Reverse Proxy for Media Apps: Nginx Proxy Manager, SSL, Access Lists, and Security

Keep Sonarr, Radarr, Prowlarr, SABnzbd, Tdarr, NAS administration, and the Nginx Proxy Manager dashboard private. Use LAN or VPN access by default. Add a reverse proxy only for a hostname that has a real remote-user requirement, and keep application authentication, patching, isolation, backups, and logging behind it.

Rights and lawful use: This reverse-proxy workflow assumes Sonarr, Radarr, Prowlarr, SABnzbd, Plex, and Tdarr manage media you own or may lawfully use. A protected hostname does not authorize downloading, storing, sharing, or processing someone else's copyrighted material.

Who this is for: This guide is for a media-stack operator deciding which Nginx Proxy Manager hosts may receive public traffic, which Arr dashboards belong behind LAN or VPN access, and how to validate that boundary.

What a Reverse Proxy Gives You

A reverse proxy gives you clean hostnames, HTTPS certificates, centralized access rules, and a single place to manage how internal services are reached. Instead of remembering http://10.0.0.10:8989, you can use a friendly name such as sonarr.example.com. More importantly, you can decide which apps are LAN-only, which require authentication, and which should never be reachable from the public internet.

GUI vs CLI

Nginx Proxy Manager is a web GUI for managing Nginx proxy hosts. You still need to understand the networking decisions, but you do not need to hand-write every Nginx server block. It supports proxy hosts, redirections, streams, Let's Encrypt certificates, access lists, basic authentication, user management, and advanced Nginx snippets when needed.

What Should Be Exposed

• Plex: usually handled through Plex Remote Access rather than a normal web admin proxy, unless you have a specific reverse proxy design.
• Sonarr/Radarr/Prowlarr/SABnzbd/Tdarr: administrative apps. Keep them LAN-only, VPN-only, or behind strong proxy protections.
• Nginx Proxy Manager admin UI: should not be public unless heavily protected. Treat it like infrastructure control.
• Public websites: good proxy candidates because they are meant to be public.

1. PublicInternet Edge

   Only intentionally public services should reach the reverse proxy from the internet.

2. ProxyNginx Proxy Manager

   Handles hostnames, TLS, access lists, and logging for approved services.

3. AuthApp Authentication

   Require strong app auth, unique passwords, HTTPS, and access controls.

4. PrivateMedia Admin Apps

   Sonarr, Radarr, Prowlarr, SABnzbd, Tdarr, NAS, and proxy admin should stay LAN/VPN by default.

5. InternalAPI Calls

   App-to-app API calls should use internal URLs, not public hostnames.

Do not port-forward admin appsNever expose Sonarr, Radarr, Prowlarr, SABnzbd, Tdarr, NAS admin, or NPM admin directly.

Protect logs and headersWatch X-Forwarded-For trust, source IP handling, and proxy logs.

Basic Nginx Proxy Manager Deployment

sudo mkdir -p /opt/nginx-proxy-manager
cd /opt/nginx-proxy-manager
cat > docker-compose.yml <<'EOF'
services:
  npm:
    image: jc21/nginx-proxy-manager:latest
    container_name: nginx-proxy-manager
    ports:
      - "80:80"
      - "443:443"
      - "127.0.0.1:81:81"
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
    restart: unless-stopped
EOF
docker compose up -d
docker compose logs --tail=100 npm

Production Docker note: After the Nginx Proxy Manager test host is stable, replace jc21/nginx-proxy-manager:latest with a release tag or digest you have selected, preserve both ./data and ./letsencrypt, and verify a private hostname and certificate state before returning ports 80 and 443 to service.

Keep this interface policy after deployment: expose only ports 80 and 443 at the edge, and reach the port 81 management UI through the host, an SSH tunnel, or a VPN. Confirm the host firewall and upstream router do not publish port 81 before adding any proxy hosts.

DNS and Certificates

For HTTPS, you need DNS that points the hostname to the proxy and a certificate that covers the hostname. Nginx Proxy Manager can request Let's Encrypt certificates. A DNS challenge is often useful for wildcard certificates or services you do not want to expose just to complete certificate validation.

Access Lists

Access lists are one of the biggest reasons to use a proxy manager for homelab apps. You can allow only LAN IP ranges, require basic authentication, or deny everything except a VPN subnet. This is not a replacement for application security, but it adds a layer before the request ever reaches Sonarr, Radarr, or SABnzbd.

Example access idea:
Allow:
  10.0.0.0/8
  192.168.0.0/16
  YOUR_VPN_SUBNET

Deny:
  all

Synology Reverse Proxy vs Nginx Proxy Manager

A Synology reverse proxy can be enough if your needs are simple: a few hostnames, SSL, and basic routing. Nginx Proxy Manager makes sense when you want easier app-by-app rules, a dedicated dashboard, access lists, certificate management, and future flexibility independent of the NAS. The decision is not about which one is more impressive. It is about where you want proxy policy to live.

Security Rules for Media Admin Apps

• Do not expose admin apps directly by port forwarding.
• Use HTTPS for any remotely reachable admin interface.
• Use access lists or VPN for Sonarr, Radarr, Prowlarr, SABnzbd, and Tdarr.
• Use strong unique passwords for every app.
• Disable default credentials immediately.
• Keep proxy manager itself patched and backed up.
• Log enough to investigate suspicious requests.
• Do not publish API keys in screenshots or blog posts.

Troubleshooting

• 502 Bad Gateway: proxy cannot reach the upstream host or port.
• SSL error: certificate, DNS, or challenge failed.
• App loads without CSS: base URL or forwarded headers may be wrong.
• Login loops: check proxy headers, HTTPS settings, and app URL base.
• API errors: make sure integrations use internal URLs when they are on the same LAN.

How This Ties Into the Series

The proxy article sits after the app setup articles because exposure should come after the apps are stable. First make Sonarr, Radarr, Prowlarr, SABnzbd, Plex, and Tdarr work internally. Then add hostnames, TLS, and access controls. A reverse proxy should make a stable environment easier to use, not hide a broken internal design.

Beginner Walk-Through: Proxy Host vs Port Forward

A port forward sends outside traffic directly to an internal service. A reverse proxy receives the traffic first and forwards it based on hostname and rules. That gives you one place for HTTPS certificates, access lists, and routing. It does not automatically make an unsafe app safe. It gives you a better control point.

Technical Header Notes

Some apps need correct forwarded headers so they understand the original protocol and host. If an app generates broken links, loses CSS, or loops during login, check base URL settings and proxy headers. For apps that are only used by other apps on the LAN, use internal URLs instead of forcing API traffic through the public proxy.

Exposure Decision Matrix

• Public website: good reverse proxy candidate.
• Plex playback: usually use Plex Remote Access unless you have a specific design.
• Sonarr/Radarr/Prowlarr/SABnzbd/Tdarr: LAN, VPN, or access-list protected.
• Nginx Proxy Manager admin: private management only.
• NAS admin: private management only.

Implementation Playbook: Nginx Proxy Manager on Ubuntu with Docker

Install Docker and Start NPM

sudo mkdir -p /opt/nginx-proxy-manager
cd /opt/nginx-proxy-manager
cat > docker-compose.yml <<'EOF'
services:
  npm:
    image: jc21/nginx-proxy-manager:latest
    container_name: nginx-proxy-manager
    ports:
      - "80:80"
      - "443:443"
      - "127.0.0.1:81:81"
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
    restart: unless-stopped
EOF
docker compose up -d
docker compose logs --tail=100 npm

Port 81 is the management UI. Binding it to 127.0.0.1 means you manage it from the host, SSH tunnel, VPN, or another deliberate access path. Public traffic should normally be limited to ports 80 and 443, with each admin app protected by access lists and app-level authentication.

Create a Proxy Host

1. Create DNS for the hostname, such as sonarr.example.com.
2. In NPM, add a Proxy Host.
3. Set scheme to http unless the upstream app itself uses HTTPS.
4. Set forward hostname/IP to the internal app host.
5. Set the forward port, such as 8989 for Sonarr.
6. Enable Websockets if the app needs live UI updates.
7. Request a Let's Encrypt certificate.
8. Attach an access list for LAN/VPN-only admin apps.

Access List Baseline

Allow:
  10.0.0.0/8
  172.16.0.0/12
  192.168.0.0/16
  YOUR_VPN_SUBNET

Deny:
  all

Verification

host="sonarr.example.com"

curl -I "https://$host"
docker logs --tail=100 nginx-proxy-manager

openssl s_client \
  -connect "$host:443" \
  -servername "$host" \
  </dev/null 2>/dev/null \
  | openssl x509 \
      -noout \
      -issuer \
      -subject \
      -dates

Do not route internal API traffic through the public proxy unless you need to. Radarr, Sonarr, SABnzbd, Tdarr, and Prowlarr can usually talk to each other on internal LAN URLs.

Backup, Update, and Rollback

Nginx Proxy Manager's proxy hosts, users, access lists, and database live under the persistent /data mapping; certificate and ACME state live under /etc/letsencrypt. Back up both host directories together, along with the Compose file and the exact tested image reference. Protect the archive because it can contain account data, private keys, and provider credentials.

cd /opt/nginx-proxy-manager
docker compose stop npm
sudo tar -C /opt -czf /secure-backups/npm-$(date +%F).tgz \
  nginx-proxy-manager
docker compose start npm
docker compose ps
docker compose logs --tail=100 npm

Adjust paths and the Compose service name to the actual installation. A file's existence does not prove recovery. Periodically restore the archive into an isolated host or alternate directory, start the same tested image, and confirm proxy-host definitions and certificates without changing production DNS.

Before an update, record the current image digest or version, test certificate renewal status, and retain the backup. If the new container fails, stop it, restore both persistent directories, return to the prior image reference, and validate a private test hostname before reopening public traffic. If a private key or DNS API credential may have been exposed, replacement and certificate revocation may be required; restoring an old archive does not undo credential compromise.

What the Proxy Does Not Prove

• A valid certificate proves control for issuance; it does not prove the upstream application is secure.
• An NPM access list does not prove the backend cannot be reached directly on its LAN port.
• Basic authentication is not equivalent to strong application identity or phishing-resistant multifactor authentication.
• A successful curl request does not validate authorization, session handling, WebSockets, large uploads, or every application workflow.
• Forwarded headers are security-sensitive. Only trust them from the controlled proxy path, and prevent clients from bypassing the proxy to the backend.

Evidence limit: The commands and checks are documentation-backed procedures. TechGeeks did not deploy this Compose file, capture certificate-renewal logs, or run an authorized web security test against these applications for this revision.

Related TechGeeks resources

• What Is the Safest Way to Expose One Self-Hosted App Publicly?
• WireGuard Home VPN: Secure Remote Access for Your Homelab
• Backup and Disaster Recovery for the Plex and Arr Stack

Series Navigation

Within the Plex, Arr, and Tdarr series, this entry owns the edge boundary: TLS termination, Nginx Proxy Manager access lists, backend reachability, and rollback for ports 80 and 443. Use the neighboring storage, application, and backup guides for the systems behind that proxy.

• Plex Homelab Architecture: Storage, GPU Transcoding, and Library Design
• Media Server Storage Design: NAS, CIFS/NFS Mounts, Permissions, and Local Cache
• Prowlarr Setup Guide: Clean Indexer Management for Sonarr and Radarr
• Sonarr Homelab Setup Guide: Install, Update, Optimize, and Connect to Tdarr
• Radarr Homelab Setup Guide: Install, Update, Optimize, Lists, and Tdarr Integration
• SABnzbd Performance Tuning for a Homelab Media Server
• Custom Formats and Quality Profiles Explained for Radarr and Sonarr
• Radarr Import Lists That Do Not Fill Your Library With Junk
• Plex + Tdarr GPU Strategy: Sharing NVIDIA GPUs Without Hurting Playback
• Reverse Proxy for Media Apps: Nginx Proxy Manager, SSL, Access Lists, and Security
• Backup and Disaster Recovery for Plex, Sonarr, Radarr, Tdarr, Prowlarr, and SABnzbd
• Monitoring and Health Checks for a Plex and Arr Homelab
• The Complete Plex, Arr, and Tdarr Homelab Media Automation Series

Related foundation: Building a Production-Grade Tdarr GPU Transcoding Stack for a Homelab.

References

• Nginx Proxy Manager setup documentation
• Nginx Proxy Manager guide
• Let's Encrypt documentation
• Let's Encrypt certificate revocation
• Plex Remote Access
• Plex secure server connections
• OWASP Web Security Testing Guide