NGINX Proxy manager config

[rocit-ric]

fully functional, hope it helps. The documentation here didn't work.

cloudflare proxied dns > port 443 on public IP restricted to cloudflare ip ranges > nginxproxymanager (2.15.1)

# ------------------------------------------------------------
# api.domain
# ------------------------------------------------------------
map $scheme $hsts_header {
  https   "max-age=63072000;includeSubDomains; preload";
}
server {
  set $forward_scheme https;
  set $server     "local-ip";
  set $port       443;
  listen 80;
listen [::]:80;
listen 443 ssl;
listen [::]:443 ssl;
  server_name api.domain;
  http2 on;
# Let's Encrypt SSL
  include /etc/nginx/conf.d/include/letsencrypt-acme-challenge.conf;
  include /etc/nginx/conf.d/include/ssl-cache.conf;
  include /etc/nginx/conf.d/include/ssl-ciphers.conf;
  ssl_certificate /etc/letsencrypt/live/npm-6/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/npm-6/privkey.pem;
# Asset Caching
  include /etc/nginx/conf.d/include/assets.conf;
# Block Exploits
  include /etc/nginx/conf.d/include/block-exploits.conf;
# HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
  add_header Strict-Transport-Security $hsts_header always;
# Force SSL
  set $trust_forwarded_proto "T";
  include /etc/nginx/conf.d/include/force-ssl.conf;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;
  access_log /data/logs/proxy-host-10_access.log proxy;
  error_log /data/logs/proxy-host-10_error.log warn;
  location / {
# HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
  add_header Strict-Transport-Security $hsts_header always;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $http_connection;
  proxy_http_version 1.1;
# Proxy!
  include /etc/nginx/conf.d/include/proxy.conf;
  }
# Custom
  include /data/nginx/custom/server_proxy[.]conf;
}


# ------------------------------------------------------------
# mesh.domain
# ------------------------------------------------------------
map $scheme $hsts_header {
  https   "max-age=63072000;includeSubDomains; preload";
}
server {
  set $forward_scheme https;
  set $server     "local-ip";
  set $port       443;
  listen 80;
listen [::]:80;
listen 443 ssl;
listen [::]:443 ssl;
  server_name mesh.domain;
  http2 on;
# Let's Encrypt SSL
  include /etc/nginx/conf.d/include/letsencrypt-acme-challenge.conf;
  include /etc/nginx/conf.d/include/ssl-cache.conf;
  include /etc/nginx/conf.d/include/ssl-ciphers.conf;
  ssl_certificate /etc/letsencrypt/live/npm-6/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/npm-6/privkey.pem;
# Block Exploits
  include /etc/nginx/conf.d/include/block-exploits.conf;
# HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
  add_header Strict-Transport-Security $hsts_header always;
# Force SSL
  set $trust_forwarded_proto "T";
  include /etc/nginx/conf.d/include/force-ssl.conf;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;
  access_log /data/logs/proxy-host-11_access.log proxy;
  error_log /data/logs/proxy-host-11_error.log warn;
proxy_set_header Host $host;
proxy_set_header CF-Connecting-IP $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host:$server_port;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
  location / {
# HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
  add_header Strict-Transport-Security $hsts_header always;
  
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $http_connection;
  proxy_http_version 1.1;
  
# Proxy!
  include /etc/nginx/conf.d/include/proxy.conf;
  }
# Custom
  include /data/nginx/custom/server_proxy[.]conf;
}


# ------------------------------------------------------------
# rmm.domain
# ------------------------------------------------------------
map $scheme $hsts_header {
  https   "max-age=63072000;includeSubDomains; preload";
}
server {
  set $forward_scheme https;
  set $server     "local-ip";
  set $port       443;
  listen 80;
listen [::]:80;
listen 443 ssl;
listen [::]:443 ssl;
  server_name rmm.domain;
  http2 on;
# Let's Encrypt SSL
  include /etc/nginx/conf.d/include/letsencrypt-acme-challenge.conf;
  include /etc/nginx/conf.d/include/ssl-cache.conf;
  include /etc/nginx/conf.d/include/ssl-ciphers.conf;
  ssl_certificate /etc/letsencrypt/live/npm-6/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/npm-6/privkey.pem;
# Asset Caching
  include /etc/nginx/conf.d/include/assets.conf;
# Block Exploits
  include /etc/nginx/conf.d/include/block-exploits.conf;
# HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
  add_header Strict-Transport-Security $hsts_header always;
# Force SSL
  set $trust_forwarded_proto "F";
  include /etc/nginx/conf.d/include/force-ssl.conf;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;
  access_log /data/logs/proxy-host-12_access.log proxy;
  error_log /data/logs/proxy-host-12_error.log warn;
  location / {
# HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
  add_header Strict-Transport-Security $hsts_header always;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $http_connection;
  proxy_http_version 1.1;
# Proxy!
  include /etc/nginx/conf.d/include/proxy.conf;
  }
# Custom
  include /data/nginx/custom/server_proxy[.]conf;
}

[farfromexact]

The configuration is a useful working example, but I would keep a few security and proxy details explicit so people do not copy it into a subtly unsafe deployment.

With Cloudflare in front of Nginx Proxy Manager, the intended chain should be:

client -> Cloudflare HTTPS -> NPM HTTPS -> TacticalRMM service

Use Full (strict) at Cloudflare, a valid origin certificate in NPM, and firewall the public origin so only the documented Cloudflare IP ranges can reach it. The NPM host must still allow the chosen ACME/DNS challenge path, and the internal upstream should use the actual TacticalRMM API/mesh ports rather than assuming every service listens on 443.

The websocket headers are important for mesh/agent connections, but preserve the original Host and forwarded scheme as well so redirects and secure-cookie decisions are correct. Test both an ordinary API request and a websocket upgrade; a proxy can return a healthy HTML response while silently breaking the websocket path.

I would also avoid blanket HSTS with includeSubDomains unless every subdomain under the parent is guaranteed to be HTTPS. Keep API and mesh hostnames separate if their access policies differ, and do not expose the NPM administration interface through the same public proxy rules.

For a reproducible guide, include a short validation checklist: Cloudflare SSL mode, origin certificate, DNS-only test, API login, websocket/agent connectivity, and the NPM error log during a failed upgrade. That will make it easier to distinguish Cloudflare filtering, NPM routing, and TacticalRMM application errors.

[disgustipated]

You have a lot of includes to other conf files listed here, this setup will not likely help many if those are not shared as well.