Nginx Proxy Manager is the public ingress layer for Smithflix. It terminates TLS, publishes service hostnames, and fronts admin UIs and household-facing apps.
nginxjc21/nginx-proxy-manager/srv/docker/nginx/data/srv/docker/nginx/letsencrypt/srv/docker/nginx/data/nginx/proxy_host/*.confRepresentative hostnames include:
wiki.better-than.tv
smithflix.better-than.tv
radarr.better-than.tv
sonarr.better-than.tv
prowlarr.better-than.tv
jellyseerr.better-than.tv
photos.better-than.tv
pihole.better-than.tv
dockge.better-than.tv
nginx.better-than.tv
ntfy.better-than.tv
astro.better-than.tv
diamondedge.better-than.tv
pelican.better-than.tv
audiobookshelf.better-than.tv
cleanuparr.better-than.tv
deluge.better-than.tv
speedtest.better-than.tv
smokeping.better-than.tv
logs.better-than.tv
jellystat.better-than.tv
36astro.better-than.tvhttp://192.168.0.113:18081 (astro Node/Astro runtime container in the Server Stack)curl -I -H 'Host: astro.better-than.tv' http://127.0.0.1/ returns 200 OK with X-Served-By: astro.better-than.tv as of 2026-05-0337 (astro.better-than.tv, Let's Encrypt R13, expires 2026-08-02 00:06:47 UTC)2026-05-04: ssl_forced=true, http2_support=true, hsts_enabled=false, hsts_subdomains=falsecurl -I https://astro.better-than.tv/ returns HTTP/2 200; curl -I http://astro.better-than.tv/ returns 301 to HTTPS./manage/ is intentionally unauthenticated and unlinked; do not add an NPM access list unless the site owner changes that preference.astro.better-than.tv was added to dynamic DNS by the site owner and successfully issued through NPM/Let's Encrypt on 2026-05-04. HSTS remains disabled deliberately during initial rollout.37diamondedge.better-than.tvsavantpicks.comwww.savantpicks.comNetwork Solutionshttp://diamondedge:3001 over the shared Docker server_default networkadmin auth127.0.0.1:18082 -> 3001 on the diamondedge container2026-05-23: anonymous curl -H 'Host: diamondedge.better-than.tv' http://127.0.0.1/ returns 401 Authorization Required2026-05-24: authenticated curl -u "$NPM_API_EMAIL:$NPM_API_PASSWORD" -H 'Host: diamondedge.better-than.tv' http://127.0.0.1/api/health returns the app health payload2026-05-23: /srv/docker/nginx/data/nginx/proxy_host/37.conf injects X-Diamond-Edge-Trusted before proxying to diamondedge:3001diamondedge container runs with REQUIRE_COSTLY_API_AUTH=true, DIAMOND_EDGE_TRUSTED_AUTH_HEADER=x-diamond-edge-trusted, and the trusted-header sentinel value from the live proxy configsavantpicks.com, but final DNS convergence, public certificate issuance, and HTTPS redirect validation are still incompleteForce SSL, HTTP/2, and HSTS for every public host.setup-authentik-mvp.sh for the backend stack, configure-authentik-manage-mvp.py for the Authentik provider/application/outpost objects, and configure-manage-authentik-mvp.sh for the manage.better-than.tv NPM front-door rewrite.2026-04-08, Wiki.js is available through https://manage.better-than.tv/wiki/ and is being tested as an embedded path inside Organizr by stripping the upstream X-Frame-Options header at the manage gateway./_assets/... to /wiki/_assets/..., proxies /wiki/graphql, forwards X-Forwarded-Prefix: /wiki, and also exposes root fallbacks for /_assets/..., /graphql, and the canonical content prefixes (/documentation, /infrastructure, /docker, /services, /networking, /storage, /operations/) because the proxied Wiki.js app can still emit absolute root paths at the manage host. Exact no-slash routes are required for the section roots so Wiki.js does not bounce between /documentation and /documentation/./srv/docker/nginx/data/nginx/proxy_host/home/adam/scripts/npm_api.py for supported proxy-host and access-list changes before falling back to direct SQLite/config edits/home/adam/scripts/npm_api.py ensure-proxy-location for new manage subpath experiments before reaching for full-host advanced_config2026-04-08, manage.better-than.tv is Authentik-gated on the same hostname rather than relying on a separate auth.better-than.tv proxy host for the MVP flow.manage, including /outpost.goauthentik.io, /application/, /if/, /static/, /api/v3/, and /flows/.docker logs nginx for runtime proxy issues2026-04-072026-05-042026-05-242026-06-02