NPMplus: A Hardened Nginx Proxy Manager Fork That Actually Cares About Security

You know the drill: you spin up nginx-proxy-manager, get your reverse proxy running in twenty minutes, and then spend the next six months wondering if your TLS config is actually good enough. The defaults are fine for a homelab, but "fine" isn't great when you're exposing services to the internet. That's where NPMplus comes in—a fork of nginx-proxy-manager that takes the familiar GUI you already know and layers on a serious security upgrade.

What It Does

NPMplus is a drop-in fork of nginx-proxy-manager that keeps the same web-based management interface but fundamentally reworks what happens under the hood. At its core, it's still an nginx reverse proxy with a nice UI for managing hosts, SSL certificates, and access controls. But the fork diverges from upstream in some significant ways.

The most notable changes are in the TLS and protocol department. NPMplus ships with HTTP/3 (QUIC) support, which means you get faster connections over UDP for your HTTPS traffic. It also includes a patched nginx build compiled from source with aws-lc, enforced cipher and curve ordering, and certificate compression using zlib-ng and brotli. The project even offers optional encrypted client hello (ECH) support, which is about as bleeding-edge as TLS gets right now.

The architecture is Alpine-based, making the image considerably smaller than the upstream version. It supports x86_64-v2 and aarch64/arm64 architectures, with SQLite as the recommended database (MariaDB and PostgreSQL technically work but are unsupported and offer no advantages here). The web UI itself runs over HTTPS rather than HTTP, which is a small change that says a lot about the project's priorities.

Why It's Cool

Let me be direct: this fork isn't just nginx-proxy-manager with a fresh coat of paint. The changes list reads like a security hardening checklist that someone actually bothered to implement.

HTTP/3 out of the box. You don't need to fiddle with Cloudflare or a separate service to get QUIC working. Just expose UDP on port 443 and you're done. That's genuinely refreshing for a self-hosted setup.

Crowdsec integration. The README mentions both crowdsec and appsec support, which means you can plug in crowdsec's IP reputation and behavioral detection directly into your reverse proxy layer. That's a meaningful upgrade over the static access lists you'd normally configure.

Built-in auth support that doesn't require advanced config. The project includes native auth_request support for common auth providers, plus OIDC login for the web UI itself. You can add OIDC authentication to your proxied services without writing custom nginx snippets.

Security headers and fingerprint stripping are automatic. Based on the OWASP secure headers project, NPMplus always sends proper security headers and strips identifying server fingerprints. The web UI itself is hardened with strict CSP, httpOnly cookies instead of local storage, and rate limiting.

Multiple serving modes per host. You're not limited to plain HTTP proxying. The fork supports gRPC, proxy protocol, load balancing across multiple upstreams, and even serving static files or PHP directly with fancyindex support. That flexibility is handy when you're running mixed workloads.

Short-lived Let's Encrypt certificates by default. This is a nice touch—shorter cert lifetimes mean less damage if a private key leaks, and the project properly supports other ACME servers too.

There are also practical quality-of-life features: mTLS with client certificates per host, multiple access lists per host and per location, zstd and brotli compression alongside gzip, punycode domain support, and Goaccess log analytics served at /goaccess within the web UI. There's even a password/MFA reset script for SQLite installs: docker exec -it npmplus password-reset.js USER_EMAIL.

One honest caveat: this fork is licensed under AGPL-3.0-or-later, not the MIT license of upstream. If you're planning to use it as a base for commercial software, that matters. Also, some certbot DNS plugins have been replaced (he, dnspod, online, powerdns, and do), so certs using those providers won't renew and will need to be recreated.

How to Try It

Getting started is straightforward if you're already comfortable with Docker. The project is available at github.com/zoeyvid/npmplus, and the repository contains a compose.yaml file that serves as the canonical configuration reference.

You'll want to pull the image and set up your compose file based on the examples in the repo. A few things to remember from the README:

1. Expose UDP/QUIC on the HTTPS port (443/udp) if you want HTTP/3 to work.
2. If you enable HSTS, consider adding your domain to the HSTS preload list.
3. If you're migrating from upstream nginx-proxy-manager, the repo has a migration guide—check the README section on that before you start.
4. The project won't trust Cloudflare IPs unless you explicitly set TRUST_CLOUDFLARE to true, and you should read the notes on Cloudflare before doing so.

If you're on an unsupported architecture (anything 32-bit, or plain x86-64 without v2 extensions), this isn't for you. But if you're on modern hardware, you can check compatibility with /lib/ld-linux-x86-64.so.2 --help on x86_64 systems.

Final Thoughts

NPMplus is clearly built by someone who got tired of bolt-on security fixes and decided to bake hardening into the foundation. It's not a revolutionary concept—it's a fork that does the work upstream hasn't gotten around to. The trade-offs are real: AGPL licensing, some unsupported DNS providers, and a narrower architecture range. But if you're self-hosting on a modern machine and want a reverse proxy that ships with decent security defaults instead of promising them in a future roadmap, this is worth a serious look. The project is actively maintained, the documentation is honest about limitations, and the feature list speaks for itself.

Follow @githubprojects for more developer tools and open source projects.