105 lines
3.4 KiB
YAML
105 lines
3.4 KiB
YAML
app:
|
|
id: nginx-proxy-manager
|
|
name: Nginx Proxy Manager
|
|
version: 2.14.0
|
|
upstream:
|
|
kind: github
|
|
repo: NginxProxyManager/nginx-proxy-manager
|
|
description: >-
|
|
Reverse proxy with SSL. Beautiful web interface for managing proxies.
|
|
The node's public web server forwards configured domains through this
|
|
service, preserving its access lists, certificates and custom routes.
|
|
backup_before_runtime_change: true
|
|
|
|
container:
|
|
image: source.archipelago-foundation.org/lfg2025/nginx-proxy-manager@sha256:8b91afcca90f5f2a7b2b8937999824f623c8a8748ae8013a1c9bf94f62177f08
|
|
pull_policy: if-not-present
|
|
# Rootless pasta copies the LAN IP, preventing requests back to this node.
|
|
# Retain the old pasta host gateway used by saved NPM upstreams, plus
|
|
# host.containers.internal. This subnet stays inside the private rootless namespace.
|
|
network: slirp4netns:allow_host_loopback=true,cidr=169.254.1.0/24
|
|
|
|
dependencies:
|
|
- storage: 1Gi
|
|
|
|
resources:
|
|
memory_limit: 512Mi
|
|
disk_limit: 1Gi
|
|
|
|
security:
|
|
# NET_BIND_SERVICE is load-bearing, not decoration: NPM's internal nginx
|
|
# listens on 80, 443 AND 81, and the orchestrator runs --cap-drop=ALL —
|
|
# without this cap every start dies with "bind() to 0.0.0.0:80 failed
|
|
# (13: Permission denied)" and s6 restart-loops forever (shorty-s,
|
|
# 2026-09-01, restart counter 3176 within hours of the manifest
|
|
# conversion). The legacy podman-run path defaulted to the full cap set,
|
|
# which is why it never showed there.
|
|
capabilities: [CHOWN, SETUID, SETGID, DAC_OVERRIDE, NET_BIND_SERVICE]
|
|
readonly_root: false
|
|
no_new_privileges: true
|
|
network_policy: isolated
|
|
|
|
ports:
|
|
- host: 8081
|
|
container: 81
|
|
protocol: tcp
|
|
bind: 127.0.0.1
|
|
# open, not gated: NPM carries a complete admin login of its own. The
|
|
# gate still fronts the port (TLS on the same port, header fixes, retry
|
|
# page, Tor) without putting a cookie challenge in front of it.
|
|
auth: open
|
|
auth_rationale: >-
|
|
Nginx Proxy Manager enforces its own admin account on every page;
|
|
the initial setup wizard also has to answer before any account exists.
|
|
|
|
- host: 8088
|
|
container: 80
|
|
protocol: tcp
|
|
bind: 127.0.0.1
|
|
auth: local
|
|
- host: 8444
|
|
container: 443
|
|
protocol: tcp
|
|
bind: 127.0.0.1
|
|
auth: local
|
|
|
|
volumes:
|
|
- type: bind
|
|
source: /var/lib/archipelago/nginx-proxy-manager
|
|
target: /data
|
|
options: [rw]
|
|
# Current NPM images refuse to start unless /etc/letsencrypt is a mount in
|
|
# its own right. Keeping the files below the same persistent app directory
|
|
# preserves existing certificates while satisfying that startup contract.
|
|
- type: bind
|
|
source: /var/lib/archipelago/nginx-proxy-manager/letsencrypt
|
|
target: /etc/letsencrypt
|
|
options: [rw]
|
|
|
|
environment: []
|
|
|
|
# Probe the admin API inside the container, independent of optional
|
|
# tunnel listeners. This also verifies the Node backend is ready.
|
|
health_check:
|
|
type: http
|
|
endpoint: http://127.0.0.1:81/api/
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
|
|
interfaces:
|
|
main:
|
|
name: Admin UI
|
|
description: Nginx Proxy Manager admin interface
|
|
type: ui
|
|
port: 8081
|
|
protocol: http
|
|
path: /
|
|
|
|
metadata:
|
|
author: Nginx Proxy Manager
|
|
category: networking
|
|
icon: /assets/img/app-icons/nginx.svg
|
|
repo: https://github.com/NginxProxyManager/nginx-proxy-manager
|
|
tier: optional
|