How do I install the Nginx Proxy Manager skill?

Run npx skillmds@latest add dvcrn/nginx-proxy-manager in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Nginx Proxy Manager safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Nginx Proxy Manager?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Nginx Proxy Manager free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Nginx Proxy Manager?

dvcrn (@dvcrn) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Nginx Proxy Manager by dvcrn — Agent Skill

Name: Nginx Proxy Manager
Rating: 4.666666666666667 (3 reviews)
Author: dvcrn

Nginx Proxy Manager

Manage Nginx Proxy Manager (NPM) for reverse proxy and SSL termination to internal services like staging/prod apps. Use when creating/updating proxy hosts, requesting or renewing Let's Encrypt certificates, enforcing HTTPS redirects, setting websocket support, or routing domains/subdomains to target servers.

dvcrn Updated Sep 8, 2026 32 repo stars

File contents

Nginx Proxy Manager Workflow

Use this skill to terminate SSL at NPM and route traffic to backend services (staging/prod).

Required inputs

Domain/subdomain (e.g. staging.example.com)
Public DNS already pointing to NPM public IP
Upstream target host/IP + port (e.g. 10.10.10.227:3000)
Whether Cloudflare proxy is enabled (if used)

Authentication (do not hardcode secrets)

Store credentials outside this skill (local secret file or environment variables).

Recommended env vars:

NPM_BASE_URL (e.g. http://<npm-host>:81)
NPM_IDENTITY
NPM_SECRET

Example token request:

curl -sS -X POST "$NPM_BASE_URL/api/tokens" \
  -H 'Content-Type: application/json; charset=UTF-8' \
  --data "{\"identity\":\"$NPM_IDENTITY\",\"secret\":\"$NPM_SECRET\"}"

Standard setup flow

Confirm DNS resolves to NPM public IP.
Create or update Proxy Host in NPM:
- Domain Names: requested host(s)
- Scheme: http (or https if upstream is TLS)
- Forward Hostname/IP: upstream IP/hostname
- Forward Port: app port
- Enable:
  - Block Common Exploits
  - Websockets Support
SSL tab:
- Request new SSL certificate (Let's Encrypt)
- Enable Force SSL
- Enable HTTP/2 Support
- Enable HSTS only after validation
Save and verify:
- curl -I https://<domain> returns 200/301
- Browser check for valid certificate and app reachability

Recommended defaults

Keep upstream as private IP where possible.
Use separate hostnames per environment:
- app.example.com → production
- staging.example.com → staging
Avoid wildcard certificates unless explicitly needed.

Troubleshooting

Certificate issuance fails:
- Check DNS A/AAAA records
- Ensure ports 80/443 reach NPM
- Disable conflicting CDN TLS mode or set to Full/Strict appropriately
502 Bad Gateway:
- Verify upstream container/service is running
- Verify correct target port and local firewall rules
Redirect loops:
- Don’t double-force HTTPS (app + proxy misconfiguration)

Publication hygiene checklist

Before sharing/publishing this skill:

Remove all real IPs, domains, emails, and tokens.
Keep only placeholders like example.com and <npm-host>.
Ensure no local credential file paths or secret values are included.

Safety rules

Never remove existing production proxy hosts unless explicitly requested.
For changes on production domains, snapshot/export config or document previous values first.
Apply changes to staging first when possible.

---name: nginx-proxy-managerdescription: Manage Nginx Proxy Manager (NPM) for reverse proxy and SSL termination to internal services like staging/prod apps. Use when creating/updating proxy hosts, requesting or renewing Let's Encrypt certificates, enforcing HTTPS redirects, setting websocket support, or routing domains/subdomains to target servers.---# Nginx Proxy Manager WorkflowUse this skill to terminate SSL at NPM and route traffic to backend services (staging/prod).## Required inputs- Domain/subdomain (e.g. `staging.example.com`)- Public DNS already pointing to NPM public IP- Upstream target host/IP + port (e.g. `10.10.10.227:3000`)- Whether Cloudflare proxy is enabled (if used)## Authentication (do not hardcode secrets)Store credentials outside this skill (local secret file or environment variables).Recommended env vars:- `NPM_BASE_URL` (e.g. `http://<npm-host>:81`)- `NPM_IDENTITY`- `NPM_SECRET`Example token request:```bashcurl -sS -X POST "$NPM_BASE_URL/api/tokens" \ -H 'Content-Type: application/json; charset=UTF-8' \ --data "{\"identity\":\"$NPM_IDENTITY\",\"secret\":\"$NPM_SECRET\"}"```## Standard setup flow1. Confirm DNS resolves to NPM public IP.2. Create or update Proxy Host in NPM: - Domain Names: requested host(s) - Scheme: `http` (or `https` if upstream is TLS) - Forward Hostname/IP: upstream IP/hostname - Forward Port: app port - Enable: - Block Common Exploits - Websockets Support3. SSL tab: - Request new SSL certificate (Let's Encrypt) - Enable `Force SSL` - Enable `HTTP/2 Support` - Enable `HSTS` only after validation4. Save and verify: - `curl -I https://<domain>` returns `200/301` - Browser check for valid certificate and app reachability## Recommended defaults- Keep upstream as private IP where possible.- Use separate hostnames per environment: - `app.example.com` → production - `staging.example.com` → staging- Avoid wildcard certificates unless explicitly needed.## Troubleshooting- Certificate issuance fails: - Check DNS A/AAAA records - Ensure ports 80/443 reach NPM - Disable conflicting CDN TLS mode or set to Full/Strict appropriately- 502 Bad Gateway: - Verify upstream container/service is running - Verify correct target port and local firewall rules- Redirect loops: - Don’t double-force HTTPS (app + proxy misconfiguration)## Publication hygiene checklistBefore sharing/publishing this skill:- Remove all real IPs, domains, emails, and tokens.- Keep only placeholders like `example.com` and `<npm-host>`.- Ensure no local credential file paths or secret values are included.## Safety rules- Never remove existing production proxy hosts unless explicitly requested.- For changes on production domains, snapshot/export config or document previous values first.- Apply changes to staging first when possible.

Frequently asked questions