — The base image ships /etc/logrotate.d/nginx-proxy-manager but the container has no cron daemon, so it never fired upstream. This fork adds an s6 longrun service that runs logrotate /etc/logrotate.conf every LOGROTATE_INTERVAL (default 86400 = 24 h). Access logs rotate weekly × 4, error logs weekly × 10, both compressed.
• TLS — ssl_prefer_server_ciphers on; TLS 1.2+ only.

⁠Source

• This fork (GitHub): https://github.com/jrandombytes/nginx-proxy-manager⁠
• Docker Hub: https://hub.docker.com/r/jrandombytes/nginx-proxy-manager⁠
• Upstream: https://github.com/NginxProxyManager/nginx-proxy-manager⁠