Nginx Proxy Manager(NPM) 當 Revers Proxy Server(Docker)

環境 : 在 Alpine Linux 3 底下安裝 docker + docker-compose

安裝的主機 IP : 192.168.11.231

編輯 yml 檔案

vi docker-compose.yml

services:
  nginx-proxy-manager:
    image: jc21/nginx-proxy-manager:latest
    container_name: nginx-proxy-manager
    restart: always
    ports:
      - '80:80'
      - '81:81'
      - '443:443'
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

  goaccess:
    image: xavierh/goaccess-for-nginxproxymanager:latest
    container_name: goaccess
    restart: always
    ports:
      - '7880:7880'
    environment:
      - TZ=Asia/Taipei
      - SKIP_ARCHIVED_LOGS=False #optional
      - DEBUG=False #optional
      - BASIC_AUTH=False #optional
      - BASIC_AUTH_USERNAME=user #optional
      - BASIC_AUTH_PASSWORD=pass #optional
      - EXCLUDE_IPS=127.0.0.1 #optional - comma delimited
      - LOG_TYPE=NPM #optional - more information below
      - ENABLE_BROWSERS_LIST=True #optional - more information below
      - CUSTOM_BROWSERS=Kuma:Uptime,TestBrowser:Crawler #optional - comma delimited, more information below
      - HTML_REFRESH=5 #optional - Refresh the HTML report every X seconds. https://goaccess.io/man
      - KEEP_LAST=30 #optional - Keep the last specified number of days in storage. https://goaccess.io/man
    volumes:
      - ./data/logs:/opt/log

  watchtower:
    image: nickfedor/watchtower
    container_name: watchtower
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - TZ=Asia/Taipei
      - WATCHTOWER_SCHEDULE=0 0 4 * * *
      - WATCHTOWER_CLEANUP=true
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    restart: unless-stopped

啟動服務

docker compose up -d

http://192.168.11.231:81 (預設帳號密碼 : [email protected] / changeme)

登入後會要求更改與設定 Administrator 的帳號密碼

只要執行以下命令就可以直接更版

docker compose pull && docker compose up -d

查看啟動過程 Logs

docker compose logs -f

參考 - https://github.com/NginxProxyManager/nginx-proxy-manager/issues/811

編輯 Proxy Host → Advanced → Custom Nginx Configuration 加入

real_ip_header CF-Connecting-IP;

即可

Proxy Host 是 NextCloud 要提供檔案下載時發現預設下載檔案大小限制為 1GB

參考 - https://rodrigolmti.medium.com/nextcloud-with-portainer-nginx-proxy-manager-63df45d62a0b

另外 NextCloud/all-in-one 會開啟 TRACE and TRACK method, 會造成主機弱點, 也順便設定關閉

編輯 Proxy Host → Advanced → Custom Nginx Configuration 加入

client_body_buffer_size 512k;
proxy_read_timeout 86400s;
client_max_body_size 0;
if ($request_method !~ ^(GET|HEAD|POST|PUT|DELETE|CONNECT|OPTIONS)$) {
    return 405;
}

參考 - https://github.com/NginxProxyManager/nginx-proxy-manager/discussions/1634

可使用 goaccess-for-nginxproxymanager 當簡易分析方案

安裝方式可參考 用 goaccess 分析 Nginx Proxy Manager(NPM) 紀錄檔

參考 - https://nginxproxymanager.com/advanced-config/#docker-file-secrets

無 IPv6 的環境啟動時 log 內會出現類似以下的錯誤訊息

:
app-1  | ❯ Starting nginx ...
app-1  | nginx: [emerg] socket() [::]:80 failed (97: Address family not supported by protocol)
app-1  | ❯ Starting nginx ...
app-1  | nginx: [emerg] socket() [::]:80 failed (97: Address family not supported by protocol)
:

只要在 docker-compose.yml 內的環境變數加上 DISABLE_IPV6=true 即可 Exp.

version: '3'
services:
  app:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '80:80'
      - '81:81'
      - '443:443'
    environment:
      - DISABLE_IPV6=true
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

參考 - https://github.com/NginxProxyManager/nginx-proxy-manager/issues/3474

log 出現 - Cannot install certbot-dns-cloudflare==4.0.0 and cloudflare==4.0.*

參考 - https://github.com/NginxProxyManager/nginx-proxy-manager/issues/4606

因為 Web UI 只能針對 SSL Certificates 新增或刪除, 如果想了解之前設定的相關內容, 只能進入 sqlite 內查看

進入 data 目錄應該可以看到 database.sqlite

使用 sqlite3 進入查詢

~/nginx-proxy-manager/data# sqlite3 database.sqlite
SQLite version 3.49.2 2025-05-07 10:39:52
sqlite> select * from certificate;
1|2024-01-25 12:55:03|2025-10-04 09:16:37|1|0|letsencrypt|*.my.ichiayi.com|["*.my.ichiayi.com"]|2026-01-02 08:18:47|{"letsencrypt_email":"[email protected]","dns_challenge":true,"dns_provider":"cloudflare","dns_provider_credentials":"# Cloudflare API token\r\ndns_cloudflare_api_token = xO************************************06","letsencrypt_agree":true}

如果有興趣了解整個資料庫結構可以下 .fullschema 查看

sqlite> .fullschema
CREATE TABLE `knex_migrations` (`id` integer not null primary key autoincrement, `name` varchar(255), `batch` integer, `migration_time` datetime);
CREATE TABLE `knex_migrations_lock` (`index` integer not null primary key autoincrement, `is_locked` integer);
CREATE TABLE `migrations` (`id` integer not null primary key autoincrement, `name` varchar(255), `batch` integer, `migration_time` datetime);
:
CREATE TABLE `access_list_client` (`id` integer not null primary key autoincrement, `created_on` datetime not null, `modified_on` datetime not null, `access_list_id` integer not null, `address` varchar(255) not null, `directive` varchar(255) not null, `meta` json not null);
/* No STAT tables available */

https://nginxproxymanager.com/guide/#features