Nginx Proxy Manager is the public ingress and TLS termination layer for Smithflix. It fronts household services, publishes admin surfaces, and stores the active reverse-proxy configuration and Let's Encrypt material.
This page documents the nginx service itself. The broader hostname map and cross-service proxy policy live on Reverse Proxy.
nginxjc21/nginx-proxy-manager:latest/opt/stacks/server/compose.yamlserver_defaultunless-stopped80, 81, 443nginx.better-than.tv/srv/docker/nginx/data/srv/docker/nginx/letsencrypt/srv/docker/nginx/data/nginx/proxy_host/*.conf/srv/docker/nginx/data/database.sqlite/srv/docker/nginx/data/logshttp://127.0.0.1:81/apihttp://127.0.0.1:81/api/schema/home/adam/scripts/npm_api.py/home/adam/.config/smithflix/npm-api.env/home/adam/scripts/setup-npm-api-creds.shhttp://192.168.0.113:81https://nginx.better-than.tv80 and 443/srv/docker/nginx/data/srv/docker/nginx/letsencrypt.env secret was verified for NPM on 2026-04-07NPM_API_TOKEN or NPM_API_EMAIL plus NPM_API_PASSWORD; do not hard-code credentials into helper scriptssetup-npm-api-creds.sh, which writes NPM_API_URL, NPM_API_EMAIL, NPM_API_PASSWORD, and NPM_API_BACKUP_DIR to the user-only env file above/srv/docker/nginx/data/nginx/proxy_host/*.conf and checking set $server plus set $port/home/adam/scripts/npm_api.py for routine proxy-host and access-list reads/writes when the API supports the operation/home/adam/scripts/npm_api.py ensure-proxy-location or remove-proxy-location for ordinary subpath routing instead of hand-maintained advanced_config blocks when the app works with NPM locations[]manage-npm-public-hosts.sh and configure-manage-authentik-mvp.sh should now be treated as targeted fallbacks, not the default path for routine proxy administrationjson-file/srv/docker/nginx/data/logs/srv/docker/nginx/data/logs into the logs stackdocker logs nginx is the fastest check for cert renewals, config reloads, and startup failures/srv/docker/nginx is within the documented Duplicati backup scope because it lives under /srv/docker/srv/docker/nginx/data and /srv/docker/nginx/letsencrypt together to preserve app state and certificatesset $server or set $port values in a proxy host file will route traffic to the wrong upstream or a dead port--apply first/srv/docker/nginx/data or /srv/docker/nginx/letsencrypt can block cert renewal or config reloads2026-04-08