Nginx Proxy Manager Workflow

Use this skill to terminate SSL at NPM and route traffic to backend services (staging/prod).

Required inputs

• - Domain/subdomain (e.g. staging.example.com)
• Public DNS already pointing to NPM public IP
• Upstream target host/IP + port (e.g. 10.10.10.227:3000)
• Whether Cloudflare proxy is enabled (if used)

Authentication (do not hardcode secrets)

Store credentials outside this skill (local secret file or environment variables).

Recommended env vars:

• - NPM_BASE_URL (e.g. http://<npm-host>:81)
• INLINECODE4
• INLINECODE5

Example token request:

CODEBLOCK0

Standard setup flow

1. 1. Confirm DNS resolves to NPM public IP.
2. Create or update Proxy Host in NPM:

- Domain Names: requested host(s) - Scheme: http (or https if upstream is TLS) - Forward Hostname/IP: upstream IP/hostname - Forward Port: app port - Enable: - Block Common Exploits - Websockets Support

1. 3. SSL tab:

- Request new SSL certificate (Let's Encrypt) - Enable Force SSL - Enable HTTP/2 Support - Enable HSTS only after validation

1. 4. Save and verify:

- curl -I https://<domain> returns 200/301 - Browser check for valid certificate and app reachability

Recommended defaults

• - Keep upstream as private IP where possible.
• Use separate hostnames per environment:

- app.example.com → production - staging.example.com → staging

• - Avoid wildcard certificates unless explicitly needed.

Troubleshooting

• - Certificate issuance fails:

- Check DNS A/AAAA records - Ensure ports 80/443 reach NPM - Disable conflicting CDN TLS mode or set to Full/Strict appropriately

• - 502 Bad Gateway:

- Verify upstream container/service is running - Verify correct target port and local firewall rules

• - Redirect loops:

- Don’t double-force HTTPS (app + proxy misconfiguration)

Publication hygiene checklist

Before sharing/publishing this skill:

• - Remove all real IPs, domains, emails, and tokens.
• Keep only placeholders like example.com and <npm-host>.
• Ensure no local credential file paths or secret values are included.

Safety rules

• - Never remove existing production proxy hosts unless explicitly requested.
• For changes on production domains, snapshot/export config or document previous values first.
• Apply changes to staging first when possible.