Nginx Proxy Manager

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a reasonable starting point.

Configure the network security group (NSG) to allow these inbound ports:

• 22/tcp from your management network
• 80/tcp and 443/tcp for proxied traffic and Let's Encrypt challenges
• 81/tcp for the admin UI

Restrict 81/tcp to trusted source IPs, so that the admin console is not exposed to the whole internet.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Nginx Proxy Manager by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22), HTTP (80), HTTPS (443) and 81 (admin UI).

Review the dedicated data disk on the Disks tab. Then select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:nginx-proxy-manager-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name nginx-proxy-manager \
  --image sac1647283583153:nginx-proxy-manager-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name nginx-proxy-manager --port 80 --priority 1010
az vm open-port --resource-group <your-rg> --name nginx-proxy-manager --port 443 --priority 1020
az vm open-port --resource-group <your-rg> --name nginx-proxy-manager --port 81 --priority 1030

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active docker.service nginx-proxy-manager-firstboot.service

Both report active. Docker manages the Nginx Proxy Manager container, which publishes ports 80 and 443 for proxied traffic and port 81 for the admin UI.

The database, nginx configuration and issued certificates live on the dedicated Azure data disk mounted at /var/lib/npm.

Step 5 - Retrieve your admin credentials

Nginx Proxy Manager 2.15 ships no default password. The first boot of your VM creates a unique admin account and writes it to a root-only file. Read the file:

sudo cat /root/nginx-proxy-manager-credentials.txt

The file contains NPM_ADMIN_EMAIL (admin@example.com), the generated NPM_ADMIN_PASSWORD, and the admin URL. Store the password somewhere safe. You can change it in the UI at any time.

Step 6 - Confirm the health endpoint

Nginx Proxy Manager exposes an unauthenticated health endpoint that also reports whether an admin has been set up:

curl -s http://localhost:81/api/

It returns {"status":"OK","setup":true,...}. The setup:true flag confirms that your per-VM admin account already exists, so the admin console is protected the moment the VM is reachable.

This endpoint never requires authentication, so it is safe for an Azure Load Balancer health probe.

Step 7 - Confirm the default password is rejected

No instance ships with the well-known default changeme password. You can prove that the default is rejected before you open the UI:

curl -s -H 'Content-Type: application/json' -X POST \
  --data '{"identity":"admin@example.com","secret":"changeme"}' \
  http://localhost:81/api/tokens

It returns an Invalid email or password error, and no token is issued. Only the per-VM password from Step 5 authenticates.

Step 8 - Sign in to the admin console

Browse to http://<vm-public-ip>:81/. Nginx Proxy Manager shows a login page. Enter the email and password from Step 5.

After you sign in, the Dashboard is your home page. It shows how many Proxy Hosts, Redirection Hosts, Streams and 404 Hosts you have. The Hosts, Access Lists, Certificates, Users, Audit Logs and Settings menus run across the top.

Step 9 - Add a proxy host

Open Hosts > Proxy Hosts and click Add Proxy Host.

Enter the Domain Names that point at this VM. Choose the forward Scheme (http/https), and enter the Forward Hostname / IP and Forward Port of your backend. Optionally, enable Block Common Exploits and Websockets Support.

Click Save, and Nginx Proxy Manager writes the nginx configuration for you.

Step 10 - Request a free Let's Encrypt certificate

Open the Certificates tab and click Add Certificate > Let's Encrypt. Alternatively, turn on SSL directly in the SSL tab of a proxy host.

Enter your domain and agree to the Let's Encrypt terms. Nginx Proxy Manager completes the HTTP-01 challenge over port 80 and installs the certificate, then renews it automatically before it expires.

Step 11 - Confirm data lives on the dedicated disk

Nginx Proxy Manager's SQLite database, nginx configuration and issued certificates are stored under /var/lib/npm on the dedicated Azure data disk. The disk is bind-mounted into the container as /data and /etc/letsencrypt, so the data survives OS changes and can be resized independently. Confirm the mount:

findmnt /var/lib/npm

A separate Azure data disk backs the mount. The disk is captured into the image and re-provisioned on every VM.

Maintenance

• Admin password: first boot creates the admin account. To change the password, sign in and use the user menu, then Edit. You can also manage users under Users.
• Certificates: Nginx Proxy Manager requests and renews Let's Encrypt certificates automatically from the Certificates tab. Renewal needs port 80 reachable from the internet for the HTTP-01 challenge.
• Admin UI security: restrict 81/tcp in your Azure NSG to trusted source IPs. The proxied traffic on ports 80 and 443 stays publicly reachable while the admin console is locked down.
• Upgrades: Nginx Proxy Manager runs as the nginx-proxy-manager container from the pinned jc21/nginx-proxy-manager:2.15.1 image. To upgrade, pull a newer tag, remove the container and re-run it with the same -v /var/lib/npm/data:/data -v /var/lib/npm/letsencrypt:/etc/letsencrypt mounts, so that your data is preserved.
• Storage: all state lives under /var/lib/npm on the data disk. Back up that volume to protect your hosts and certificates.
• Security patches: unattended-upgrades remains enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Nginx Proxy Manager on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com