Nginx Proxy Manager

[Amras2322]

⚠️ Please verify that this bug has NOT been raised before.

• I checked and didn't find similar issue

🛡️ Security Policy

• I agree to have read this project Security Policy

📝 Describe your problem

I'm trying to set up Nginx Proxy Manager (NPM) in Dockge so that I can access my services (Immich, Vaultwarden, etc) remotely and securely. Here's my compose file for NPM:

 nginx-reverse-proxy:
    restart: always
    image: docker.io/jc21/nginx-proxy-manager:latest
    container_name: nginx-reverse-proxy
    volumes:
      - /docker/appdata/npm/data:/data
      - /docker/appdata/npm/letsencrypt:/etc/letsencrypt
    ports:
      - 443:443 # Public HTTPS Port
      - 80:80
      - 81:81 # Admin Web Port

My issue is, this stack cannot see containers in other stacks. I can solve this by setting its network mode to host, but when I do I can no longer access the admin web port (gives a warning that network mode: host overrides the port)
OR
I can add each other stack as an external network, like so:

    networks:
      - dockge_default
      - immich_immich-network
      - n8n_default
      - nut_default
      - vaultwarden_default

I thought this solution was working great, but then as I added my hosts I found I'm unable to access Vaultwarden this way, even though I'm setting things up both in NPM and my Cloudflare DNS settings the same way. I understand this may be a Vaultwarden issue, so I'll post this there as well, I just wanted to check if there's a better/recommended way to set up NPM to play more nicely with the other stacks in Dockge.

📝 Error Message(s) or Log

No response

🐻 Dockge Version

1.4.2

💻 Operating System and Arch

Ubuntu noble 24.04 x86_64

🌐 Browser

Firefox

🐋 Docker Version

Docker version 27.3.1, build ce12230

🟩 NodeJS Version

No response

[mizady]

This is not a bug, this is a configuration issue and not related to dockge. That being said, npm should be connected to a network listed as external, it should be created outside of the stack so it will exist whether the stack is up or not. You then need to also connect to that same network, lets call it "frontend" as i've seen many people label it. You then need to make sure that any container you want to route to it is also part of that same external network. Here is the docker documentation that may help with this. https://docs.docker.com/compose/how-tos/networking/#specify-custom-networks

[Amras2322]

Thank you! I don't believe I listed it as a bug, but as a help request. The "Verify that this bug has not been raised before" is added automatically. It was intended as a request for help with configuration, so I'm glad you agree!

As for adding external networks, I mentioned in my reqest that I've tried that, and it works for /most/ containers, but is finicky with others and it seems like a weird inconsistency. I'll try creating a new "frontend" network as you mentioned and see if that resolves the issue. Would it really make that much of a difference? An isolated external network vs the networks that are created when you create a stack in dockge? They seem like functionally the same thing to my mind, so if there's something differentiating them I'd love to learn!

[mizady]

creating it separately keeps the network independent of a stack, so that if you down a stack then the network is not removed, which could cause issues having multiple containers across multiple stacks if that was not the case. i'll post my nginx proxy manager compose file and the command used to create the network that it connects to. it maybe of help. specifying the name under the network is not needed but i find it comforts my preference for things to be explicit at times. I use vault warden as well through npm and i use https as the scheme using the certificates created by npm (or rather retrieved from letsencrypt by npm). i'll include my vaultwarden compose as well, though its externally accessible so i don't use an internet network to reach it, the lldapnet is used for lldap and Authelia to provide authentication and authorization while keeping lldap in a bridge network and not externally accessible. I did remove environment variables and clean the vault compose so i wouldn't just copy and paste it. In my case I manually move the new certificates in place as I wanted to decouple the two, but that's due to this being a temporary setup.

Assuming you're using the terminal to create the network
sudo docker network create -d bridge lldapnet

`version: "3.8"
services:
nginx:
container_name: nginx
image: jc21/nginx-proxy-manager
restart: unless-stopped
ports:
- 80:80
- 81:81
- 443:443
volumes:
- ./nginx/data:/data
- ./nginx/letsencrypt:/etc/letsencrypt
- ./nginx/snippets:/snippets
environment:
- TZ=America/New_York
networks:
- lldapnet

networks:
lldapnet:
name: lldapnet
external: true`

`version: "3.8"
services:
vaultwarden:
container_name: vaultwarden
image: vaultwarden/server:latest
restart: unless-stopped
volumes:
- ./vaultwarden_app_data/:/data/
- ./keys/fullchain18.pem:/ssl/fullchain.pem
- ./keys/privkey18.pem:/ssl/privkey.pem
ports:
- 6796:80
environment:
- ROCKET_TLS={certs="/ssl/fullchain.pem",key="/ssl/privkey.pem"}
- DOMAIN=https://vault.yourdomain.com