# Nginx Proxy Manager
import {
adguardAdminLink,
adguardSetupLink,
npmServerLink,
serverIp,
virtualIp,
} from "@/lib/mdx-constants";
Access your home services via a secure URL from anywhere in the world. This guide covers setting up AdGuard Home for custom DNS, Nginx Proxy Manager for wildcard SSL certificates via Cloudflare and Tailscale for a zero-config VPN mesh.
### References
---
1. ## Tailscale
[Setup Tailscale](/guides/linux/programs/tailscale)
2. ## Docker
Deploy AdGuard Home and Nginx Proxy Manager as containerized services for network filtering and reverse proxying.
1. ### Make directory
```sh wrap preserveIndent
mkdir -p {{DOCKER_PATH_VAR}}/dns-proxy && cd {{DOCKER_PATH_VAR}}/dns-proxy
```
2. ### compose.yml
```sh
nano compose.yml
```
```yml title="compose.yml"
composeYml
```
```yml title="compose.yml"
composeWithSyncYml
```
```sh
nano .env
```
```dotenv title=".env"
env
```
**keepalived.conf (Optional)**
```sh wrap
mkdir -p ./keepalived && nano ./keepalived/keepalived.conf
```
```dotenv title="./keepalived/keepalived.conf"
keepalivedConfig
```
3. ### Fix port conflict (53)
#### Disable the stub listener
```sh
sudo nano /etc/systemd/resolved.conf
```
Set `DNSStubListener=no`
#### Restart systemd-resolved
```sh
sudo systemctl restart systemd-resolved
```
4. ### Start container
```sh
docker compose up -d
```
3. ## Cloudflare
Generate a scoped API token to automate DNS record management and SSL certificate validation.
- Go to Dashboard > My Profile > **API Tokens**.
- **Create Token:** Use the `Edit zone DNS template`.
- **Permissions:** Select `Zone` | `DNS` | `Edit`.
- **Zone Resources:** Select `Include` | `Specific zone` | `your-domain.tld`.
4. ## AdGuard Home
Complete the initial web setup to manage network-wide DNS filtering and security rules.
1. ### Initial setup
- Go to http://localhost:3000 or {adguardSetupLink}
- Admin Web Interface.
- **Listen interface:** Select `All interfaces`.
- **Port:** Change to `8080`.
2. ### DNS rewrites
- Go to http://localhost:8080 or {adguardAdminLink}
- Go to Filters > **DNS Rewrites**.
- Click **Add DNS rewrite**.
- **Domain name:** `*.lan.your-domain.tld`.
- **IP address:** Enter your device IP {serverIp} or virtual IP {virtualIp}.
3. ### Blocklists (optional)
1. Preconfigured list
- Go to Filters > DNS Blocklists > **Add Blocklist:** `Choose from the list`.
- [x] AdGuard DNS filter
- [x] AdAway Default Blocklist
- [x] HaGeZi's Pro++ Blocklist
- [x] OISD Blocklist Small
- [x] OISD Blocklist Big
- [x] HaGeZi's Samsung Tracker Blocklist
2. Custom list
- Go to Filters > DNS Blocklists > **Add Blocklist:** `Add a custom list`.
- **Name:** Enter a name.
- ```txt wrap title="URL"
https://raw.githubusercontent.com/huffmanks/code-share/refs/heads/main/src/files/config/adguard/blocklist.txt
```
4. ### General settings (optional)
- Go to Settings > **General Settings**.
- [x] Use AdGuard `browsing security` web service.
- [x] Use AdGuard `parental control` web service.
- [x] Use `Safe Search`.
5. ### DNS settings (optional)
- Go to Settings > **DNS settings**.
- **Upstream DNS servers**.
```txt
https://dns.quad9.net/dns-query
https://dns.cloudflare.com/dns-query
https://dns.adguard-dns.com/dns-query
```
- Enter the **DNS providers** above.
- Click `apply`.
- **DNS server configuration**.
- [x] Enable DNSSEC.
- Click `save`.
- Access Settings > **Allowed clients**.
```txt
100.64.0.0/10
{{SUBNET_VAR}}
```
- Add **Tailscale and device IP ranges** above.
- Leave blank to allow all.
- Click `Save configuration`.
5. ### Filters (optional)
- Go to Filters > **Custom filtering rules**.
```txt wrap
@@||tailscale.com^
@@||tailscale.io^
@@||log.tailscale.io^
||*.church^$denyallow=host.church|life.church|online.church,badfilter
```
- Add **domains** to allow.
- Click `Apply`.
5. ## Nginx Proxy Manager
Access the administrative dashboard to route incoming traffic and manage SSL certificates for your services.
1. ### Certificate
- Go to http://localhost:81 or {npmServerLink}
- Go to Certificates > Add Certificate > **Let’s Encrypt via DNS**.
- **Domain Names:** Enter `*.lan.your-domain.tld`.
- **DNS Provider:** Select `Cloudflare`.
- **Credentials File Content:** Replace `dns_cloudflare_api_token=YOUR_CLOUDFLARE_API_KEY`.
- **Agree to terms** and click `Save`.
2. ### Proxy host
- In NPM, go to Hosts > Proxy Hosts > **Add Proxy Host**.
- **Domain Names:** `adguard.lan.your-domain.tld`.
- **Scheme:** `http`.
- **Forward IP:** {serverIp}.
- **Forward Port:** `8080`.
- **Block common exploits and Websockets support:** toggle to `ON`.
- **SSL Tab:** Select the certificate you created.
- **Force SSL and HTTP/2 Support:** toggle to `ON`.
- Click `Save`.
6. ## Router config
Update the **Primary DNS**, often located under LAN, DHCP or DNS Settings.
- **Primary DNS:** {serverIp} or {virtualIp} *(Your device’s Local LAN IP or virtual IP, not the Tailscale one)*.
- **Secondary DNS:** `1.1.1.1` *(Fail-safe so your internet still works if your device is turned off)*.