Install Nginx Proxy Manager with Docker Compose and Let's Encrypt on Ubuntu

If you are running multiple apps on a single VPS and need a way to route traffic to each one with HTTPS, Nginx proxy manager Docker Compose is one of the easiest setups you can do. Instead of writing Nginx config files or dealing with Certbot manually, Nginx Proxy Manager (NPM) gives you a simple web dashboard where you can add proxy hosts, request free SSL certificates from Let's Encrypt, and manage everything in a browser.

Nginx Proxy Manager is a free tool that wraps Nginx inside a friendly web GUI. It handles reverse proxy configuration, free SSL certificate generation via Let's Encrypt, redirects, access lists, and more, all without touching a single config file.

It is a great choice if you want:

• A GUI-based reverse proxy you can manage without SSH every time.
• Automatic Let's Encrypt SSL certificates with zero manual renewal.
• A beginner-friendly alternative to Traefik or Caddy for single-server setups.
• Support for WebSocket-based apps like Nextcloud, Vaultwarden, and Home Assistant.

Compared to Traefik or Caddy, NPM is the easiest option. Traefik has better Docker auto-discovery via labels. Caddy has simpler config files. For most self-hosted single-server setups, NPM is the best starting point. If you prefer a label-driven approach, you can check out our guide on setting up Traefik with Docker Compose.

Before you start, make sure you have the following ready:

• A fresh Ubuntu 22.04 or 24.04 VPS.
• Root or sudo access.
• Docker and Docker Compose are installed.
• A domain name with DNS access.
• Ports 80, 81, and 443 are not in use by another service.
• Your server's public IP address is ready.

First, update your system and install the required packages:

Add Docker's official GPG key and repository:

Now install Docker Engine and the Compose plugin:

Verify Docker is running:

To run Docker without sudo, add the user to the Docker group:

Before you deploy anything, your domain needs to point to your server. Log in to your DNS provider and create an A record for each subdomain you plan to use:

DNS changes can take a few minutes to a few hours to propagate. You can check with:

It should return your server's IP. Let's Encrypt will fail to issue a certificate if DNS is not pointing to your server at the time of the request.

If UFW is active on your server, you need to allow the three ports that Nginx proxy manager Docker Compose uses:

Security note: Port 81 (the admin UI) should not be opened in the firewall. You will access it via an SSH tunnel or restrict it to 127.0.0.1 in the Compose file. Exposing it to the internet is a security risk.

Check the firewall status:

At this point, you must create a dedicated directory for NPM and move into it:

Create the Nginx proxy manager Docker Compose YAML file:

Paste the following configuration:

• image: jc21/nginx-proxy-manager:latest: pulls the official NPM image
• restart: unless-stopped: NPM restarts automatically after a reboot.
• 80:80 and 443:443: public HTTP and HTTPS ports.
• 127.0.0.1:81:81: binds the admin UI to localhost only, keeping it off the internet.
• ./data:/data and ./letsencrypt:/etc/letsencrypt: persistent storage so your config and certs survive container updates.

Now bring up the container in detached mode:

Check that it is running:

You should see the container status as Up.

The Nginx proxy manager Docker Compose setup uses port 81 for the admin interface. Since it is bound to 127.0.0.1, you must open an SSH tunnel from your local machine:

Then open your browser and go to:

Create your admin account:

This is the core feature of the Nginx proxy manager Docker Compose setup. A proxy host tells NPM where to forward incoming traffic for a given domain.

Once you access the NPM dashboard, click Hosts > Proxy Hosts and click Add Proxy Host.

Fill in the Details tab with:

Finding the Docker bridge IP if your app runs in another container:

Or, if your app is on the same Docker network as NPM, use the container service name directly as the hostname.

Now switch to the SSL tab:

• SSL Certificate > select Request a new SSL Certificate.
• Enable Force SSL to redirect HTTP to HTTPS automatically.
• Enable HTTP/2 Support.
• Enable HSTS, optional but recommended.
• Click Save.

NPM will reach out to Let's Encrypt, complete the HTTP-01 challenge, and install the certificate automatically. This usually takes about 10 to 30 seconds.

Certificates renew automatically. Let's Encrypt certificates expire every 90 days, but NPM renews them without any cron jobs or manual steps needed.

The best way to use the Nginx proxy manager Docker Compose stack is to put NPM and your apps on a shared Docker network. This lets you use container names as hostnames instead of IP addresses.

Update your NPM Docker Compose YAML file:

And in your app's docker-compose.yml, attach it to the same network:

Now in NPM's proxy host, set Forward Hostname / IP to myapp, and it resolves directly via Docker DNS.

Keeping Nginx proxy manager Docker Compose up to date is easy. To do this, you can use the commands below:

Your configuration, proxy hosts, and certificates are stored in the ./data and ./letsencrypt volumes and survive updates.

To back up your NPM data, you can use:

For the official documentation and latest Docker image tags, you can visit the Nginx Proxy Manager official documentation.

The Nginx proxy manager Docker Compose combination is one of the fastest ways to get a reverse proxy running on a Linux VPS. You get a GUI, automatic Let's Encrypt SSL, and persistent storage, all without touching a single Nginx config file. Whether you are self-hosting a few small apps or building a full stack, this setup handles it well and stays easy to manage as you grow.

For anything more complex, like label-based auto-discovery or multi-server setups, you can always migrate to Traefik later.

If you need a fresh Linux VPS for your reverse proxy and app stack, you can start with a PerLod Linux VPS.