Nginx Proxy Manager on a VPS: A Review and Setup Guide

NPM vs Caddy vs Traefik: Which Reverse Proxy Fits Your VPS

The three tools split along four axes that decide the choice: how you configure them, how they handle HTTPS, how they scale with service count, and how much RAM they idle at. Here is the comparison.

The idle-RAM figures are approximate observations from one 2026 comparison, not fixed requirements. Actual usage varies by image version, enabled features, traffic, and logging.

The switching criteria follow directly from that table. If you want a dashboard and you run a handful of services that do not change often, NPM is the right tool. If you prefer configuration as code, want the smallest footprint, or appreciate Caddy's automatic HTTPS provisioning and renewal with zero ACME setup, use Caddy. I reach for Caddy myself on single-site deployments because the SSL handling is automatic and the Caddyfile is short. If you frequently add, remove, or redeploy containers, Traefik's label-based auto-discovery means you stop hand-registering every new host.

There is also bare Nginx with Certbot, which some administrators prefer for precise control or non-Docker deployments. Certbot can automate certificate renewal, but you still manage the virtual-host routing and Nginx configuration yourself. If your main reason for considering NPM is avoiding manual proxy configuration, bare Nginx is unlikely to be the better fit.

One note on the choice: byte-guard's comparison lands on Caddy as the lightest option in that comparison, and for a fresh 2026 single-host setup that is a reasonable choice. Caddy wins on being lighter than NPM, but if you specifically want a GUI, it isn't your best bet.

For a deeper side-by-side of the underlying engines, see the Caddy vs Nginx on a VPS comparison.

Prerequisites: What You'll Need

Before you deploy, have these ready. This is a short list, but skip any item and the certificate step will fail later.

• A VPS with Docker and Docker Compose installed (Ubuntu 22.04 LTS or Debian 12 is fine).
• A domain name, with a DNS A record (and AAAA if you use IPv6) pointing at your VPS public IP.
• SSH access to the VPS.
• Ports 80 and 443 open to the internet on your firewall.
• Port 81 reachable by you only, not open to the public (covered in the security section).

Setting Up Nginx Proxy Manager on Your VPS with Docker Compose

This section deploys NPM using Docker Compose. Once your DNS records resolve to the VPS, the container setup itself is quick, although DNS propagation and certificate issuance may take longer.

The setup uses one Docker Compose file and a one-time command to create a shared Docker network. Create a directory, create the network, add the docker-compose.yml file below, and bring up the container.

First, create the shared Docker network:

docker network create proxy

Then create the following docker-compose.yml file:

# docker-compose.yml
services:
  npm:
    image: 'jc21/nginx-proxy-manager:<PATCHED_VERSION>'
    restart: unless-stopped
    ports:
      - '80:80'                 # public HTTP
      - '443:443'               # public HTTPS
      - '127.0.0.1:81:81'       # admin UI, reachable only from the VPS itself
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
    networks:
      - proxy
networks:
  proxy:
    external: true

Attach every backend container that NPM must reach by service name to the same external proxy network. This lets NPM resolve the container by its service name without publishing the backend application's port on the VPS.

Back up both ./data and ./letsencrypt before upgrades. The data directory contains NPM's database and generated configuration, while the Let's Encrypt directory contains its certificate material.

A few things about this file. The image defaults to a SQLite database stored in the ./data volume. That is the default backend and it is correct for most single-VPS deployments. If you need an external database, NPM supports MariaDB/MySQL and PostgreSQL, which means adding a database service and the matching environment variables. For a single VPS, SQLite is still the simplest default unless you have a clear reason to move the database out of the data volume. The restart: unless-stopped policy means NPM comes back up if the VPS reboots, which is what you want for a service that sits in front of everything else.

Bring it up and confirm it is running:

docker compose up -d
docker compose ps

Expected output: the npm container with state Up, ports 80 and 443 publicly mapped, and port 81 bound only to 127.0.0.1. The first start takes a couple of minutes while NPM generates a JWT key, initializes the database, and creates the default admin user. The official setup docs describe this first-run sequence.

Create an SSH tunnel from your local computer before opening the admin interface:

ssh -L 8181:127.0.0.1:81 user@your-vps

Then open http://127.0.0.1:8181 in your browser. On a fresh installation, sign in with [email protected] and changeme, then immediately replace the default email and password. Do not make the dashboard publicly reachable while the default credentials are active.

Once you have changed the admin credentials, add your first proxy host:

1. In the dashboard, go to Hosts, then Proxy Hosts, then Add Proxy Host.
2. Set the Domain Name to your subdomain (for example cloud.example.com).
3. Set Forward Hostname / IP to the backend container name or IP, and Forward Port to the port it listens on.
4. Save. The proxy host appears in the list, and traffic to that subdomain now reaches your container.

If you run a Docker management UI alongside this, the same pattern applies: point a subdomain at the container-management tool the same way, and do the same for a Prometheus and Grafana monitoring stack you want to sit behind the proxy.

Configuring Automatic HTTPS for a Subdomain

This section gets you a valid, auto-renewing Let's Encrypt certificate for your subdomain. The prerequisite is the one that catches people: the DNS A record for that subdomain has to already point at your VPS, and port 80 has to be reachable from the internet, because Let's Encrypt verifies the domain by connecting back to it.

With the proxy host created, request the certificate:

1. Edit the proxy host, open the SSL tab.
2. Under SSL Certificate, choose Request a new SSL Certificate.
3. Enable Force SSL and HTTP/2 Support. Turn on HSTS only after confirming that HTTPS works correctly, because browsers can cache the policy and make recovery from a certificate or proxy configuration mistake more difficult.
4. Agree to the Let's Encrypt terms and save.

By default, NPM uses the HTTP-01 challenge for non-wildcard names, validating each requested hostname over port 80. A certificate can contain multiple non-wildcard names, but HTTP-01 cannot issue wildcard certificates. Wildcard names such as *.example.com require the DNS-01 challenge with a supported DNS provider. For a normal one-subdomain-per-service setup, HTTP-01 is all you need, and renewals are automatic.

Sizing Your VPS for Nginx Proxy Manager

NPM itself is light; the sizing question is really about NPM plus the services sitting behind it. The proxy's idle footprint is rarely the constraint. A Nextcloud instance or Ghost blog will use more resources than the proxy itself.

Here is how the tiers work out in practice:

• Minimum practical baseline: 1 GB RAM, 1 vCPU, and 10 GB storage. One third-party sizing guide uses the same baseline, but treat it as planning guidance rather than an official NPM requirement. It is enough for NPM, the operating system, and a few light services, but it leaves limited headroom.
• Comfortable: 2 GB RAM, 1 vCPU, 20 GB storage. NPM plus three to five services with room to breathe. This is the sweet spot for most self-hosters.
• Step-up: 4 GB RAM, 2 vCPU. For eight to twelve services, or a setup with meaningful traffic where you want CPU headroom for TLS termination.

The number you size against is the sum of the proxied apps, not NPM. Add up the RAM footprints of the services you intend to run, add the proxy's small idle overhead on top, and pick the tier above that with margin.

Sizing the box is the easy part. Getting NPM running still means provisioning the VPS, installing Docker, pulling the image, and walking through that first-run setup. If you would rather skip the provisioning steps, Cloudzy's marketplace has a one-click Nginx Proxy Manager deploy on an NVMe VPS. It stands the container up on a fresh server, so you go straight to the dashboard and your first proxy host. Either way, the sizing tiers above are what you provision against.

Frequently Asked Questions