Home Assistant Community Add-on: Nginx Proxy Manager

madface · December 26, 2022, 1:21pm

DNS makes my router, as it can see only the docker ip all container names have the same ip.
But i think i found the problem, it is about my ipv4 / v6 configuration.
Described here

In host mode it is passed. But host mode is only available on Linux.

A special situation is when the docker host is ipv4 and ipv6 (which is quite normal today) and the containers are ipv4 only.
Then clients connecting per ipv4 are connecting the host per ipv4 (host mode/Linux only) and the correct client source address is seen in the container.
But if the client connects with ipv6 it is routed through the docker_gwbridge per ipv4 and the container can only see the IP address of the bridge. MS would say this is a feature

For a test i disabled ipv6 on my machine connecting to ha. And voila, the logs show my external ip (the one from my provider). Enabled v6 again, and it reverted to 172.30.32.1. So nginx x_forwarded_for works, but nginx does not see the real adress but only the docker ip.
Only solution at the moment seems to be to start the docker container with network_mode: host but i think this is not possible using one of the addons.
Again, thank you for helping, in the end it shoed me where to look further and my originally problem ist solved

sundancekid80 · January 3, 2023, 9:40am

Hi! I’m using the NGINX addon with DuckDNS + Letsencrypt to access my HA (VM in ProxMox) instance externally. Now,I’d like to access additional internal VM:s through the reverse proxy. Is this possible? If it is - is there a guide?

BR,
Niklas

flobidan · January 10, 2023, 11:14am

Yes, this is possible.
Not sure if there is a guide somewhere, but you can even achieve that with additional duckdns subdomains from you current duckdns domain. I went through this, maybe this post and the following ones by me help:

lotohov · March 11, 2023, 9:08am

btw ! help ! i have problems while accesing ESPHOME and VSCODE addons iternaly by the addon , chrome browser shows blank page. other addons works well
edge shows 401: Unauthorized

when connecting without addon by local ip and http addons loading but working bad due to insecure http

Chaoscontrol · March 22, 2023, 7:42pm

Has anyone experienced getting their domains flagged as deceptive/phishing from Google after using NPM?

I moved from using NGINX Proxy SSL to NPM a few weeks ago due to needing to redirect more than 1 domain to different services, and wanted secure access. Not sure how long after, my the subdomain (from DuckDNS) that I was using to access HA was flagged as dangerous.
Shortly after, the other subdomain I was using to access this other addon was also flagged.

I have seen reports of people using DuckDNS subdomains of these issues. So I went and decided to use a domain of my own.
It was instaflagged too, and not only my own subdomain, but the main domain too (which was pointing to our business website). It caused quite a big deal of trouble tbh. Since it’s Google’s flagging system, it doesn’t allow you to use OAuth services with Google’s either.

After that I went ahead and did further testing today. I retraced my steps, went back to DuckDNS (same subdomain I was using) + NGINX Proxy SSL (NPM deactivated). So far it’s not being flagged, which is making me strongly suspicious NPM was indeed the culprit, and I’m not sure why.

I actually need to use NPM, as I said, since I need more than just HA to be accessible remotely. And NPM was easy enough for me (non-dev) to use, including the SSL certs.

DJJo14 · March 22, 2023, 8:26pm

My domain has also been flagged and as far as i can see this happens to a lot of us. (i have also seen something similar with other software)
you can read more about it at:

~~What do you mean by NPM? is that an option in Nginx Proxy Manager?~~
edit: did not know it was short for Nginx proxy manager.

I am looking for a solution for this.

but it is still interesting that NGINX Proxy SSL works but NPM not, but still implements the NGINX, this sounds like a option

grosilver · March 22, 2023, 9:32pm

I have sent report to Google and few hours later it all went back to normal

Chaoscontrol · March 22, 2023, 11:09pm

@grosilver And did it never happen again? I cannot risk my entire domain to this happening once in a while. It fucked up our emails, everything started being rejected everywhere… it was a bit of chaos. Actually I’ve reported it this morning and I’m still waiting for it to be fixed.

@DJJo14 Yeah, I’ve seen that thread but it relates to DuckDNS. It was my first thought. But as I said, I tested with a domain of my own, doing DDNS on my own, without any connection to DuckDNS. And the domain was instantly flagged as soon as it connected to my local server. Which leads me to believe it’s not DuckDNS fault, but NPM…

Edit: so… today the DuckDNS subdomain shows as dangerous again, just using NGINX Proxy SSL. So NPM itself is not to blame then. I’m going to deactivate it and see if DuckDNS alone is still flagged, so I can blame reverse proxies in general.

Fred-DTV · March 24, 2023, 1:09pm

I had to restore HomeAssistant from a backup and ever since my NGINX proxies don’t work anymore.

I was able to renew the certificates, all the port forwarding is still the same as before.
When I try to test the server reachability in NGINX I get this error: Communication with the API failed, is NPM running correctly?

I was reading through this thread but couldn’t find anything on how to restart/reinstall NPM in homeasssistant or in the NGINX add-on.

Can anyone help me here?

EDIT: Oh just realized NPM stands for NGINX Proxy Manager haha now I am even more confused. I have reinstalled the addon already and nothing changed

SOLVED: Now I feel stupid: It was all caused by a typo in the general network gateway settings of the Pi… Thanks for coming to my TED Talk

loungelizard2018 · April 3, 2023, 4:08pm

thanks - should be sticky or in some FAQ. totally helped me out. !

Stooovie · April 10, 2023, 2:38pm

same, in 2023. I haven’t accessed the addon for a couple of months because I didn’t need to, and now I cannot log in. Password is managed by Bitwarden and should be correct.

Stooovie · April 10, 2023, 2:40pm

Same. Cannot log in.

lotohov · May 21, 2023, 6:58pm

answer to myself. fixed by adding aditional configuration

location / {
# Needed to workaround VSCode Web Socket Origin error
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;
proxy_set_header X-Forwarded-Host $http_host;

# Proxy!
include conf.d/include/proxy.conf;
}

Buzze · May 23, 2023, 4:33pm

Hi, with the Nginx Proxy Manager is the ZeroSSL cert with automated renew supported, if so, how to configure it? The ZeroSSL support page says it’s a partner with nginx-proxy, but there are two nginx proxy’s available inside the HA Add-on store, which one is it? I’m a noob when it comes to ssl certificates, until now i configured them manually (generating the cert inside ZeroSSL web and downloading the certs and uploading to HA and using the configuration.yaml to locate the cert and key)

Logic1 · May 25, 2023, 10:15pm

May I ask where you added this config?
I tried adding it here, but then the proxy goes offline:

lotohov · May 26, 2023, 8:42am

i added it here. btw loks like it broke esphome for a little /example you cant see logs from outside . look next post for solution

lotohov · May 26, 2023, 10:30am

And another fix to make working esphome but i cant set them both

github.com/esphome/issues

ESPHOME and NGINX Proxy Manager SSL proxy HA addon don't play nicely

opened 12:40PM - 19 Mar 23 UTC

mcarbonneaux

### The problem In fact esphome don't accept the normal way of nginx is trans…miting the browser request host and port to esphome throught ha ingress. by default when firewall is on front and expose the nginx with diferent port than the nginx port (is the case of nginx proxy manager ha addons is 443) this port are not transmited by default by nginx (nginx use the 443 port in place), and the esphome refuse the connection. For example: - firewall on port 12345 on public ip -> homeassistant nginx proxy manager port 443 on ha private ip (ex: 192.168.xx.xx the ha os ip) -> homeassistant core ui on 8123 (on local container private ip) with the way of nginx do the 12345 port are not transmited to the backend (the backend receive 443 in place)... I've found a "clean way" to fix this use of ha ingress with esphome using NGINX proxy manager addon (base on exchange on https://github.com/esphome/issues/issues/1035#issuecomment-697560334) by using `custom location` of `nginx proxy manager`. i've added the location `/api/hassio_ingress/` on the `Proxy Host` to `homeassistant/api/hassio_ingress/` on `8123` port, with `http` protocol: ![image](https://user-images.githubusercontent.com/8479023/224751332-917683b8-6dd5-4451-8b8f-38b79f009d0f.png) and i've added the custom configuration : ``` proxy_set_header Host $http_host; ``` to force to use the `hostname` **AND** `port` from the browser as transmited by using (`$http_host` nginx variable) the `Host` header received in place of the nginx variable `$host` that not containe the request port. - see https://serverfault.com/questions/706438/what-is-the-difference-between-nginx-variables-host-http-host-and-server-na and also configured `Websockets support` on the `proxy host` : ![image](https://user-images.githubusercontent.com/8479023/224750465-f7d3cf5c-157e-4a2c-9fc5-639aebc99716.png) ### Which version of ESPHome has the issue? 2023.3.0 ### What type of installation are you using? Home Assistant Add-on ### Which version of Home Assistant has the issue? 2023.3.5 ### What platform are you using? ESP8266

after some attempts to learn ngnix i did the trick
solution

proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;

and

Custom Nginx Configuration

location / {
    location  /api/hassio_ingress { 
    }
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;
proxy_set_header X-Forwarded-Host $http_host;

# Proxy!
include conf.d/include/proxy.conf;
}

be careful with structure and chek it )

martymarty004 · June 2, 2023, 11:23pm

Hi, I’m trying to configure access lists on NPM to prevent external access to some services I am going to add, but they don’t seem to be working because the IP that Nginx sees for every client is 172.30.32.1.
This is also an issue because the HA ip_ban system also detects the same IP.
If I use WireGuard, the IP which gets recorded is my home network public IP.

From what I read, adding an X-Forwarded For header should do the trick, but I don’t know how to do that, especially for the VPN traffic.

Also, how do I decide if I can enable cache assets, web sockets support and http/2 support depending on the service I’m using? (I’m my case I’d like to configure HA, Bitwarden, UniFi app, Node-RED dashboard and Nginx itself)

HA, WG (add-on) and NPM (add-on) are all hosted on my RPi.

Thanks in advance.

peter.vk · July 21, 2023, 9:33pm

Sorry if this is a stupid question, but will this add on conflict with dyndns & SSL certificates run/installed directly on my UDM Pro router?

I have a domain for my UDM Pro using Duck DNS and SSL certificates using GitHub - alxwolf/ubios-cert: Manage SSL / TLS certificates with acme.sh (Let's Encrypt, ZeroSSL) for Ubiquiti UbiOS firmwares.

I would like to setup https access to the Plex addon, as well as Overseerr and it looks like the Nginx Proxy Manager is designed to do this, but I’m worried that either it won’t work or will conflict with the ubios-cert setup.

So can I simply install the Nginx Proxy Manager addon, or do I first need to undo the ubios-cert and dydns setup on my UDM Pro?

lotohov · August 9, 2023, 2:26pm

i think u must use different ports and subdomains and forward port 80 to pass letsencrypt check