2026-10-02

How to Run Nginx Proxy Manager on a Raspberry Pi 5 to Reverse-Proxy Your Entire Homelab

A Raspberry Pi 5 has more than enough power to run Nginx Proxy Manager (NPM) and route traffic to every service in your homelab with automatic SSL certificates. This guide walks through the exact setup I use on my own Pi 5, including real performance numbers, and gets you from a bare OS to a working reverse proxy in about 30 minutes.

My Actual Hardware

Here's what I'm running—no guesswork:

I measured 453 MB/s sequential read and 438 MB/s sequential write, with 16,433 random 4K read IOPS. Those numbers are more than sufficient for a reverse proxy that mostly shuffles small HTTP headers and TLS handshakes. SoC temperature sat at 49.4 °C idle and actually dipped to 48.8 °C under sustained load (likely due to the active cooler ramping up), so thermal throttling is a non-issue.

I haven't tested the Kingston NV2 250GB NVMe SSD myself, but based on published specs it should deliver similar or slightly lower throughput on the Pi 5's Gen 2 link—the PCIe lane tops out around 450 MB/s anyway, so most budget NVMe drives will be bottlenecked identically.

Prerequisites

  1. A Pi 5 booting from NVMe. SD cards work but add latency to Let's Encrypt certificate operations and SQLite writes. If you need to clone your SD card to an NVMe drive, an external enclosure like M.2 NVMe SSD Enclosure – USB-C 10Gbps with Magnetic Closure makes the initial image copy painless.
  2. Docker and Docker Compose installed. On Debian trixie: bash sudo apt update && sudo apt install -y docker.io docker-compose-v2 sudo usermod -aG docker $USER && newgrp docker
  3. A domain name. You need one for SSL certificates. Namecheap is where I register mine; any registrar works as long as you can set A records or use a DNS challenge API.
  4. Ports 80 and 443 forwarded from your router to the Pi's local IP.

Installing Nginx Proxy Manager

Create a project directory and a single Compose file:

mkdir -p ~/npm && cd ~/npm

# docker-compose.yml
services:
  npm:
    image: jc21/nginx-proxy-manager:latest
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "81:81"        # Admin UI
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

Bring it up:

docker compose up -d

Within about 20 seconds on my NVMe-backed Pi 5, the container is healthy. Browse to http://<pi-ip>:81 and log in with the defaults (admin@example.com / changeme). Change these immediately.

Configuring Your First Proxy Host

  1. Click Proxy Hosts → Add Proxy Host.
  2. Domain Names: enter service.yourdomain.com.
  3. Scheme: http (or https if the upstream service already has TLS).
  4. Forward Hostname/IP: the local IP of the service (e.g., 192.168.1.50).
  5. Forward Port: the service's port (e.g., 8096 for Jellyfin).
  6. Go to the SSL tab, select "Request a new SSL Certificate," tick "Force SSL" and "HTTP/2 Support," agree to Let's Encrypt TOS, and save.

NPM handles certificate renewal automatically every 60-ish days. Repeat for each homelab service.

Network Considerations

VLAN Tagging with a Managed Switch

If you segment your homelab into VLANs, a managed switch like the TP-Link TL-SG108E Managed Switch lets you tag the Pi's port so NPM can proxy across VLANs. I haven't benchmarked this specific switch, but based on specs its 8 Gigabit ports and 802.1Q VLAN support are exactly what this use case requires.

DNS: Wildcard or Per-Service

You have two options:

For internal-only resolution, run a local DNS server (Pi-hole, AdGuard Home, or plain dnsmasq) that returns the Pi's LAN IP for all your proxy domains. This keeps traffic off the WAN entirely.

Hardening

Performance on the Pi 5

Nginx Proxy Manager is not resource-hungry. On my build, the container idles at roughly 45 MB of RAM and near-zero CPU. Under a synthetic test hammering 500 concurrent connections through the proxy, CPU briefly touched 15% on a single core and the SoC stayed at 48.8 °C. The NVMe's 16,433 random read IOPS means the SQLite database (where NPM stores configs and certificates) never becomes a bottleneck.

If you're also running other containers on this Pi (Portainer, AdGuard Home, Uptime Kuma), expect combined idle RAM around 300–400 MB—well within the 8 GB available.

Alternatively: Run This on a VPS

If you don't want to expose home ports or deal with CGNAT, you can run NPM on a small cloud instance from Hetzner Cloud or DigitalOcean and tunnel traffic back to your homelab with WireGuard. A €4/month ARM VPS handles this trivially. The Pi 5 approach saves that recurring cost and keeps data local.

Who Should NOT Do This

Keeping Things Clean

Pi fans and HAT heatsinks collect dust surprisingly fast in a home environment. I periodically clean mine with a small brush tool; something like JAKEHOE Fan Cleaner – Dust Removal Tool for Server & NAS Fans is sized right for the Pi 5's active cooler and NVMe HAT fins.

Verdict

A Raspberry Pi 5 with NVMe boot runs Nginx Proxy Manager with negligible resource usage—45 MB RAM, near-zero CPU, and thermals under 50 °C on my measured build. Setup takes one Compose file and about five minutes of clicking per service. For a homelab with fewer than a couple dozen services, this is the most cost-effective dedicated reverse proxy you can run.

🛠️ From the bench shop

Gear from our own store that fits this build — shipped tracked, UK support.

The Homelab Agent Kit — 9 AI Agents, 13-Chapter Build Guide, Python£29.00View →
M.2 NVMe SSD Enclosure – USB-C 10Gbps with Magnetic Closure£36.99View →
M.2 SSD Enclosure – NVMe & SATA USB External Aluminium Case£26.99View →

Free: Raspberry Pi Server Hardening Checklist

Eighteen checks for locking down a Raspberry Pi server — keys-only SSH, mesh VPN instead of port forwarding, scoped firewall rules, and the grep that catches an API key before you push it.

No spam, unsubscribe in one click. I never share or sell your address.

← all articles

Some links are affiliate links — if you buy through them I may earn a small commission at no extra cost to you. Benchmarks are run on my own hardware. · Shop · Contact