Reverse-proxy settings for 20 self-hosted apps

# Immich: nginx for photos.example.org
# App-specific lines are checked against Immich's docs (2026-09-26); [n] = source n below.

server {
    listen 80;
    listen [::]:80;
    server_name photos.example.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name photos.example.org;
    ssl_certificate     /etc/letsencrypt/live/photos.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/photos.example.org/privkey.pem;

    client_max_body_size 50000M; # [1]
    proxy_read_timeout 600s; # [1]
    proxy_send_timeout 600s; # [1]
    proxy_request_buffering off; # [1]
    client_body_buffer_size 1024k; # [1]
    send_timeout 600s; # [1]
    proxy_redirect off; # [1]

    location / {
        proxy_pass http://immich-server:2283;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1; # [1]
        proxy_set_header Upgrade $http_upgrade; # [1]
        proxy_set_header Connection "upgrade"; # [1]
    }
}

# Nginx Proxy Manager: Hosts > Proxy Hosts > Add Proxy Host, for Immich
# Checked against Immich's docs (2026-09-26); [n] = source n below.

Details tab
  Domain Names .......... photos.example.org
  Scheme ................ http
  Forward Hostname / IP . immich-server
  Forward Port .......... 2283
  Cache Assets .......... off
  Block Common Exploits . on
  Websockets Support .... on  # [1]

SSL tab
  SSL Certificate ....... Request a new SSL Certificate
  Force SSL ............. on
  HTTP/2 Support ........ on

client_max_body_size 50000M; # [1]
proxy_read_timeout 600s; # [1]
proxy_send_timeout 600s; # [1]
proxy_request_buffering off; # [1]
client_body_buffer_size 1024k; # [1]
send_timeout 600s; # [1]
proxy_redirect off; # [1]

# Immich: Caddyfile site block, the same one the dankhost builder writes.
# Checked against Immich's docs (2026-09-26); [n] = source n below.
# Caddy passes WebSockets and sets X-Forwarded-For/-Proto/-Host by itself.
photos.example.org {
	reverse_proxy immich-server:2283
}

# Immich: Traefik v3 labels, the same ones the dankhost builder writes.
# Checked against Immich's docs (2026-09-26); [n] = source n below.
# "websecure" and "letsencrypt" are the builder's entrypoint and resolver names: use yours.
# Traefik must share a Docker network with the container; it passes WebSockets by itself.
services:
  immich-server:
    labels:
      traefik.enable: "true"
      traefik.http.routers.immich.rule: "Host(`photos.example.org`)"
      traefik.http.routers.immich.entrypoints: "websecure"
      traefik.http.routers.immich.tls: "true"
      traefik.http.routers.immich.tls.certresolver: "letsencrypt"
      traefik.http.routers.immich.service: "immich"
      traefik.http.services.immich.loadbalancer.server.port: "2283"
      # [1] Immich's docs: Traefik's entrypoint readTimeout defaults to 60s, which stops video
      # uploads after a minute (error 499). Raise it in Traefik's static configuration:
      # entryPoints.websecure.transport.respondingTimeouts.readTimeout: 600s and idleTimeout:
      # 600s. (The dankhost builder sets readTimeout to 0, no limit.)

# Nextcloud: nginx for cloud.example.org
# App-specific lines are checked against Nextcloud's docs (2026-09-26); [n] = source n below.

server {
    listen 80;
    listen [::]:80;
    server_name cloud.example.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name cloud.example.org;
    ssl_certificate     /etc/letsencrypt/live/cloud.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/cloud.example.org/privkey.pem;

    client_max_body_size 512M; # [3]
    proxy_buffering off; # [2]

    location / {
        proxy_pass http://app:80;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /.well-known/carddav { # [1]
        return 301 $scheme://$host/remote.php/dav;
    }

    location /.well-known/caldav { # [1]
        return 301 $scheme://$host/remote.php/dav;
    }
}

# Nginx Proxy Manager: Hosts > Proxy Hosts > Add Proxy Host, for Nextcloud
# Checked against Nextcloud's docs (2026-09-26); [n] = source n below.

Details tab
  Domain Names .......... cloud.example.org
  Scheme ................ http
  Forward Hostname / IP . app
  Forward Port .......... 80
  Cache Assets .......... off
  Block Common Exploits . on
  Websockets Support .... off (the docs ask for no WebSocket headers)

SSL tab
  SSL Certificate ....... Request a new SSL Certificate
  Force SSL ............. on
  HTTP/2 Support ........ on

client_max_body_size 512M; # [3]
proxy_buffering off; # [2]
proxy_hide_header Upgrade; # [1]
location /.well-known/carddav { # [1]
    return 301 $scheme://$host/remote.php/dav;
}
location /.well-known/caldav { # [1]
    return 301 $scheme://$host/remote.php/dav;
}

• Nextcloud's manual: with Nginx Proxy Manager, add proxy_hide_header Upgrade; to the Custom Nginx Configuration, otherwise iPhones and iPads get 'Connection Closed'. [1]

# Nextcloud: Caddyfile site block, the same one the dankhost builder writes.
# Checked against Nextcloud's docs (2026-09-26); [n] = source n below.
# Caddy passes WebSockets and sets X-Forwarded-For/-Proto/-Host by itself.
cloud.example.org {
	# [1]
	redir /.well-known/carddav /remote.php/dav/ 301
	# [1]
	redir /.well-known/caldav /remote.php/dav/ 301
	reverse_proxy app:80
}

# Nextcloud: Traefik v3 labels, the same ones the dankhost builder writes.
# Checked against Nextcloud's docs (2026-09-26); [n] = source n below.
# "websecure" and "letsencrypt" are the builder's entrypoint and resolver names: use yours.
# Traefik must share a Docker network with the container; it passes WebSockets by itself.
services:
  app:
    labels:
      traefik.enable: "true"
      traefik.http.routers.nextcloud.rule: "Host(`cloud.example.org`)"
      traefik.http.routers.nextcloud.entrypoints: "websecure"
      traefik.http.routers.nextcloud.tls: "true"
      traefik.http.routers.nextcloud.tls.certresolver: "letsencrypt"
      traefik.http.routers.nextcloud.service: "nextcloud"
      traefik.http.routers.nextcloud.middlewares: "nextcloud-dav-redirect"
      traefik.http.services.nextcloud.loadbalancer.server.port: "80"
      traefik.http.middlewares.nextcloud-dav-redirect.redirectregex.regex: "^https://cloud\\.example\\.org/\\.well-known/(?:card|cal)dav$$"
      traefik.http.middlewares.nextcloud-dav-redirect.redirectregex.replacement: "https://cloud.example.org/remote.php/dav/"
      traefik.http.middlewares.nextcloud-dav-redirect.redirectregex.permanent: "true"
      # [1] The dav-redirect middleware is the Traefik 2+ redirectregex the manual gives for
      # /.well-known/carddav and caldav, pointed at /remote.php/dav/.

# Home Assistant: nginx for home.example.org
# App-specific lines are checked against Home Assistant's docs (2026-09-26); [n] = source n below.

# Home Assistant runs with host networking: host.docker.internal:8123 from nginx in a container
# (with an extra_hosts host-gateway entry), 127.0.0.1:8123 from nginx on the same machine.
upstream home-assistant {
    server host.docker.internal:8123;
}

# WebSocket map [2]. It belongs in the http {} context, which conf.d files are.
# Leave it out if your nginx already defines $connection_upgrade.
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 80;
    listen [::]:80;
    server_name home.example.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name home.example.org;
    ssl_certificate     /etc/letsencrypt/live/home.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/home.example.org/privkey.pem;

    proxy_buffering off; # [2]

    location / {
        proxy_pass http://home-assistant;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1; # [2]
        proxy_set_header Upgrade $http_upgrade; # [2]
        proxy_set_header Connection $connection_upgrade; # [2]
    }
}

# Nginx Proxy Manager: Hosts > Proxy Hosts > Add Proxy Host, for Home Assistant
# Checked against Home Assistant's docs (2026-09-26); [n] = source n below.

Details tab
  Domain Names .......... home.example.org
  Scheme ................ http
  Forward Hostname / IP . host.docker.internal
  Forward Port .......... 8123
  Cache Assets .......... off
  Block Common Exploits . on
  Websockets Support .... on  # [2]

SSL tab
  SSL Certificate ....... Request a new SSL Certificate
  Force SSL ............. on
  HTTP/2 Support ........ on

proxy_buffering off; # [2]

# Home Assistant: Caddyfile site block, the same one the dankhost builder writes.
# Checked against Home Assistant's docs (2026-09-26); [n] = source n below.
# Caddy passes WebSockets and sets X-Forwarded-For/-Proto/-Host by itself.
home.example.org {
	reverse_proxy host.docker.internal:8123
}

# Home Assistant: Traefik v3 labels, the same ones the dankhost builder writes.
# Checked against Home Assistant's docs (2026-09-26); [n] = source n below.
# "websecure" and "letsencrypt" are the builder's entrypoint and resolver names: use yours.
# Traefik must share a Docker network with the container; it passes WebSockets by itself.
# Home Assistant uses host networking: Traefik reaches it at host.docker.internal:8123.
services:
  homeassistant:
    labels:
      traefik.enable: "true"
      traefik.http.routers.home-assistant.rule: "Host(`home.example.org`)"
      traefik.http.routers.home-assistant.entrypoints: "websecure"
      traefik.http.routers.home-assistant.tls: "true"
      traefik.http.routers.home-assistant.tls.certresolver: "letsencrypt"
      traefik.http.routers.home-assistant.service: "home-assistant"
      traefik.http.services.home-assistant.loadbalancer.server.port: "8123"

# Vaultwarden: nginx for vault.example.org
# App-specific lines are checked against Vaultwarden's docs (2026-09-26); [n] = source n below.

# WebSocket map [1]. It belongs in the http {} context, which conf.d files are.
# Leave it out if your nginx already defines $connection_upgrade.
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      "";
}

server {
    listen 80;
    listen [::]:80;
    server_name vault.example.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name vault.example.org;
    ssl_certificate     /etc/letsencrypt/live/vault.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/vault.example.org/privkey.pem;

    client_max_body_size 525M; # [1]

    location / {
        proxy_pass http://vaultwarden:80;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1; # [1]
        proxy_set_header Upgrade $http_upgrade; # [1]
        proxy_set_header Connection $connection_upgrade; # [1]
    }
}

# Nginx Proxy Manager: Hosts > Proxy Hosts > Add Proxy Host, for Vaultwarden
# Checked against Vaultwarden's docs (2026-09-26); [n] = source n below.

Details tab
  Domain Names .......... vault.example.org
  Scheme ................ http
  Forward Hostname / IP . vaultwarden
  Forward Port .......... 80
  Cache Assets .......... off
  Block Common Exploits . on
  Websockets Support .... on  # [1]

SSL tab
  SSL Certificate ....... Request a new SSL Certificate
  Force SSL ............. on
  HTTP/2 Support ........ on

client_max_body_size 525M; # [1]

# Vaultwarden: Caddyfile site block, the same one the dankhost builder writes.
# Checked against Vaultwarden's docs (2026-09-26); [n] = source n below.
# Caddy passes WebSockets and sets X-Forwarded-For/-Proto/-Host by itself.
vault.example.org {
	reverse_proxy vaultwarden:80 {
		# [1]
		header_up X-Real-IP {remote_host}
	}
}

# Vaultwarden: Traefik v3 labels, the same ones the dankhost builder writes.
# Checked against Vaultwarden's docs (2026-09-26); [n] = source n below.
# "websecure" and "letsencrypt" are the builder's entrypoint and resolver names: use yours.
# Traefik must share a Docker network with the container; it passes WebSockets by itself.
services:
  vaultwarden:
    labels:
      traefik.enable: "true"
      traefik.http.routers.vaultwarden.rule: "Host(`vault.example.org`)"
      traefik.http.routers.vaultwarden.entrypoints: "websecure"
      traefik.http.routers.vaultwarden.tls: "true"
      traefik.http.routers.vaultwarden.tls.certresolver: "letsencrypt"
      traefik.http.routers.vaultwarden.service: "vaultwarden"
      traefik.http.services.vaultwarden.loadbalancer.server.port: "80"

# Jellyfin: nginx for media.example.org
# App-specific lines are checked against Jellyfin's docs (2026-09-26); [n] = source n below.

server {
    listen 80;
    listen [::]:80;
    server_name media.example.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name media.example.org;
    ssl_certificate     /etc/letsencrypt/live/media.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/media.example.org/privkey.pem;

    client_max_body_size 20M; # [1]

    location / {
        proxy_pass http://jellyfin:8096;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Protocol $scheme; # [1]
        proxy_set_header X-Forwarded-Host $http_host; # [1]
        proxy_buffering off; # [1]
    }

    # WebSocket traffic [1]
    location /socket {
        proxy_pass http://jellyfin:8096;
        proxy_http_version 1.1; # [1]
        proxy_set_header Upgrade $http_upgrade; # [1]
        proxy_set_header Connection "upgrade"; # [1]
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Protocol $scheme; # [1]
        proxy_set_header X-Forwarded-Host $http_host; # [1]
    }
}

# Nginx Proxy Manager: Hosts > Proxy Hosts > Add Proxy Host, for Jellyfin
# Checked against Jellyfin's docs (2026-09-26); [n] = source n below.

Details tab
  Domain Names .......... media.example.org
  Scheme ................ http
  Forward Hostname / IP . jellyfin
  Forward Port .......... 8096
  Cache Assets .......... off
  Block Common Exploits . on
  Websockets Support .... on  # [1]

SSL tab
  SSL Certificate ....... Request a new SSL Certificate
  Force SSL ............. on
  HTTP/2 Support ........ on

client_max_body_size 20M; # [1]
proxy_buffering off; # [1]
# NPM puts this text inside the server block, where proxy_set_header does not reach its own
# location /. So this location / replaces NPM's (an Access List on this host no longer applies).
location / {
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_http_version 1.1;
    include conf.d/include/proxy.conf;
    proxy_set_header X-Forwarded-Protocol $scheme; # [1]
    proxy_set_header X-Forwarded-Host $http_host; # [1]
}

# Jellyfin: Caddyfile site block, the same one the dankhost builder writes.
# Checked against Jellyfin's docs (2026-09-26); [n] = source n below.
# Caddy passes WebSockets and sets X-Forwarded-For/-Proto/-Host by itself.
media.example.org {
	reverse_proxy jellyfin:8096
}

# Jellyfin: Traefik v3 labels, the same ones the dankhost builder writes.
# Checked against Jellyfin's docs (2026-09-26); [n] = source n below.
# "websecure" and "letsencrypt" are the builder's entrypoint and resolver names: use yours.
# Traefik must share a Docker network with the container; it passes WebSockets by itself.
services:
  jellyfin:
    labels:
      traefik.enable: "true"
      traefik.http.routers.jellyfin.rule: "Host(`media.example.org`)"
      traefik.http.routers.jellyfin.entrypoints: "websecure"
      traefik.http.routers.jellyfin.tls: "true"
      traefik.http.routers.jellyfin.tls.certresolver: "letsencrypt"
      traefik.http.routers.jellyfin.service: "jellyfin"
      traefik.http.services.jellyfin.loadbalancer.server.port: "8096"

# Paperless-ngx: nginx for docs.example.org
# App-specific lines are checked against Paperless-ngx's docs (2026-09-26); [n] = source n below.

server {
    listen 80;
    listen [::]:80;
    server_name docs.example.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name docs.example.org;
    ssl_certificate     /etc/letsencrypt/live/docs.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/docs.example.org/privkey.pem;

    client_max_body_size 10M; # [1]

    location / {
        proxy_pass http://webserver:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $server_name; # [1]
        proxy_redirect off; # [1]
        proxy_http_version 1.1; # [1]
        proxy_set_header Upgrade $http_upgrade; # [1]
        proxy_set_header Connection "upgrade"; # [1]
    }
}

# Nginx Proxy Manager: Hosts > Proxy Hosts > Add Proxy Host, for Paperless-ngx
# Checked against Paperless-ngx's docs (2026-09-26); [n] = source n below.

Details tab
  Domain Names .......... docs.example.org
  Scheme ................ http
  Forward Hostname / IP . webserver
  Forward Port .......... 8000
  Cache Assets .......... off
  Block Common Exploits . on
  Websockets Support .... on  # [1]

SSL tab
  SSL Certificate ....... Request a new SSL Certificate
  Force SSL ............. on
  HTTP/2 Support ........ on

client_max_body_size 10M; # [1]
proxy_redirect off; # [1]
proxy_send_timeout 600m; # [1]
proxy_read_timeout 600m; # [1]
# NPM puts this text inside the server block, where proxy_set_header does not reach its own
# location /. So this location / replaces NPM's (an Access List on this host no longer applies).
location / {
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_http_version 1.1;
    include conf.d/include/proxy.conf;
    proxy_set_header X-Forwarded-Host $server_name; # [1]
}

• The wiki: NPM's 90-second default timeout cuts the WebSocket when nothing changes for 90 seconds; raise it in the Custom Nginx Configuration. [1]

# Paperless-ngx: Caddyfile site block, the same one the dankhost builder writes.
# Checked against Paperless-ngx's docs (2026-09-26); [n] = source n below.
# Caddy passes WebSockets and sets X-Forwarded-For/-Proto/-Host by itself.
docs.example.org {
	reverse_proxy webserver:8000
}

# Paperless-ngx: Traefik v3 labels, the same ones the dankhost builder writes.
# Checked against Paperless-ngx's docs (2026-09-26); [n] = source n below.
# "websecure" and "letsencrypt" are the builder's entrypoint and resolver names: use yours.
# Traefik must share a Docker network with the container; it passes WebSockets by itself.
services:
  webserver:
    labels:
      traefik.enable: "true"
      traefik.http.routers.paperless.rule: "Host(`docs.example.org`)"
      traefik.http.routers.paperless.entrypoints: "websecure"
      traefik.http.routers.paperless.tls: "true"
      traefik.http.routers.paperless.tls.certresolver: "letsencrypt"
      traefik.http.routers.paperless.service: "paperless"
      traefik.http.services.paperless.loadbalancer.server.port: "8000"

# Uptime Kuma: nginx for status.example.org
# App-specific lines are checked against Uptime Kuma's docs (2026-09-26); [n] = source n below.

server {
    listen 80;
    listen [::]:80;
    server_name status.example.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name status.example.org;
    ssl_certificate     /etc/letsencrypt/live/status.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/status.example.org/privkey.pem;

    location / {
        proxy_pass http://uptime-kuma:3001;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1; # [1]
        proxy_set_header Upgrade $http_upgrade; # [1]
        proxy_set_header Connection "upgrade"; # [1]
    }
}

# Nginx Proxy Manager: Hosts > Proxy Hosts > Add Proxy Host, for Uptime Kuma
# Checked against Uptime Kuma's docs (2026-09-26); [n] = source n below.

Details tab
  Domain Names .......... status.example.org
  Scheme ................ http
  Forward Hostname / IP . uptime-kuma
  Forward Port .......... 3001
  Cache Assets .......... off
  Block Common Exploits . on
  Websockets Support .... on  # [1]

SSL tab
  SSL Certificate ....... Request a new SSL Certificate
  Force SSL ............. on
  HTTP/2 Support ........ on

# Nothing to add: Uptime Kuma's docs give no setting beyond NPM's defaults. The project documents nothing more.

# Uptime Kuma: Caddyfile site block, the same one the dankhost builder writes.
# Checked against Uptime Kuma's docs (2026-09-26); [n] = source n below.
# Caddy passes WebSockets and sets X-Forwarded-For/-Proto/-Host by itself.
status.example.org {
	reverse_proxy uptime-kuma:3001
}

# Uptime Kuma: Traefik v3 labels, the same ones the dankhost builder writes.
# Checked against Uptime Kuma's docs (2026-09-26); [n] = source n below.
# "websecure" and "letsencrypt" are the builder's entrypoint and resolver names: use yours.
# Traefik must share a Docker network with the container; it passes WebSockets by itself.
services:
  uptime-kuma:
    labels:
      traefik.enable: "true"
      traefik.http.routers.uptime-kuma.rule: "Host(`status.example.org`)"
      traefik.http.routers.uptime-kuma.entrypoints: "websecure"
      traefik.http.routers.uptime-kuma.tls: "true"
      traefik.http.routers.uptime-kuma.tls.certresolver: "letsencrypt"
      traefik.http.routers.uptime-kuma.service: "uptime-kuma"
      traefik.http.services.uptime-kuma.loadbalancer.server.port: "3001"

# Audiobookshelf: nginx for books.example.org
# App-specific lines are checked against Audiobookshelf's docs (2026-09-26); [n] = source n below.

server {
    listen 80;
    listen [::]:80;
    server_name books.example.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name books.example.org;
    ssl_certificate     /etc/letsencrypt/live/books.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/books.example.org/privkey.pem;

    client_max_body_size 10240M; # [2]

    location / {
        proxy_pass http://audiobookshelf:80;
        proxy_set_header Host $http_host; # [2]
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_redirect http:// https://; # [2]
        proxy_http_version 1.1; # [1]
        proxy_set_header Upgrade $http_upgrade; # [1]
        proxy_set_header Connection "upgrade"; # [1]
    }
}

# Nginx Proxy Manager: Hosts > Proxy Hosts > Add Proxy Host, for Audiobookshelf
# Checked against Audiobookshelf's docs (2026-09-26); [n] = source n below.

Details tab
  Domain Names .......... books.example.org
  Scheme ................ http
  Forward Hostname / IP . audiobookshelf
  Forward Port .......... 80
  Cache Assets .......... off
  Block Common Exploits . on
  Websockets Support .... on  # [1]

SSL tab
  SSL Certificate ....... Request a new SSL Certificate
  Force SSL ............. on
  HTTP/2 Support ........ on

client_max_body_size 10240M; # [2]
proxy_redirect http:// https://; # [2]
# Host: NPM already sends Host $host, the same value as $http_host while NPM listens on 443.

• The docs: only if NPM listens on a non-standard port (not 443) does the Host header need changing, with a custom location '/' carrying proxy_set_header Host $http_host. On 443 NPM's own Host $host is the same value. [3]

# Audiobookshelf: Caddyfile site block, the same one the dankhost builder writes.
# Checked against Audiobookshelf's docs (2026-09-26); [n] = source n below.
# Caddy passes WebSockets and sets X-Forwarded-For/-Proto/-Host by itself.
books.example.org {
	reverse_proxy audiobookshelf:80
}

# Audiobookshelf: Traefik v3 labels, the same ones the dankhost builder writes.
# Checked against Audiobookshelf's docs (2026-09-26); [n] = source n below.
# "websecure" and "letsencrypt" are the builder's entrypoint and resolver names: use yours.
# Traefik must share a Docker network with the container; it passes WebSockets by itself.
services:
  audiobookshelf:
    labels:
      traefik.enable: "true"
      traefik.http.routers.audiobookshelf.rule: "Host(`books.example.org`)"
      traefik.http.routers.audiobookshelf.entrypoints: "websecure"
      traefik.http.routers.audiobookshelf.tls: "true"
      traefik.http.routers.audiobookshelf.tls.certresolver: "letsencrypt"
      traefik.http.routers.audiobookshelf.service: "audiobookshelf"
      traefik.http.services.audiobookshelf.loadbalancer.server.port: "80"

# Navidrome: nginx for music.example.org
# App-specific lines are checked against Navidrome's docs (2026-09-26); [n] = source n below.
# Navidrome's docs give no nginx setting beyond the generic lines. The project documents nothing more.

server {
    listen 80;
    listen [::]:80;
    server_name music.example.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name music.example.org;
    ssl_certificate     /etc/letsencrypt/live/music.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/music.example.org/privkey.pem;

    location / {
        proxy_pass http://navidrome:4533;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# Nginx Proxy Manager: Hosts > Proxy Hosts > Add Proxy Host, for Navidrome
# Checked against Navidrome's docs (2026-09-26); [n] = source n below.

Details tab
  Domain Names .......... music.example.org
  Scheme ................ http
  Forward Hostname / IP . navidrome
  Forward Port .......... 4533
  Cache Assets .......... off
  Block Common Exploits . on
  Websockets Support .... off (the docs ask for no WebSocket headers)

SSL tab
  SSL Certificate ....... Request a new SSL Certificate
  Force SSL ............. on
  HTTP/2 Support ........ on

# Nothing to add: Navidrome's docs give no setting beyond NPM's defaults. The project documents nothing more.

# Navidrome: Caddyfile site block, the same one the dankhost builder writes.
# Checked against Navidrome's docs (2026-09-26); [n] = source n below.
# Caddy passes WebSockets and sets X-Forwarded-For/-Proto/-Host by itself.
music.example.org {
	reverse_proxy navidrome:4533
}

# Navidrome: Traefik v3 labels, the same ones the dankhost builder writes.
# Checked against Navidrome's docs (2026-09-26); [n] = source n below.
# "websecure" and "letsencrypt" are the builder's entrypoint and resolver names: use yours.
# Traefik must share a Docker network with the container; it passes WebSockets by itself.
services:
  navidrome:
    labels:
      traefik.enable: "true"
      traefik.http.routers.navidrome.rule: "Host(`music.example.org`)"
      traefik.http.routers.navidrome.entrypoints: "websecure"
      traefik.http.routers.navidrome.tls: "true"
      traefik.http.routers.navidrome.tls.certresolver: "letsencrypt"
      traefik.http.routers.navidrome.service: "navidrome"
      traefik.http.services.navidrome.loadbalancer.server.port: "4533"

# PhotoPrism: nginx for gallery.example.org
# App-specific lines are checked against PhotoPrism's docs (2026-09-26); [n] = source n below.

# WebSocket map [1]. It belongs in the http {} context, which conf.d files are.
# Leave it out if your nginx already defines $connection_upgrade.
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 80;
    listen [::]:80;
    server_name gallery.example.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name gallery.example.org;
    ssl_certificate     /etc/letsencrypt/live/gallery.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/gallery.example.org/privkey.pem;

    client_max_body_size 512M; # [1]
    proxy_read_timeout 600s; # [1]
    proxy_send_timeout 600s; # [1]
    proxy_buffering off; # [1]

    location / {
        proxy_pass http://photoprism:2342;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host; # [1]
        proxy_http_version 1.1; # [1]
        proxy_set_header Upgrade $http_upgrade; # [1]
        proxy_set_header Connection $connection_upgrade; # [1]
    }
}

# Nginx Proxy Manager: Hosts > Proxy Hosts > Add Proxy Host, for PhotoPrism
# Checked against PhotoPrism's docs (2026-09-26); [n] = source n below.

Details tab
  Domain Names .......... gallery.example.org
  Scheme ................ http
  Forward Hostname / IP . photoprism
  Forward Port .......... 2342
  Cache Assets .......... off
  Block Common Exploits . on
  Websockets Support .... on  # [1]

SSL tab
  SSL Certificate ....... Request a new SSL Certificate
  Force SSL ............. on
  HTTP/2 Support ........ on

client_max_body_size 512M; # [1]
proxy_read_timeout 600s; # [1]
proxy_send_timeout 600s; # [1]
proxy_buffering off; # [1]
# NPM puts this text inside the server block, where proxy_set_header does not reach its own
# location /. So this location / replaces NPM's (an Access List on this host no longer applies).
location / {
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_http_version 1.1;
    include conf.d/include/proxy.conf;
    proxy_set_header X-Forwarded-Host $host; # [1]
}

# PhotoPrism: Caddyfile site block, the same one the dankhost builder writes.
# Checked against PhotoPrism's docs (2026-09-26); [n] = source n below.
# Caddy passes WebSockets and sets X-Forwarded-For/-Proto/-Host by itself.
gallery.example.org {
	# [2]
	encode zstd gzip
	reverse_proxy photoprism:2342 {
		# [2]
		flush_interval -1
	}
}

# PhotoPrism: Traefik v3 labels, the same ones the dankhost builder writes.
# Checked against PhotoPrism's docs (2026-09-26); [n] = source n below.
# "websecure" and "letsencrypt" are the builder's entrypoint and resolver names: use yours.
# Traefik must share a Docker network with the container; it passes WebSockets by itself.
services:
  photoprism:
    labels:
      traefik.enable: "true"
      traefik.http.routers.photoprism.rule: "Host(`gallery.example.org`)"
      traefik.http.routers.photoprism.entrypoints: "websecure"
      traefik.http.routers.photoprism.tls: "true"
      traefik.http.routers.photoprism.tls.certresolver: "letsencrypt"
      traefik.http.routers.photoprism.service: "photoprism"
      traefik.http.routers.photoprism.middlewares: "photoprism-compress"
      traefik.http.services.photoprism.loadbalancer.server.port: "2342"
      traefik.http.services.photoprism.loadbalancer.responseforwarding.flushinterval: "-1ms"
      traefik.http.middlewares.photoprism-compress.compress.encodings: "zstd,gzip"
      # [2] The compress middleware (zstd, gzip) and responseForwarding.flushInterval=-1ms are
      # Traefik's form of the Caddy example's encode and flush_interval -1.

# Syncthing: nginx for sync.example.org
# App-specific lines are checked against Syncthing's docs (2026-09-26); [n] = source n below.

server {
    listen 80;
    listen [::]:80;
    server_name sync.example.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name sync.example.org;
    ssl_certificate     /etc/letsencrypt/live/sync.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sync.example.org/privkey.pem;

    proxy_read_timeout 600s; # [1]
    proxy_send_timeout 600s; # [1]

    location / {
        proxy_pass http://syncthing:8384;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# Nginx Proxy Manager: Hosts > Proxy Hosts > Add Proxy Host, for Syncthing
# Checked against Syncthing's docs (2026-09-26); [n] = source n below.

Details tab
  Domain Names .......... sync.example.org
  Scheme ................ http
  Forward Hostname / IP . syncthing
  Forward Port .......... 8384
  Cache Assets .......... off
  Block Common Exploits . on
  Websockets Support .... off (the docs ask for no WebSocket headers)

SSL tab
  SSL Certificate ....... Request a new SSL Certificate
  Force SSL ............. on
  HTTP/2 Support ........ on

proxy_read_timeout 600s; # [1]
proxy_send_timeout 600s; # [1]

# Syncthing: Caddyfile site block, the same one the dankhost builder writes.
# Checked against Syncthing's docs (2026-09-26); [n] = source n below.
# Caddy passes WebSockets and sets X-Forwarded-For/-Proto/-Host by itself.
sync.example.org {
	reverse_proxy syncthing:8384 {
		# [1]
		header_up Host {upstream_hostport}
	}
}

# Syncthing: Traefik v3 labels, the same ones the dankhost builder writes.
# Checked against Syncthing's docs (2026-09-26); [n] = source n below.
# "websecure" and "letsencrypt" are the builder's entrypoint and resolver names: use yours.
# Traefik must share a Docker network with the container; it passes WebSockets by itself.
services:
  syncthing:
    labels:
      traefik.enable: "true"
      traefik.http.routers.syncthing.rule: "Host(`sync.example.org`)"
      traefik.http.routers.syncthing.entrypoints: "websecure"
      traefik.http.routers.syncthing.tls: "true"
      traefik.http.routers.syncthing.tls.certresolver: "letsencrypt"
      traefik.http.routers.syncthing.service: "syncthing"
      traefik.http.services.syncthing.loadbalancer.server.port: "8384"
      traefik.http.services.syncthing.loadbalancer.passhostheader: "false"
      # [1] passHostHeader=false is Traefik's form of the Caddy example's header_up Host
      # {upstream_hostport}: Syncthing receives its own address as Host.

# n8n: nginx for n8n.example.org
# App-specific lines are checked against n8n's docs (2026-09-26); [n] = source n below.

server {
    listen 80;
    listen [::]:80;
    server_name n8n.example.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name n8n.example.org;
    ssl_certificate     /etc/letsencrypt/live/n8n.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/n8n.example.org/privkey.pem;

    location / {
        proxy_pass http://n8n:5678;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host; # [1]
        proxy_http_version 1.1; # [2]
        proxy_set_header Upgrade $http_upgrade; # [2]
        proxy_set_header Connection "upgrade"; # [2]
    }
}

# Nginx Proxy Manager: Hosts > Proxy Hosts > Add Proxy Host, for n8n
# Checked against n8n's docs (2026-09-26); [n] = source n below.

Details tab
  Domain Names .......... n8n.example.org
  Scheme ................ http
  Forward Hostname / IP . n8n
  Forward Port .......... 5678
  Cache Assets .......... off
  Block Common Exploits . on
  Websockets Support .... on  # [2]

SSL tab
  SSL Certificate ....... Request a new SSL Certificate
  Force SSL ............. on
  HTTP/2 Support ........ on

# NPM puts this text inside the server block, where proxy_set_header does not reach its own
# location /. So this location / replaces NPM's (an Access List on this host no longer applies).
location / {
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_http_version 1.1;
    include conf.d/include/proxy.conf;
    proxy_set_header X-Forwarded-Host $host; # [1]
}

# n8n: Caddyfile site block, the same one the dankhost builder writes.
# Checked against n8n's docs (2026-09-26); [n] = source n below.
# Caddy passes WebSockets and sets X-Forwarded-For/-Proto/-Host by itself.
n8n.example.org {
	reverse_proxy n8n:5678
}

# n8n: Traefik v3 labels, the same ones the dankhost builder writes.
# Checked against n8n's docs (2026-09-26); [n] = source n below.
# "websecure" and "letsencrypt" are the builder's entrypoint and resolver names: use yours.
# Traefik must share a Docker network with the container; it passes WebSockets by itself.
services:
  n8n:
    labels:
      traefik.enable: "true"
      traefik.http.routers.n8n.rule: "Host(`n8n.example.org`)"
      traefik.http.routers.n8n.entrypoints: "websecure"
      traefik.http.routers.n8n.tls: "true"
      traefik.http.routers.n8n.tls.certresolver: "letsencrypt"
      traefik.http.routers.n8n.service: "n8n"
      traefik.http.services.n8n.loadbalancer.server.port: "5678"

# Open WebUI: nginx for chat.example.org
# App-specific lines are checked against Open WebUI's docs (2026-09-26); [n] = source n below.

server {
    listen 80;
    listen [::]:80;
    server_name chat.example.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name chat.example.org;
    ssl_certificate     /etc/letsencrypt/live/chat.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/chat.example.org/privkey.pem;

    client_max_body_size 20M; # [1]
    proxy_read_timeout 10m; # [1]
    proxy_buffering off; # [1]
    proxy_cache off; # [1]

    location / {
        proxy_pass http://open-webui:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1; # [1]
        proxy_set_header Upgrade $http_upgrade; # [1]
        proxy_set_header Connection "upgrade"; # [1]
    }
}

# Nginx Proxy Manager: Hosts > Proxy Hosts > Add Proxy Host, for Open WebUI
# Checked against Open WebUI's docs (2026-09-26); [n] = source n below.

Details tab
  Domain Names .......... chat.example.org
  Scheme ................ http
  Forward Hostname / IP . open-webui
  Forward Port .......... 8080
  Cache Assets .......... off
  Block Common Exploits . on
  Websockets Support .... on  # [1]

SSL tab
  SSL Certificate ....... Request a new SSL Certificate
  Force SSL ............. on
  HTTP/2 Support ........ on

client_max_body_size 20M; # [1]
proxy_read_timeout 10m; # [1]
proxy_buffering off; # [1]
proxy_cache off; # [1]

• The docs give 30-minute timeouts for very long completions in NPM (proxy_read_timeout 1800; proxy_send_timeout 1800; proxy_connect_timeout 1800;). If you use them, replace the proxy_read_timeout line above rather than adding a second one: nginx refuses a duplicate. [1]

# Open WebUI: Caddyfile site block, the same one the dankhost builder writes.
# Checked against Open WebUI's docs (2026-09-26); [n] = source n below.
# Caddy passes WebSockets and sets X-Forwarded-For/-Proto/-Host by itself.
chat.example.org {
	reverse_proxy open-webui:8080
}

# Open WebUI: Traefik v3 labels, the same ones the dankhost builder writes.
# Checked against Open WebUI's docs (2026-09-26); [n] = source n below.
# "websecure" and "letsencrypt" are the builder's entrypoint and resolver names: use yours.
# Traefik must share a Docker network with the container; it passes WebSockets by itself.
services:
  open-webui:
    labels:
      traefik.enable: "true"
      traefik.http.routers.open-webui.rule: "Host(`chat.example.org`)"
      traefik.http.routers.open-webui.entrypoints: "websecure"
      traefik.http.routers.open-webui.tls: "true"
      traefik.http.routers.open-webui.tls.certresolver: "letsencrypt"
      traefik.http.routers.open-webui.service: "open-webui"
      traefik.http.services.open-webui.loadbalancer.server.port: "8080"

# Grafana: nginx for grafana.example.org
# App-specific lines are checked against Grafana's docs (2026-09-26); [n] = source n below.

# WebSocket map [1]. It belongs in the http {} context, which conf.d files are.
# Leave it out if your nginx already defines $connection_upgrade.
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 80;
    listen [::]:80;
    server_name grafana.example.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name grafana.example.org;
    ssl_certificate     /etc/letsencrypt/live/grafana.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/grafana.example.org/privkey.pem;

    location / {
        proxy_pass http://grafana:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # WebSocket traffic [1]
    location /api/live/ {
        proxy_pass http://grafana:3000;
        proxy_http_version 1.1; # [1]
        proxy_set_header Upgrade $http_upgrade; # [1]
        proxy_set_header Connection $connection_upgrade; # [1]
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# Nginx Proxy Manager: Hosts > Proxy Hosts > Add Proxy Host, for Grafana
# Checked against Grafana's docs (2026-09-26); [n] = source n below.

Details tab
  Domain Names .......... grafana.example.org
  Scheme ................ http
  Forward Hostname / IP . grafana
  Forward Port .......... 3000
  Cache Assets .......... off
  Block Common Exploits . on
  Websockets Support .... on  # [1]

SSL tab
  SSL Certificate ....... Request a new SSL Certificate
  Force SSL ............. on
  HTTP/2 Support ........ on

# Nothing to add: Grafana's docs give no setting beyond NPM's defaults. The project documents nothing more.

# Grafana: Caddyfile site block, the same one the dankhost builder writes.
# Checked against Grafana's docs (2026-09-26); [n] = source n below.
# Caddy passes WebSockets and sets X-Forwarded-For/-Proto/-Host by itself.
grafana.example.org {
	reverse_proxy grafana:3000
}

# Grafana: Traefik v3 labels, the same ones the dankhost builder writes.
# Checked against Grafana's docs (2026-09-26); [n] = source n below.
# "websecure" and "letsencrypt" are the builder's entrypoint and resolver names: use yours.
# Traefik must share a Docker network with the container; it passes WebSockets by itself.
services:
  grafana:
    labels:
      traefik.enable: "true"
      traefik.http.routers.grafana.rule: "Host(`grafana.example.org`)"
      traefik.http.routers.grafana.entrypoints: "websecure"
      traefik.http.routers.grafana.tls: "true"
      traefik.http.routers.grafana.tls.certresolver: "letsencrypt"
      traefik.http.routers.grafana.service: "grafana"
      traefik.http.services.grafana.loadbalancer.server.port: "3000"

# Forgejo: nginx for git.example.org
# App-specific lines are checked against Forgejo's docs (2026-09-26); [n] = source n below.

server {
    listen 80;
    listen [::]:80;
    server_name git.example.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name git.example.org;
    ssl_certificate     /etc/letsencrypt/live/git.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/git.example.org/privkey.pem;

    client_max_body_size 512M; # [1]
    merge_slashes off; # [1]

    location / {
        proxy_pass http://server:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1; # [1]
        proxy_set_header Upgrade $http_upgrade; # [1]
        proxy_set_header Connection $http_connection; # [1]
    }
}

# Nginx Proxy Manager: Hosts > Proxy Hosts > Add Proxy Host, for Forgejo
# Checked against Forgejo's docs (2026-09-26); [n] = source n below.

Details tab
  Domain Names .......... git.example.org
  Scheme ................ http
  Forward Hostname / IP . server
  Forward Port .......... 3000
  Cache Assets .......... off
  Block Common Exploits . on
  Websockets Support .... on  # [1]

SSL tab
  SSL Certificate ....... Request a new SSL Certificate
  Force SSL ............. on
  HTTP/2 Support ........ on

client_max_body_size 512M; # [1]
merge_slashes off; # [1]

# Forgejo: Caddyfile site block, the same one the dankhost builder writes.
# Checked against Forgejo's docs (2026-09-26); [n] = source n below.
# Caddy passes WebSockets and sets X-Forwarded-For/-Proto/-Host by itself.
git.example.org {
	reverse_proxy server:3000
}

# Forgejo: Traefik v3 labels, the same ones the dankhost builder writes.
# Checked against Forgejo's docs (2026-09-26); [n] = source n below.
# "websecure" and "letsencrypt" are the builder's entrypoint and resolver names: use yours.
# Traefik must share a Docker network with the container; it passes WebSockets by itself.
services:
  server:
    labels:
      traefik.enable: "true"
      traefik.http.routers.forgejo.rule: "Host(`git.example.org`)"
      traefik.http.routers.forgejo.entrypoints: "websecure"
      traefik.http.routers.forgejo.tls: "true"
      traefik.http.routers.forgejo.tls.certresolver: "letsencrypt"
      traefik.http.routers.forgejo.service: "forgejo"
      traefik.http.services.forgejo.loadbalancer.server.port: "3000"

# Frigate: nginx for nvr.example.org
# App-specific lines are checked against Frigate's docs (2026-09-26); [n] = source n below.

server {
    listen 80;
    listen [::]:80;
    server_name nvr.example.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name nvr.example.org;
    ssl_certificate     /etc/letsencrypt/live/nvr.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/nvr.example.org/privkey.pem;

    location / {
        proxy_pass http://frigate:8971;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1; # [1]
        proxy_set_header Upgrade $http_upgrade; # [1]
        proxy_set_header Connection $http_connection; # [1]
    }
}

# Nginx Proxy Manager: Hosts > Proxy Hosts > Add Proxy Host, for Frigate
# Checked against Frigate's docs (2026-09-26); [n] = source n below.

Details tab
  Domain Names .......... nvr.example.org
  Scheme ................ http
  Forward Hostname / IP . frigate
  Forward Port .......... 8971
  Cache Assets .......... off
  Block Common Exploits . on
  Websockets Support .... on  # [1]

SSL tab
  SSL Certificate ....... Request a new SSL Certificate
  Force SSL ............. on
  HTTP/2 Support ........ on

# Nothing to add: Frigate's docs give no setting beyond NPM's defaults. The project documents nothing more.

# Frigate: Caddyfile site block, the same one the dankhost builder writes.
# Checked against Frigate's docs (2026-09-26); [n] = source n below.
# Caddy passes WebSockets and sets X-Forwarded-For/-Proto/-Host by itself.
nvr.example.org {
	reverse_proxy frigate:8971
}

# Frigate: Traefik v3 labels, the same ones the dankhost builder writes.
# Checked against Frigate's docs (2026-09-26); [n] = source n below.
# "websecure" and "letsencrypt" are the builder's entrypoint and resolver names: use yours.
# Traefik must share a Docker network with the container; it passes WebSockets by itself.
services:
  frigate:
    labels:
      traefik.enable: "true"
      traefik.http.routers.frigate.rule: "Host(`nvr.example.org`)"
      traefik.http.routers.frigate.entrypoints: "websecure"
      traefik.http.routers.frigate.tls: "true"
      traefik.http.routers.frigate.tls.certresolver: "letsencrypt"
      traefik.http.routers.frigate.service: "frigate"
      traefik.http.services.frigate.loadbalancer.server.port: "8971"
      # No https server scheme label here: with Frigate's own TLS turned off (see "In Frigate
      # itself") Traefik talks plain HTTP to port 8971, and nothing here skips certificate
      # checks.

# Portainer CE: nginx for portainer.example.org
# App-specific lines are checked against Portainer CE's docs (2026-09-26); [n] = source n below.

server {
    listen 80;
    listen [::]:80;
    server_name portainer.example.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name portainer.example.org;
    ssl_certificate     /etc/letsencrypt/live/portainer.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/portainer.example.org/privkey.pem;

    location / {
        proxy_pass http://portainer:9000;
        proxy_set_header Host $http_host; # [1]
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# Nginx Proxy Manager: Hosts > Proxy Hosts > Add Proxy Host, for Portainer CE
# Checked against Portainer CE's docs (2026-09-26); [n] = source n below.

Details tab
  Domain Names .......... portainer.example.org
  Scheme ................ http
  Forward Hostname / IP . portainer
  Forward Port .......... 9000
  Cache Assets .......... off
  Block Common Exploits . on
  Websockets Support .... off (the docs ask for no WebSocket headers)

SSL tab
  SSL Certificate ....... Request a new SSL Certificate
  Force SSL ............. on
  HTTP/2 Support ........ on

# Host: NPM already sends Host $host, the same value as $http_host while NPM listens on 443.

• NPM sends Host $host, which equals $http_host while NPM listens on the standard port 443; on another port Portainer's CSRF check rejects requests with 403 unless you add the public origin with --trusted-origins. [1]

# Portainer CE: Caddyfile site block, the same one the dankhost builder writes.
# Checked against Portainer CE's docs (2026-09-26); [n] = source n below.
# Caddy passes WebSockets and sets X-Forwarded-For/-Proto/-Host by itself.
portainer.example.org {
	reverse_proxy portainer:9000
}

# Portainer CE: Traefik v3 labels, the same ones the dankhost builder writes.
# Checked against Portainer CE's docs (2026-09-26); [n] = source n below.
# "websecure" and "letsencrypt" are the builder's entrypoint and resolver names: use yours.
# Traefik must share a Docker network with the container; it passes WebSockets by itself.
services:
  portainer:
    labels:
      traefik.enable: "true"
      traefik.http.routers.portainer.rule: "Host(`portainer.example.org`)"
      traefik.http.routers.portainer.entrypoints: "websecure"
      traefik.http.routers.portainer.tls: "true"
      traefik.http.routers.portainer.tls.certresolver: "letsencrypt"
      traefik.http.routers.portainer.service: "portainer"
      traefik.http.services.portainer.loadbalancer.server.port: "9000"

# AdGuard Home: nginx for adguard.example.org
# App-specific lines are checked against AdGuard Home's docs (2026-09-26); [n] = source n below.
# AdGuard Home's docs give no nginx setting beyond the generic lines. The project documents nothing more.

server {
    listen 80;
    listen [::]:80;
    server_name adguard.example.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name adguard.example.org;
    ssl_certificate     /etc/letsencrypt/live/adguard.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/adguard.example.org/privkey.pem;

    location / {
        proxy_pass http://adguardhome:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# Nginx Proxy Manager: Hosts > Proxy Hosts > Add Proxy Host, for AdGuard Home
# Checked against AdGuard Home's docs (2026-09-26); [n] = source n below.

Details tab
  Domain Names .......... adguard.example.org
  Scheme ................ http
  Forward Hostname / IP . adguardhome
  Forward Port .......... 3000
  Cache Assets .......... off
  Block Common Exploits . on
  Websockets Support .... off (the docs ask for no WebSocket headers)

SSL tab
  SSL Certificate ....... Request a new SSL Certificate
  Force SSL ............. on
  HTTP/2 Support ........ on

# Nothing to add: AdGuard Home's docs give no setting beyond NPM's defaults. The project documents nothing more.

# AdGuard Home: Caddyfile site block, the same one the dankhost builder writes.
# Checked against AdGuard Home's docs (2026-09-26); [n] = source n below.
# Caddy passes WebSockets and sets X-Forwarded-For/-Proto/-Host by itself.
adguard.example.org {
	reverse_proxy adguardhome:3000
}

# AdGuard Home: Traefik v3 labels, the same ones the dankhost builder writes.
# Checked against AdGuard Home's docs (2026-09-26); [n] = source n below.
# "websecure" and "letsencrypt" are the builder's entrypoint and resolver names: use yours.
# Traefik must share a Docker network with the container; it passes WebSockets by itself.
services:
  adguardhome:
    labels:
      traefik.enable: "true"
      traefik.http.routers.adguard-home.rule: "Host(`adguard.example.org`)"
      traefik.http.routers.adguard-home.entrypoints: "websecure"
      traefik.http.routers.adguard-home.tls: "true"
      traefik.http.routers.adguard-home.tls.certresolver: "letsencrypt"
      traefik.http.routers.adguard-home.service: "adguard-home"
      traefik.http.services.adguard-home.loadbalancer.server.port: "3000"

# ntfy: nginx for ntfy.example.org
# App-specific lines are checked against ntfy's docs (2026-09-26); [n] = source n below.

server {
    listen 80;
    listen [::]:80;
    server_name ntfy.example.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name ntfy.example.org;
    ssl_certificate     /etc/letsencrypt/live/ntfy.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/ntfy.example.org/privkey.pem;

    client_max_body_size 0; # [1]
    proxy_connect_timeout 3m; # [1]
    proxy_read_timeout 3m; # [1]
    proxy_send_timeout 3m; # [1]
    proxy_buffering off; # [1]
    proxy_request_buffering off; # [1]
    proxy_redirect off; # [1]

    location / {
        proxy_pass http://ntfy:80;
        proxy_set_header Host $http_host; # [1]
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1; # [1]
        proxy_set_header Upgrade $http_upgrade; # [1]
        proxy_set_header Connection "upgrade"; # [1]
    }
}

# Nginx Proxy Manager: Hosts > Proxy Hosts > Add Proxy Host, for ntfy
# Checked against ntfy's docs (2026-09-26); [n] = source n below.

Details tab
  Domain Names .......... ntfy.example.org
  Scheme ................ http
  Forward Hostname / IP . ntfy
  Forward Port .......... 80
  Cache Assets .......... off
  Block Common Exploits . on
  Websockets Support .... on  # [1]

SSL tab
  SSL Certificate ....... Request a new SSL Certificate
  Force SSL ............. on
  HTTP/2 Support ........ on

client_max_body_size 0; # [1]
proxy_connect_timeout 3m; # [1]
proxy_read_timeout 3m; # [1]
proxy_send_timeout 3m; # [1]
proxy_buffering off; # [1]
proxy_request_buffering off; # [1]
proxy_redirect off; # [1]
# Host: NPM already sends Host $host, the same value as $http_host while NPM listens on 443.

# ntfy: Caddyfile site block, the same one the dankhost builder writes.
# Checked against ntfy's docs (2026-09-26); [n] = source n below.
# Caddy passes WebSockets and sets X-Forwarded-For/-Proto/-Host by itself.
ntfy.example.org {
	reverse_proxy ntfy:80
}

# ntfy: Traefik v3 labels, the same ones the dankhost builder writes.
# Checked against ntfy's docs (2026-09-26); [n] = source n below.
# "websecure" and "letsencrypt" are the builder's entrypoint and resolver names: use yours.
# Traefik must share a Docker network with the container; it passes WebSockets by itself.
services:
  ntfy:
    labels:
      traefik.enable: "true"
      traefik.http.routers.ntfy.rule: "Host(`ntfy.example.org`)"
      traefik.http.routers.ntfy.entrypoints: "websecure"
      traefik.http.routers.ntfy.tls: "true"
      traefik.http.routers.ntfy.tls.certresolver: "letsencrypt"
      traefik.http.routers.ntfy.service: "ntfy"
      traefik.http.services.ntfy.loadbalancer.server.port: "80"

# Gotify: nginx for gotify.example.org
# App-specific lines are checked against Gotify's docs (2026-09-26); [n] = source n below.

server {
    listen 80;
    listen [::]:80;
    server_name gotify.example.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name gotify.example.org;
    ssl_certificate     /etc/letsencrypt/live/gotify.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/gotify.example.org/privkey.pem;

    proxy_connect_timeout 1m; # [1]
    proxy_read_timeout 1m; # [1]
    proxy_send_timeout 1m; # [1]

    location / {
        proxy_pass http://gotify:80;
        proxy_set_header Host $http_host; # [1]
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_redirect http:// $scheme://; # [1]
        proxy_http_version 1.1; # [1]
        proxy_set_header Upgrade $http_upgrade; # [1]
        proxy_set_header Connection "upgrade"; # [1]
    }
}

# Nginx Proxy Manager: Hosts > Proxy Hosts > Add Proxy Host, for Gotify
# Checked against Gotify's docs (2026-09-26); [n] = source n below.

Details tab
  Domain Names .......... gotify.example.org
  Scheme ................ http
  Forward Hostname / IP . gotify
  Forward Port .......... 80
  Cache Assets .......... off
  Block Common Exploits . on
  Websockets Support .... on  # [1]

SSL tab
  SSL Certificate ....... Request a new SSL Certificate
  Force SSL ............. on
  HTTP/2 Support ........ on

proxy_connect_timeout 1m; # [1]
proxy_read_timeout 1m; # [1]
proxy_send_timeout 1m; # [1]
proxy_redirect http:// $scheme://; # [1]
# Host: NPM already sends Host $host, the same value as $http_host while NPM listens on 443.

# Gotify: Caddyfile site block, the same one the dankhost builder writes.
# Checked against Gotify's docs (2026-09-26); [n] = source n below.
# Caddy passes WebSockets and sets X-Forwarded-For/-Proto/-Host by itself.
gotify.example.org {
	reverse_proxy gotify:80
}

# Gotify: Traefik v3 labels, the same ones the dankhost builder writes.
# Checked against Gotify's docs (2026-09-26); [n] = source n below.
# "websecure" and "letsencrypt" are the builder's entrypoint and resolver names: use yours.
# Traefik must share a Docker network with the container; it passes WebSockets by itself.
services:
  gotify:
    labels:
      traefik.enable: "true"
      traefik.http.routers.gotify.rule: "Host(`gotify.example.org`)"
      traefik.http.routers.gotify.entrypoints: "websecure"
      traefik.http.routers.gotify.tls: "true"
      traefik.http.routers.gotify.tls.certresolver: "letsencrypt"
      traefik.http.routers.gotify.service: "gotify"
      traefik.http.services.gotify.loadbalancer.server.port: "80"