Nginx Proxy Manager

Nginx Proxy Manager is the only container on the Docker host with an exposed port, 443. Every other container that runs a service sits behind it as a proxy host, each with its own dedicated certificate so hosts can be added or removed on the fly, all through its own web UI instead of hand-written Nginx config files. Nothing else on the host is reachable directly, which keeps the attack surface down to this one container.

Certificates are signed by OPNsense’s internal CA rather than a public authority like Let’s Encrypt, since these services aren’t exposed to the internet. That CA is trusted on every personal device, so browsers still see a valid certificate with no warnings.

It also proxies Frigate’s web UI on its dedicated server, configured the same way through its own instance there. Deployed through the generic Compose stack rather than a dedicated role, since proxy hosts and certificates are managed by hand through the UI on both instances.