NPMplus

This project comes as a pre-built docker image that enables you to easily forward to your websites running at home or otherwise, including free TLS, without having to know too much about Nginx or Certbot.

• Quick Setup

  Note: Reloading the NPMplus UI can cause a 502 error. See https://github.com/ZoeyVid/NPMplus/issues/241.
  Note: NO armv7, route53 and aws cloudfront ip ranges support.
  Note: add net.ipv4.ip_unprivileged_port_start=0 at the end of /etc/sysctl.conf to support PUID/PGID in network mode host.
  Note: If you don't use network mode host, which I don't recommend, don't forget to expose port 443 on tcp AND udp (http3/quic needs udp).
  Note: If you don't use network mode host, which I don't recommend, don't forget to enable IPv6 in Docker, see here, you only need to follow step one and two before deploying NPMplus!
  Note: Don't forget to open Port 80 (tcp) and 443 (tcp AND udp, http3/quic needs udp) in your firewall (because of network mode host, you also need to open this ports in ufw, if you use ufw).
  Note: ModSecurity overblocking (403 Error)? Please see /opt/npm/etc/modsecurity, if you also use CRS please see here.
  Note: Other Databases like MariaDB may work, but are unsupported.
  Note: access.log/stream.log, logrotate and goaccess are NOT enabled by default bceuase of GDPR, you can enable them in the compose.yaml.
  Note: if you remove a cert, which is still used by a host, NPM/NPMplus will crash.
  

  Project Goal

  I created this project to fill a personal need to provide users with an easy way to accomplish reverse proxying hosts with TLS termination and it had to be so easy that a monkey could do it. This goal hasn't changed. While there might be advanced options they are optional and the project should be as simple as possible so that the barrier for entry here is low.

  Features

  • Beautiful and Secure Admin Interface based on Tabler
  • Easily create forwarding domains, redirections, streams and 404 hosts without knowing anything about Nginx
  • Free trusted TLS certificates using Certbot (Let's Encrypt/other CAs) or provide your own custom TLS certificates
  • Access Lists and basic HTTP Authentication for your hosts
  • Advanced Nginx configuration available for super users
  • User management, permissions and audit log

  List of new features

  • Supports HTTP/3 (QUIC) protocol.
  • Supports CrowdSec IPS. Please see here to enable it.
  • goaccess included, see compose.yaml to enable, runs by default on https://:91 (nginx config from here)
  • Supports ModSecurity, with coreruleset as an option. You can configure ModSecurity/coreruleset by editing the files in the /opt/npm/etc/modsecurity folder.
    • If the core ruleset blocks valid requests, please check the /opt/npm/etc/modsecurity/crs-setup.conf file.
    • Try to whitelist the Content-Type you are sending (for example, application/activity+json for Mastodon and application/dns-message for DoH).
    • Try to whitelist the HTTP request method you are using (for example, PUT is blocked by default, which also affects NPM).