Nginx Proxy Manager

Reverse proxy with SSL management.

Overview

Property	Value
Host	192.168.1.10 (LXC 103)
Type	Docker on LXC (Proxmox)
Admin Port	81
HTTP	80
HTTPS	443
Primary Domain	shdwnet.cloud

Access

• Admin UI: http://192.168.1.10:81
• Credentials: See vault

---

✅ Active Proxy Hosts (2026-02-03)

All services migrated to shdwnet.cloud domain with Let’s Encrypt SSL.

Domain	Target	Port	Scheme	SSL	Notes
notes.shdwnet.cloud	192.168.1.156	3030	http	✅	Quartz notes (PM2)
plex.shdwnet.cloud	192.168.1.156	32400	http	✅	Plex Media Server
paperless.shdwnet.cloud	192.168.1.156	8000	http	✅	Paperless-ngx
vault.shdwnet.cloud	192.168.1.20	443	https	✅	Vaultwarden
uptime.shdwnet.cloud	192.168.1.20	3001	http	✅	Uptime Kuma
pulse.shdwnet.cloud	192.168.1.20	3001	http	✅	Alias → Uptime Kuma
portainer.shdwnet.cloud	192.168.1.20	9443	https	✅	Portainer
netdata.shdwnet.cloud	76.13.115.76	19998	http	✅	VPS monitoring (basic auth)

---

SSL Certificates

All certs via Let’s Encrypt, auto-renewal enabled.

Certificate	Domains	Expires
notes.shdwnet.cloud	notes.shdwnet.cloud	2026-05-04
plex.shdwnet.cloud	plex.shdwnet.cloud	2026-05-04
paperless.shdwnet.cloud	paperless.shdwnet.cloud	2026-05-04
vault.shdwnet.cloud	vault.shdwnet.cloud	2026-05-04
uptime.shdwnet.cloud	uptime.shdwnet.cloud, pulse.shdwnet.cloud	2026-05-04
portainer.shdwnet.cloud	portainer.shdwnet.cloud	2026-05-04
netdata.shdwnet.cloud	netdata.shdwnet.cloud	2026-05-04

---

Architecture

Internet (Cloudflare DNS)
    │
    │  *.shdwnet.cloud → WAN IP (wildcard A record)
    ▼
┌─────────────────────────────────────────────────────────────┐
│                    Router (Port Forward)                     │
│                    80/443 → 192.168.1.10                    │
└─────────────────────────────────────────────────────────────┘
    │
    ▼
┌─────────────────────────────────────────────────────────────┐
│              NPM (192.168.1.10) - LXC 103                   │
│                                                              │
│  ┌────────────────────────────────────────────────────────┐ │
│  │              SSL Termination (Let's Encrypt)           │ │
│  └────────────────────────────────────────────────────────┘ │
│                            │                                 │
│         ┌──────────────────┼──────────────────┐             │
│         ▼                  ▼                  ▼             │
│  ┌─────────────┐    ┌─────────────┐    ┌─────────────┐     │
│  │  pop-os     │    │  docker1    │    │    VPS      │     │
│  │ .156        │    │ .20         │    │ 76.13...    │     │
│  │             │    │             │    │             │     │
│  │ • notes:3030│    │ • vault:443 │    │ • netdata   │     │
│  │ • plex:32400│    │ • uptime:3001    │   :19998    │     │
│  │ • paper:8000│    │ • port:9443 │    │             │     │
│  └─────────────┘    └─────────────┘    └─────────────┘     │
└─────────────────────────────────────────────────────────────┘

---

Adding New Proxy Host

1. Login to NPM admin: http://192.168.1.10:81
2. Proxy Hosts → Add Proxy Host
3. Details Tab:
   • Domain Names: service.shdwnet.cloud
   • Scheme: http (or https if backend uses SSL)
   • Forward Hostname/IP: target IP
   • Forward Port: target port
   • ✅ Block Common Exploits
   • ✅ Websockets Support (if needed)
4. SSL Tab:
   • Request new SSL Certificate
   • ✅ Force SSL
   • ✅ HTTP/2 Support
   • Email: your@email.com

---

API Access

NPM has a REST API for automation:

# Get token
curl -X POST "http://192.168.1.10:81/api/tokens" \
  -H "Content-Type: application/json" \
  -d '{"identity":"email","secret":"password"}'
 
# List proxy hosts
curl "http://192.168.1.10:81/api/nginx/proxy-hosts" \
  -H "Authorization: Bearer $TOKEN"

---

Related

• Network Overview
• Split-Horizon DNS
• Pi-hole DNS