- -
-
- 
-
-
- 
-
-
- 
-
+
+ +
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
- Expose web services on your network · - Free SSL with Let's Encrypt · - Designed with security in mind · - Perfect for home networks -
-Expose your private network Web services and get connected anywhere.
-Based on Tabler, the interface is a pleasure to use. Configuring a server has never been so fun.
-Built in Let’s Encrypt support allows you to secure your Web services at no cost to you. The certificates even renew themselves!
-Built as a Docker Image, Nginx Proxy Manager only requires a database.
-Configure other users to either view or manage their own hosts. Full access permissions are available.
-
-
-
-
-
-
-
-
-
-
diff --git a/docs/setup/README.md b/docs/setup/README.md
deleted file mode 100644
index f6c8f9461..000000000
--- a/docs/setup/README.md
+++ /dev/null
@@ -1,132 +0,0 @@
-# Full Setup Instructions
-
-### Configuration File
-
-**The configuration file needs to be provided by you!**
-
-Don't worry, this is easy to do.
-
-The app requires a configuration file to let it know what database you're using. By default, this file is called `config.json`
-
-Here's an example configuration for `mysql` (or mariadb) that is compatible with the docker-compose example below:
-
-```json
-{
- "database": {
- "engine": "mysql",
- "host": "db",
- "name": "npm",
- "user": "npm",
- "password": "npm",
- "port": 3306
- }
-}
-```
-
-Once you've created your configuration file it's easy to mount it in the docker container.
-
-**Note:** After the first run of the application, the config file will be altered to include generated encryption keys unique to your installation. These keys
-affect the login and session management of the application. If these keys change for any reason, all users will be logged out.
-
-
-### Database
-
-This app doesn't come with a database, you have to provide one yourself. Currently only `mysql/mariadb` is supported for the minimum versions:
-
-- MySQL v5.7.8+
-- MariaDB v10.2.7+
-
-It's easy to use another docker container for your database also and link it as part of the docker stack, so that's what the following examples
-are going to use.
-
-::: warning
-
-When using a `mariadb` database, the NPM configuration file should still use the `mysql` engine!
-
-:::
-
-
-### Running the App
-
-Via `docker-compose`:
-
-```yml
-version: "3"
-services:
- app:
- image: jc21/nginx-proxy-manager:2
- restart: always
- ports:
- # Public HTTP Port:
- - '80:80'
- # Public HTTPS Port:
- - '443:443'
- # Admin Web Port:
- - '81:81'
- environment:
- # Uncomment this if IPv6 is not enabled on your host
- # DISABLE_IPV6: 'true'
- volumes:
- # Make sure this config.json file exists as per instructions above:
- - ./config.json:/app/config/production.json
- - ./data:/data
- - ./letsencrypt:/etc/letsencrypt
- depends_on:
- - db
- db:
- image: jc21/mariadb-aria:10.4
- restart: always
- environment:
- MYSQL_ROOT_PASSWORD: 'npm'
- MYSQL_DATABASE: 'npm'
- MYSQL_USER: 'npm'
- MYSQL_PASSWORD: 'npm'
- volumes:
- - ./data/mysql:/var/lib/mysql
-```
-
-Then:
-
-```bash
-docker-compose up -d
-```
-
-The config file (config.json) must be present in this directory.
-
-### Running on Raspberry PI / ARM devices
-
-The docker images support the following architectures:
-- amd64
-- arm64
-- armv7
-
-The docker images are a manifest of all the architecture docker builds supported, so this means
-you don't have to worry about doing anything special and you can follow the common instructions above.
-
-Check out the [dockerhub tags](https://cloud.docker.com/repository/registry-1.docker.io/jc21/nginx-proxy-manager/tags)
-for a list of supported architectures and if you want one that doesn't exist,
-[create a feature request](https://github.com/jc21/nginx-proxy-manager/issues/new?assignees=&labels=enhancement&template=feature_request.md&title=).
-
-Also, if you don't know how to already, follow [this guide to install docker and docker-compose](https://manre-universe.net/how-to-run-docker-and-docker-compose-on-raspbian/)
-on Raspbian.
-
-
-### Initial Run
-
-After the app is running for the first time, the following will happen:
-
-1. The database will initialize with table structures
-2. GPG keys will be generated and saved in the configuration file
-3. A default admin user will be created
-
-This process can take a couple of minutes depending on your machine.
-
-
-### Default Administrator User
-
-```
-Email: admin@example.com
-Password: changeme
-```
-
-Immediately after logging in with this default user you will be asked to modify your details and change your password.
diff --git a/docs/src/advanced-config/index.md b/docs/src/advanced-config/index.md
new file mode 100644
index 000000000..4a7c260eb
--- /dev/null
+++ b/docs/src/advanced-config/index.md
@@ -0,0 +1,230 @@
+---
+outline: deep
+---
+
+# Advanced Configuration
+
+## Running processes as a user/group
+
+By default, the services (nginx etc) will run as `root` user inside the docker container.
+You can change this behaviour by setting the following environment variables.
+Not only will they run the services as this user/group, they will change the ownership
+on the `data` and `letsencrypt` folders at startup.
+
+```yml
+services:
+ app:
+ image: 'jc21/nginx-proxy-manager:latest'
+ environment:
+ PUID: 1000
+ PGID: 1000
+ # ...
+```
+
+This may have the side effect of a failed container start due to permission denied trying
+to open port 80 on some systems. The only course to fix that is to remove the variables
+and run as the default root user.
+
+## Best Practice: Use a Docker network
+
+For those who have a few of their upstream services running in Docker on the same Docker
+host as NPM, here's a trick to secure things a bit better. By creating a custom Docker network,
+you don't need to publish ports for your upstream services to all of the Docker host's interfaces.
+
+Create a network, ie "scoobydoo":
+
+```bash
+docker network create scoobydoo
+```
+
+Then add the following to the `docker-compose.yml` file for both NPM and any other
+services running on this Docker host:
+
+```yml
+networks:
+ default:
+ external: true
+ name: scoobydoo
+```
+
+Let's look at a Portainer example:
+
+```yml
+services:
+
+ portainer:
+ image: portainer/portainer
+ privileged: true
+ volumes:
+ - './data:/data'
+ - '/var/run/docker.sock:/var/run/docker.sock'
+ restart: unless-stopped
+
+networks:
+ default:
+ external: true
+ name: scoobydoo
+```
+
+Now in the NPM UI you can create a proxy host with `portainer` as the hostname,
+and port `9000` as the port. Even though this port isn't listed in the docker-compose
+file, it's "exposed" by the Portainer Docker image for you and not available on
+the Docker host outside of this Docker network. The service name is used as the
+hostname, so make sure your service names are unique when using the same network.
+
+## Docker Healthcheck
+
+The `Dockerfile` that builds this project does not include a `HEALTHCHECK` but you can opt in to this
+feature by adding the following to the service in your `docker-compose.yml` file:
+
+```yml
+healthcheck:
+ test: ["CMD", "/usr/bin/check-health"]
+ interval: 10s
+ timeout: 3s
+```
+
+## Docker File Secrets
+
+This image supports the use of Docker secrets to import from files and keep sensitive usernames or passwords from being passed or preserved in plaintext.
+
+You can set any environment variable from a file by appending `__FILE` (double-underscore FILE) to the environmental variable name.
+
+```yml
+secrets:
+ # Secrets are single-line text files where the sole content is the secret
+ # Paths in this example assume that secrets are kept in local folder called ".secrets"
+ DB_ROOT_PWD:
+ file: .secrets/db_root_pwd.txt
+ MYSQL_PWD:
+ file: .secrets/mysql_pwd.txt
+
+services:
+ app:
+ image: 'jc21/nginx-proxy-manager:latest'
+ restart: unless-stopped
+ ports:
+ # Public HTTP Port:
+ - '80:80'
+ # Public HTTPS Port:
+ - '443:443'
+ # Admin Web Port:
+ - '81:81'
+ environment:
+ # These are the settings to access your db
+ DB_MYSQL_HOST: "db"
+ DB_MYSQL_PORT: 3306
+ DB_MYSQL_USER: "npm"
+ # DB_MYSQL_PASSWORD: "npm" # use secret instead
+ DB_MYSQL_PASSWORD__FILE: /run/secrets/MYSQL_PWD
+ DB_MYSQL_NAME: "npm"
+ # If you would rather use Sqlite, remove all DB_MYSQL_* lines above
+ # Uncomment this if IPv6 is not enabled on your host
+ # DISABLE_IPV6: 'true'
+ volumes:
+ - ./data:/data
+ - ./letsencrypt:/etc/letsencrypt
+ secrets:
+ - MYSQL_PWD
+ depends_on:
+ - db
+
+ db:
+ image: jc21/mariadb-aria
+ restart: unless-stopped
+ environment:
+ # MYSQL_ROOT_PASSWORD: "npm" # use secret instead
+ MYSQL_ROOT_PASSWORD__FILE: /run/secrets/DB_ROOT_PWD
+ MYSQL_DATABASE: "npm"
+ MYSQL_USER: "npm"
+ # MYSQL_PASSWORD: "npm" # use secret instead
+ MYSQL_PASSWORD__FILE: /run/secrets/MYSQL_PWD
+ MARIADB_AUTO_UPGRADE: '1'
+ volumes:
+ - ./mysql:/var/lib/mysql
+ secrets:
+ - DB_ROOT_PWD
+ - MYSQL_PWD
+```
+
+
+## Disabling IPv6
+
+On some Docker hosts IPv6 may not be enabled. In these cases, the following message may be seen in the log:
+
+> Address family not supported by protocol
+
+The easy fix is to add a Docker environment variable to the Nginx Proxy Manager stack:
+
+```yml
+ environment:
+ DISABLE_IPV6: 'true'
+```
+
+## Disabling IP Ranges Fetch
+
+By default, NPM fetches IP ranges from CloudFront and Cloudflare during application startup. In environments with limited internet access or to speed up container startup, this fetch can be disabled:
+
+```yml
+ environment:
+ IP_RANGES_FETCH_ENABLED: 'false'
+```
+
+## Custom Nginx Configurations
+
+If you are a more advanced user, you might be itching for extra Nginx customizability.
+
+NPM has the ability to include different custom configuration snippets in different places.
+
+You can add your custom configuration snippet files at `/data/nginx/custom` as follow:
+
+ - `/data/nginx/custom/root_top.conf`: Included at the top of nginx.conf
+ - `/data/nginx/custom/root.conf`: Included at the very end of nginx.conf
+ - `/data/nginx/custom/http_top.conf`: Included at the top of the main http block
+ - `/data/nginx/custom/http.conf`: Included at the end of the main http block
+ - `/data/nginx/custom/events.conf`: Included at the end of the events block
+ - `/data/nginx/custom/stream.conf`: Included at the end of the main stream block
+ - `/data/nginx/custom/server_proxy.conf`: Included at the end of every proxy server block
+ - `/data/nginx/custom/server_redirect.conf`: Included at the end of every redirection server block
+ - `/data/nginx/custom/server_stream.conf`: Included at the end of every stream server block
+ - `/data/nginx/custom/server_stream_tcp.conf`: Included at the end of every TCP stream server block
+ - `/data/nginx/custom/server_stream_udp.conf`: Included at the end of every UDP stream server block
+ - `/data/nginx/custom/server_dead.conf`: Included at the end of every 404 server block
+
+Every file is optional.
+
+
+## X-FRAME-OPTIONS Header
+
+You can configure the [`X-FRAME-OPTIONS`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options) header
+value by specifying it as a Docker environment variable. The default if not specified is `deny`.
+
+```yml
+ ...
+ environment:
+ X_FRAME_OPTIONS: "sameorigin"
+ ...
+```
+
+## Customising logrotate settings
+
+By default, NPM rotates the access- and error logs weekly and keeps 4 and 10 log files respectively.
+Depending on the usage, this can lead to large log files, especially access logs.
+You can customise the logrotate configuration through a mount (if your custom config is `logrotate.custom`):
+
+```yml
+ volumes:
+ ...
+ - ./logrotate.custom:/etc/logrotate.d/nginx-proxy-manager
+```
+
+For reference, the default configuration can be found [here](https://github.com/NginxProxyManager/nginx-proxy-manager/blob/develop/docker/rootfs/etc/logrotate.d/nginx-proxy-manager).
+
+## Enabling the geoip2 module
+
+To enable the geoip2 module, you can create the custom configuration file `/data/nginx/custom/root_top.conf` and include the following snippet:
+
+```
+load_module /usr/lib/nginx/modules/ngx_http_geoip2_module.so;
+load_module /usr/lib/nginx/modules/ngx_stream_geoip2_module.so;
+```
diff --git a/docs/src/faq/index.md b/docs/src/faq/index.md
new file mode 100644
index 000000000..ea375f47b
--- /dev/null
+++ b/docs/src/faq/index.md
@@ -0,0 +1,26 @@
+---
+outline: deep
+---
+
+# FAQ
+
+## Do I have to use Docker?
+
+Yes, that's how this project is packaged.
+
+This makes it easier to support the project when we have control over the version of Nginx other packages
+use by the project.
+
+## Can I run it on a Raspberry Pi?
+
+Yes! The docker image is multi-arch and is built for a variety of architectures. If yours is
+[not listed](https://hub.docker.com/r/jc21/nginx-proxy-manager/tags) please open a
+[GitHub issue](https://github.com/NginxProxyManager/nginx-proxy-manager/issues/new?assignees=&labels=enhancement&template=feature_request.md&title=).
+
+## I can't get my service to proxy properly?
+
+Your best bet is to ask the [Reddit community for support](https://www.reddit.com/r/nginxproxymanager/). There's safety in numbers.
+
+## When adding username and password access control to a proxy host, I can no longer login into the app.
+
+Having an Access Control List (ACL) with username and password requires the browser to always send this username and password in the `Authorization` header on each request. If your proxied app also requires authentication (like Nginx Proxy Manager itself), most likely the app will also use the `Authorization` header to transmit this information, as this is the standardized header meant for this kind of information. However having multiples of the same headers is not allowed in the [internet standard](https://www.rfc-editor.org/rfc/rfc7230#section-3.2.2) and almost all apps do not support multiple values in the `Authorization` header. Hence one of the two logins will be broken. This can only be fixed by either removing one of the logins or by changing the app to use other non-standard headers for authorization.
diff --git a/docs/src/guide/index.md b/docs/src/guide/index.md
new file mode 100644
index 000000000..fcf176fa9
--- /dev/null
+++ b/docs/src/guide/index.md
@@ -0,0 +1,125 @@
+---
+outline: deep
+---
+
+# Guide
+
+::: raw
+
+:::
+
+This project comes as a pre-built docker image that enables you to easily forward to your websites
+running at home or otherwise, including free SSL, without having to know too much about Nginx or Letsencrypt.
+
+- [Quick Setup](#quick-setup)
+- [Full Setup](/setup/)
+- [Screenshots](/screenshots/)
+
+## Project Goal
+
+I created this project to fill a personal need to provide users with an easy way to accomplish reverse
+proxying hosts with SSL termination and it had to be so easy that a monkey could do it. This goal hasn't changed.
+While there might be advanced options they are optional and the project should be as simple as possible
+so that the barrier for entry here is low.
+
+::: raw
+
+:::
+
+## Features
+
+- Beautiful and Secure Admin Interface based on [Tabler](https://tabler.github.io/)
+- Easily create forwarding domains, redirections, streams and 404 hosts without knowing anything about Nginx
+- Free SSL using Let's Encrypt or provide your own custom SSL certificates
+- Access Lists and basic HTTP Authentication for your hosts
+- Advanced Nginx configuration available for super users
+- User management, permissions and audit log
+
+
+## Hosting your home network
+
+I won't go in to too much detail here but here are the basics for someone new to this self-hosted world.
+
+1. Your home router will have a Port Forwarding section somewhere. Log in and find it
+2. Add port forwarding for port 80 and 443 to the server hosting this project
+3. Configure your domain name details to point to your home, either with a static ip or a service like DuckDNS or [Amazon Route53](https://github.com/jc21/route53-ddns)
+4. Use the Nginx Proxy Manager as your gateway to forward to your other web based services
+
+## Quick Setup
+
+1. Install Docker and Docker-Compose
+
+- [Docker Install documentation](https://docs.docker.com/get-docker/)
+- [Docker-Compose Install documentation](https://docs.docker.com/compose/install/)
+
+2. Create a docker-compose.yml file similar to this:
+
+```yml
+services:
+ app:
+ image: 'jc21/nginx-proxy-manager:latest'
+ restart: unless-stopped
+ ports:
+ - '80:80'
+ - '81:81'
+ - '443:443'
+ volumes:
+ - ./data:/data
+ - ./letsencrypt:/etc/letsencrypt
+```
+
+This is the bare minimum configuration required. See the [documentation](https://nginxproxymanager.com/setup/) for more.
+
+3. Bring up your stack by running
+
+```bash
+docker-compose up -d
+
+# If using docker-compose-plugin
+docker compose up -d
+```
+
+4. Log in to the Admin UI
+
+When your docker container is running, connect to it on port `81` for the admin interface.
+Sometimes this can take a little bit because of the entropy of keys.
+
+[http://127.0.0.1:81](http://127.0.0.1:81)
+
+Default Admin User:
+```
+Email: admin@example.com
+Password: changeme
+```
+
+Immediately after logging in with this default user you will be asked to modify your details and change your password.
+
+
+## Contributing
+
+All are welcome to create pull requests for this project, against the `develop` branch. Official releases are created from the `master` branch.
+
+CI is used in this project. All PR's must pass before being considered. After passing,
+docker builds for PR's are available on dockerhub for manual verifications.
+
+Documentation within the `develop` branch is available for preview at
+[https://develop.nginxproxymanager.com](https://develop.nginxproxymanager.com)
+
+
+### Contributors
+
+Special thanks to [all of our contributors](https://github.com/NginxProxyManager/nginx-proxy-manager/graphs/contributors).
+
+
+## Getting Support
+
+1. [Found a bug?](https://github.com/NginxProxyManager/nginx-proxy-manager/issues)
+2. [Discussions](https://github.com/NginxProxyManager/nginx-proxy-manager/discussions)
+3. [Reddit](https://reddit.com/r/nginxproxymanager)
diff --git a/docs/src/index.md b/docs/src/index.md
new file mode 100644
index 000000000..74a263bd0
--- /dev/null
+++ b/docs/src/index.md
@@ -0,0 +1,32 @@
+---
+# https://vitepress.dev/reference/default-theme-home-page
+layout: home
+
+hero:
+ name: "Nginx Proxy Manager"
+ tagline: Expose your services easily and securely
+ image:
+ src: /logo.svg
+ alt: NPM Logo
+ actions:
+ - theme: brand
+ text: Get Started
+ link: /guide/
+ - theme: alt
+ text: GitHub
+ link: https://github.com/NginxProxyManager/nginx-proxy-manager
+
+features:
+ - title: Get Connected
+ details: Expose web services on your network · Free SSL with Let's Encrypt · Designed with security in mind · Perfect for home networks
+ - title: Proxy Hosts
+ details: Expose your private network Web services and get connected anywhere.
+ - title: Beautiful UI
+ details: Based on Tabler, the interface is a pleasure to use. Configuring a server has never been so fun.
+ - title: Free SSL
+ details: Built in Let’s Encrypt support allows you to secure your Web services at no cost to you. The certificates even renew themselves!
+ - title: Docker FTW
+ details: Built as a Docker Image, Nginx Proxy Manager only requires a database.
+ - title: Multiple Users
+ details: Configure other users to either view or manage their own hosts. Full access permissions are available.
+---
diff --git a/docs/.vuepress/public/github.png b/docs/src/public/github.png
similarity index 100%
rename from docs/.vuepress/public/github.png
rename to docs/src/public/github.png
diff --git a/docs/.vuepress/public/icon.png b/docs/src/public/icon.png
similarity index 100%
rename from docs/.vuepress/public/icon.png
rename to docs/src/public/icon.png
diff --git a/docs/.vuepress/public/logo.svg b/docs/src/public/logo.svg
similarity index 100%
rename from docs/.vuepress/public/logo.svg
rename to docs/src/public/logo.svg
diff --git a/docs/.vuepress/public/robots.txt b/docs/src/public/robots.txt
similarity index 100%
rename from docs/.vuepress/public/robots.txt
rename to docs/src/public/robots.txt
diff --git a/docs/.vuepress/public/screenshots/access-lists.png b/docs/src/public/screenshots/access-lists.png
similarity index 100%
rename from docs/.vuepress/public/screenshots/access-lists.png
rename to docs/src/public/screenshots/access-lists.png
diff --git a/docs/.vuepress/public/screenshots/audit-log.png b/docs/src/public/screenshots/audit-log.png
similarity index 100%
rename from docs/.vuepress/public/screenshots/audit-log.png
rename to docs/src/public/screenshots/audit-log.png
diff --git a/docs/.vuepress/public/screenshots/certificates.png b/docs/src/public/screenshots/certificates.png
similarity index 100%
rename from docs/.vuepress/public/screenshots/certificates.png
rename to docs/src/public/screenshots/certificates.png
diff --git a/docs/.vuepress/public/screenshots/custom-settings.png b/docs/src/public/screenshots/custom-settings.png
similarity index 100%
rename from docs/.vuepress/public/screenshots/custom-settings.png
rename to docs/src/public/screenshots/custom-settings.png
diff --git a/docs/.vuepress/public/screenshots/dashboard.png b/docs/src/public/screenshots/dashboard.png
similarity index 100%
rename from docs/.vuepress/public/screenshots/dashboard.png
rename to docs/src/public/screenshots/dashboard.png
diff --git a/docs/.vuepress/public/screenshots/dead-hosts.png b/docs/src/public/screenshots/dead-hosts.png
similarity index 100%
rename from docs/.vuepress/public/screenshots/dead-hosts.png
rename to docs/src/public/screenshots/dead-hosts.png
diff --git a/docs/.vuepress/public/screenshots/login.png b/docs/src/public/screenshots/login.png
similarity index 100%
rename from docs/.vuepress/public/screenshots/login.png
rename to docs/src/public/screenshots/login.png
diff --git a/docs/.vuepress/public/screenshots/permissions.png b/docs/src/public/screenshots/permissions.png
similarity index 100%
rename from docs/.vuepress/public/screenshots/permissions.png
rename to docs/src/public/screenshots/permissions.png
diff --git a/docs/.vuepress/public/screenshots/proxy-hosts-add.png b/docs/src/public/screenshots/proxy-hosts-add.png
similarity index 100%
rename from docs/.vuepress/public/screenshots/proxy-hosts-add.png
rename to docs/src/public/screenshots/proxy-hosts-add.png
diff --git a/docs/.vuepress/public/screenshots/proxy-hosts.png b/docs/src/public/screenshots/proxy-hosts.png
similarity index 100%
rename from docs/.vuepress/public/screenshots/proxy-hosts.png
rename to docs/src/public/screenshots/proxy-hosts.png
diff --git a/docs/.vuepress/public/screenshots/redirection-hosts.png b/docs/src/public/screenshots/redirection-hosts.png
similarity index 100%
rename from docs/.vuepress/public/screenshots/redirection-hosts.png
rename to docs/src/public/screenshots/redirection-hosts.png
diff --git a/docs/src/screenshots/index.md b/docs/src/screenshots/index.md
new file mode 100644
index 000000000..8bd210285
--- /dev/null
+++ b/docs/src/screenshots/index.md
@@ -0,0 +1,20 @@
+---
+outline: deep
+---
+
+# Screenshots
+
+::: raw
+
+
+
+
+
+
+
+
+
+
++ IP Address Whitelist/Blacklist via + + Nginx HTTP Access + +
allow and deny directives will be applied in the order they are defined.