Setting up nginx as a reverse proxy
If you run more than one service on a server, you need a single entry point in front of them. Instead of setting up a web server and SSL inside every service, it gets handled once, in one place. We will use jwilder/nginx-proxy . It watches the Docker socket and builds nginx config automatically, based on labels and env vars on your containers. No manual nginx.conf editing every time you add a…
To run multiple services on a server, a reverse proxy is needed to serve as the single entry point. The jwilder/nginx-proxy container automates the creation of nginx configurations based on container labels and environment variables. This eliminates the need to manually edit the nginx.conf file each time a new service is added.
Requirements include a server with Docker and the Docker Compose plugin installed, a domain name pointing to the server, and familiarity with Docker Compose files. The nginx-proxy container exposes ports 80 and 443 and reads the Docker socket to manage container routing. It mounts several volumes, including one for custom nginx snippets per domain, which can be used to restrict access to specific endpoints.
HTTPS is secured with acme-companion, which pairs with nginx-proxy and handles Let's Encrypt certificates. The acme-companion container shares the same certificate volume as nginx-proxy, ensuring both can access the same certificate files. The docker-compose.yml file combines both containers, volumes, and networks.
The environment variable EMAIL is used by acme-companion as the default contact address for Let's Encrypt. This should be replaced with a valid email address. The webproxy network is marked external, meaning it is not created by the compose file. This network must be created manually before deploying any services behind the proxy.
A dedicated folder, /srv/nginx-vhosts, is created for per-domain nginx snippets. Services place their own config fragments here to customize routing, headers, or other settings. The acme-companion container is then started with the necessary environment variables, including EMAIL, DOMAIN, and LETSENCRYPT_HOST. These are used to request Let's Encrypt certificates for the specified domain.
Any container can join the proxy by adding specific environment variables and connecting to the webproxy network. The VIRTUAL_HOST variable tells nginx-proxy which domain routes to the container, VIRTUAL_PORT is the port the app listens on, and LETSENCRYPT_HOST and LETSENCRYPT_EMAIL instruct acme-companion to obtain a certificate for that domain.
Custom nginx configurations can be added for certain services by placing config snippets in /srv/nginx-vhosts/${DOMAIN}. These snippets are automatically loaded by nginx-proxy for that domain, allowing for additional features like IP allow lists, custom headers, or other advanced settings.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
