Reverse-Proxy

Traefik vs Caddy vs Nginx Proxy Manager: Reverse Proxy Showdown 2026 Every self-hoster hits the same wall: you’ve got a dozen services running on different ports, and you want clean URLs with HTTPS. You need a reverse proxy. The question is which one. Traefik, Caddy, and Nginx Proxy Manager are the three most popular choices in the self-hosting world. They all solve the same core problem — route app.yourdomain.com to the right container with automatic SSL — but they do it very differently. ...

The Complete Self-Hosting Security Stack: Fail2Ban + CrowdSec + Authelia Running self-hosted services on the open internet without a security stack is like leaving your front door unlocked in a busy neighborhood. Individual tools help, but real protection comes from layering defenses so each one covers the gaps of the others. This guide builds a complete security stack using three open-source tools: Fail2Ban — reactive log-based banning for brute-force attacks CrowdSec — community-powered threat intelligence and behavioral detection Authelia — authentication portal with single sign-on and multi-factor authentication Together, they give you intrusion prevention, shared threat intelligence, and access control. All running in Docker, all free. ...

The Complete Self-Hosting Security Stack: Fail2Ban + CrowdSec + Authelia Running self-hosted services is great — until someone else discovers them. The moment you expose a port to the internet, bots start probing. Brute-force SSH attempts, credential stuffing on web apps, vulnerability scanners — it never stops. No single tool solves this. You need layers. This guide walks through building a complete security stack using three open-source tools that complement each other perfectly: ...

Running Caddy Server: The Zero-Config HTTPS Reverse Proxy You’re running a dozen Docker containers. Each one listens on a different port. You’re tired of remembering 192.168.1.50:8096 for Jellyfin and :3000 for Gitea. You want jellyfin.yourdomain.com with HTTPS — and you don’t want to wrestle with Nginx config files or manually renew Let’s Encrypt certificates. Caddy does all of this automatically. Point a domain at it, tell it where your service lives, and it handles HTTPS certificates, renewal, and reverse proxying with almost zero configuration. ...

If you’re running multiple Docker services and juggling Nginx configs every time you add a container, Traefik will change your life. It watches Docker for new containers and automatically configures routing — no config file edits, no reloads, no downtime. What is Traefik? Traefik is a modern reverse proxy and load balancer designed for microservices and containers. Version 3 brought HTTP/3 support, WASM plugins, and a cleaner configuration model. It sits in front of all your services, handles SSL termination, and routes traffic based on Docker labels. ...

Running multiple self-hosted services on one server creates a problem: they all need different ports. Nextcloud on 8080, Jellyfin on 8096, Grafana on 3000 — and you’re expected to remember all of them. Worse, none of them have SSL unless you set it up manually. Nginx Proxy Manager (NPM) fixes this by giving you a clean web UI to manage reverse proxy hosts, automatically provision SSL certificates from Let’s Encrypt, and control access — all without touching a single Nginx config file. ...

Choosing a reverse proxy is one of the first big decisions when self-hosting. It sits in front of all your services, handles SSL certificates, and routes traffic to the right container. Pick the wrong one and you’ll waste hours fighting configuration files. This guide compares the three most popular options — Nginx Proxy Manager, Caddy, and Traefik — from a beginner’s perspective. By the end, you’ll know exactly which one to start with. ...