Nginx Proxy Manager

Access your home services via a secure URL from anywhere in the world. This guide covers setting up AdGuard Home for custom DNS, Nginx Proxy Manager for wildcard SSL certificates via Cloudflare and Tailscale for a zero-config VPN mesh.

References

Tailscale
Section titled “Tailscale”

Setup TailscaleInstall and configure the Tailscale client to establish a secure mesh network and manage node connectivity.

Docker

Deploy AdGuard Home and Nginx Proxy Manager as containerized services for network filtering and reverse proxying.

Make directory

mkdir -p {{DOCKER_PATH_VAR}}/dns-proxy && cd {{DOCKER_PATH_VAR}}/dns-proxy

compose.yml

nano compose.yml

Standalone
With sync

services:
  adguard:
    image: adguard/adguardhome
    container_name: adguard
    restart: unless-stopped
    volumes:
      - ./adguard/work:/opt/adguardhome/work
      - ./adguard/conf:/opt/adguardhome/conf
    network_mode: host

  npm:
    image: "jc21/nginx-proxy-manager:latest"
    container_name: npm
    restart: unless-stopped
    network_mode: host
    volumes:
      - ./npm/data:/data
      - ./npm/letsencrypt:/etc/letsencrypt
    environment:
      - DB_SQLITE_FILE=/data/database.sqlite

services:
  adguard:
    image: adguard/adguardhome
    container_name: adguard
    restart: unless-stopped
    volumes:
      - ./adguard/work:/opt/adguardhome/work
      - ./adguard/conf:/opt/adguardhome/conf
    network_mode: host

  adguardhome-sync:
    image: ghcr.io/bakito/adguardhome-sync:latest
    container_name: adguardhome-sync
    command: run
    environment:
      ORIGIN_URL: ${ORIGIN_URL}
      ORIGIN_USERNAME: ${ORIGIN_USERNAME}
      ORIGIN_PASSWORD: ${ORIGIN_PASSWORD}
      REPLICA_URL: ${REPLICA_URL}
      REPLICA_USERNAME: ${REPLICA_USERNAME}
      REPLICA_PASSWORD: ${REPLICA_PASSWORD}
      CRON: "*/10 * * * *"
      RUN_ON_START: "true"

  npm:
    image: "jc21/nginx-proxy-manager:latest"
    container_name: npm
    restart: unless-stopped
    network_mode: host
    volumes:
      - ./npm/data:/data
      - ./npm/letsencrypt:/etc/letsencrypt
    environment:
      - DB_SQLITE_FILE=/data/database.sqlite

  keepalived:
    image: osixia/keepalived:latest
    container_name: keepalived
    restart: unless-stopped
    network_mode: host
    cap_add:
      - NET_ADMIN
      - NET_BROADCAST
      - NET_RAW
    volumes:
      # optional
      - ./keepalived/keepalived.conf:/etc/keepalived/keepalived.conf:ro
    environment:
      - KEEPALIVED_STATE=MASTER # MASTER | BACKUP
      - KEEPALIVED_INTERFACE=enp3s0 # eth0 | enp3s0 | wlan0
      - KEEPALIVED_VIRTUAL_ROUTER_ID=51
      - KEEPALIVED_PRIORITY=101
      - KEEPALIVED_UNICAST_PEERS={{CLIENT_IP_VAR}} # Peers/other devices
      - KEEPALIVED_VIRTUAL_IPS={{VIRTUAL_IP_VAR}}/24
      - KEEPALIVED_PASSWORD=${KEEPALIVED_PASSWORD}

nano .env

ORIGIN_URL=http://{{SERVER_IP_VAR}}:8080
ORIGIN_USERNAME=admin
ORIGIN_PASSWORD=password
REPLICA_URL=http://{{CLIENT_IP_VAR}}:8080
REPLICA_USERNAME=admin
REPLICA_PASSWORD=password
KEEPALIVED_PASSWORD=password

keepalived.conf (Optional)

mkdir -p ./keepalived && nano ./keepalived/keepalived.conf

global_defs {
    enable_script_security
    script_user root
}

vrrp_script check_adguard {
    script "/usr/bin/curl -fsS http://{{SERVER_IP_VAR}}:8080/control/status"
    interval 2
    weight 2
}

vrrp_instance VI_1 {
    state MASTER # MASTER | BACKUP
    interface enp3s0 # eth0 | enp3s0 | wlan0
    virtual_router_id 51
    priority 101 # MASTER: 101 | BACKUP: 100
    advert_int 1

    unicast_peer {
        # Add peers as necessary
        # 192.168.100.212 # peer 1
        # 192.168.100.213 # peer 2
    }

    authentication {
        auth_type PASS
        auth_pass password # Change max 8 characters
    }

    virtual_ipaddress {
        {{VIRTUAL_IP_VAR}}/24
    }

    track_script {
        check_adguard
    }
}

Fix port conflict (53)
Section titled “Fix port conflict (53)”

Disable the stub listener
Section titled “Disable the stub listener”
Terminal window
```
sudo nano /etc/systemd/resolved.conf
```
Set DNSStubListener=no

Restart systemd-resolved
Section titled “Restart systemd-resolved”
Terminal window
```
sudo systemctl restart systemd-resolved
```
Start container
Section titled “Start container”
Terminal window
```
docker compose up -d
```

Cloudflare
Section titled “Cloudflare”

Generate a scoped API token to automate DNS record management and SSL certificate validation.
- Go to Dashboard > My Profile > API Tokens.
- Create Token: Use the Edit zone DNS template.
- Permissions: Select Zone | DNS | Edit.
- Zone Resources: Select Include | Specific zone | your-domain.tld.
AdGuard Home
Section titled “AdGuard Home”

Complete the initial web setup to manage network-wide DNS filtering and security rules.
1. Initial setup
  Section titled “Initial setup”
  - Go to http://localhost:3000 or http://{{SERVER_IP_VAR}}:3000
  - Admin Web Interface.
  - Listen interface: Select All interfaces.
  - Port: Change to 8080.
2. DNS rewrites
  Section titled “DNS rewrites”
  - Go to http://localhost:8080 or http://{{SERVER_IP_VAR}}:8080
  - Go to Filters > DNS Rewrites.
  - Click Add DNS rewrite.
  - Domain name: *.lan.your-domain.tld.
  - IP address: Enter your device IP {{SERVER_IP_VAR}} or virtual IP {{VIRTUAL_IP_VAR}}.
3. Blocklists (optional)
  Section titled “Blocklists (optional)”
  1. Preconfigured list
    - Go to Filters > DNS Blocklists > Add Blocklist: Choose from the list.
      - AdGuard DNS filter
      - AdAway Default Blocklist
      - HaGeZi’s Pro++ Blocklist
      - OISD Blocklist Small
      - OISD Blocklist Big
      - HaGeZi’s Samsung Tracker Blocklist
  2. Custom list
    - Go to Filters > DNS Blocklists > Add Blocklist: Add a custom list.
    - Name: Enter a name.
    - URL
      https://raw.githubusercontent.com/huffmanks/code-share/refs/heads/main/src/files/config/adguard/blocklist.txt
4. General settings (optional)
  Section titled “General settings (optional)”
  - Go to Settings > General Settings.
    - Use AdGuard browsing security web service.
    - Use AdGuard parental control web service.
    - Use Safe Search.
5. DNS settings (optional)
  Section titled “DNS settings (optional)”
  - Go to Settings > DNS settings.
    - Upstream DNS servers.
      https://dns.quad9.net/dns-query https://dns.cloudflare.com/dns-query https://dns.adguard-dns.com/dns-query
      - Enter the DNS providers above.
      - Click apply.
    - DNS server configuration.
      - Enable DNSSEC.
      - Click save.
    - Access Settings > Allowed clients.
      100.64.0.0/10 {{SUBNET_VAR}}
      - Add Tailscale and device IP ranges above.
      - Leave blank to allow all.
      - Click Save configuration.
6. Filters (optional)
  Section titled “Filters (optional)”
  - Go to Filters > Custom filtering rules.
    @@||tailscale.com^ @@||tailscale.io^ @@||log.tailscale.io^ ||*.church^$denyallow=host.church|life.church|online.church,badfilter
    - Add domains to allow.
    - Click Apply.
Nginx Proxy Manager
Section titled “Nginx Proxy Manager”

Access the administrative dashboard to route incoming traffic and manage SSL certificates for your services.
1. Certificate
  Section titled “Certificate”
  - Go to http://localhost:81 or http://{{SERVER_IP_VAR}}:81
  - Go to Certificates > Add Certificate > Let’s Encrypt via DNS.
  - Domain Names: Enter *.lan.your-domain.tld.
  - DNS Provider: Select Cloudflare.
  - Credentials File Content: Replace dns_cloudflare_api_token=YOUR_CLOUDFLARE_API_KEY.
  - Agree to terms and click Save.
2. Proxy host
  Section titled “Proxy host”
  - In NPM, go to Hosts > Proxy Hosts > Add Proxy Host.
  - Domain Names: adguard.lan.your-domain.tld.
  - Scheme: http.
  - Forward IP: {{SERVER_IP_VAR}}.
  - Forward Port: 8080.
  - Block common exploits and Websockets support: toggle to ON.
  - SSL Tab: Select the certificate you created.
  - Force SSL and HTTP/2 Support: toggle to ON.
  - Click Save.
Router config
Section titled “Router config”

Update the Primary DNS, often located under LAN, DHCP or DNS Settings.
- Primary DNS: {{SERVER_IP_VAR}} or {{VIRTUAL_IP_VAR}} (Your device’s Local LAN IP or virtual IP, not the Tailscale one).
- Secondary DNS: 1.1.1.1 (Fail-safe so your internet still works if your device is turned off).

Nginx Proxy Manager

References

Tailscale

Docker

Make directory

compose.yml

Fix port conflict (53)

Disable the stub listener

Restart systemd-resolved

Start container

Cloudflare

AdGuard Home

Initial setup

DNS rewrites

Blocklists (optional)

General settings (optional)

DNS settings (optional)

Filters (optional)

Nginx Proxy Manager

Certificate

Proxy host

Router config