Choosing a Reverse Proxy for a Home Server Without Headaches

Most home servers start with one service on one port. Then a photo library arrives on 2342, a password manager on 8080, a media server on 8096, and six months later you are typing port numbers from memory and accepting browser warnings about certificates you never set up. Picking a reverse proxy for a home server is the step that turns that pile of ports into a set of clean addresses like photos.home.example and vault.home.example, each with a valid certificate.

I have run Nginx, Caddy and Traefik on the same small machine over the years, an old four core mini PC with 8 GB of RAM. All three work. The differences that matter for a household setup are not speed or features. They are how much configuration you have to remember, how certificates get renewed, and what happens when something breaks at 23:00 on a Sunday.

What a Reverse Proxy for a Home Server Actually Does

A reverse proxy sits in front of your services and receives every request on ports 80 and 443. It reads the hostname the browser asked for, then forwards the request to the right internal address, such as 192.168.1.20:8096. The services themselves never face the network directly.

That single entry point gives you three practical things:

• One place for certificates. The proxy handles TLS, so each app can keep speaking plain HTTP on the local network.
• Friendly names. Subdomains replace port numbers, which also means bookmarks survive when you move a service to another machine.
• One place for rules. Access limits, basic authentication and request size caps live in one file instead of ten app settings pages.

It does not make a vulnerable app safe. If the app behind it has a login bypass, the proxy forwards the attack politely. That is why the checklist in what to check before exposing a home server online still applies after the proxy is in place.

The Three Common Choices Compared

For a home lab with five to fifteen services, the realistic shortlist is short. Here is how they compare on the points that decide daily life with them.

A Caddy entry for a media server can be as small as the hostname followed by one reverse_proxy line pointing at the internal port. The equivalent Nginx block is usually 15 to 25 lines once you add headers, TLS paths and the redirect from HTTP. Neither is wrong. One is just easier to read a year later.

Why I Usually Recommend Caddy First

The strongest argument is the certificate story. Caddy requests and renews certificates from Let's Encrypt on its own, and it does so before expiry without a cron job you set up and forgot. With Nginx, renewal depends on a separate timer, and the most common failure I see in forums is a certificate that expired because that timer stopped after an OS upgrade.

The second argument is that the config file is short enough to keep in your head. When a family member says the photo site is down, you open one file, see four lines, and know immediately whether the problem is the proxy or the app.

Caddy is not ideal everywhere. If you need fine control over caching, rate limiting per path or unusual load balancing, Nginx has more documented recipes. For a house, you rarely need those.

The Advice I Would Push Back On

A lot of guides tell beginners to start with Traefik because it discovers Docker containers automatically. In my experience that is backwards for a first proxy. Traefik's model involves entry points, routers, services and middlewares, all expressed as container labels. When a route fails, the error can sit in any of four layers, spread across several compose files.

Automatic discovery pays off when containers come and go every week. Most home servers change maybe once a month. For that pace, a static file you edit by hand is faster to debug than a system that writes the routing table for you. Learn the concept with something simple, then move to Traefik if you outgrow it.

Certificates Without Opening Your Network

Many people want valid HTTPS but do not want anything reachable from the internet. That is possible, and it is the setup I use for most services.

Use the DNS challenge

Instead of proving domain ownership by answering on port 80, the proxy creates a temporary DNS TXT record through your DNS provider's API. Let's Encrypt checks the record, issues the certificate, and nothing inside your house was ever exposed. You need a domain, which costs around 10 to 15 dollars a year, and an API token limited to editing that one zone.

Point names at private addresses

You can create DNS records for vault.home.example that resolve to 192.168.1.20. From outside, the address goes nowhere. From inside, it works with a real certificate and no browser warnings. Some home routers block private answers from public DNS as a rebinding protection, so you may need to add an exception or use local DNS.

Mistakes That Cost an Evening

1. Forgetting forwarded headers. Apps like Nextcloud need to know the original hostname and that the visitor used HTTPS. Without that, logins loop or links point to http addresses.
2. Upload limits. Nginx defaults to a 1 MB request body. The first time someone uploads a phone video to a self hosted photo app, it fails with a vague error.
3. WebSockets. Home Assistant and several chat apps need the connection upgrade passed through. Caddy does this automatically; Nginx needs explicit lines.
4. Binding services to all interfaces. If the app still listens on 0.0.0.0:8096, anyone on your network can skip the proxy. Bind it to localhost or a Docker network instead.

Keeping the Proxy Boring Over Time

A proxy that works should be left alone, but not ignored. Keep the config file in a small Git repository so every change has a date and a reason. Back it up alongside your other data, which fits naturally into the routine described in what running a home backup server involves day to day.

Check the logs once a month for two things: certificate renewal messages and unexpected hostnames. A burst of requests for names you never created usually means scanners found your public IP. That is normal, but it is a reminder to confirm that only the services you meant to share are reachable.

When you upgrade, read the release notes for the proxy before the apps behind it. A breaking change in the proxy takes every service down at once, which is the one outage the whole household notices.

FAQ

Do I need a reverse proxy if I only run two services?

Not strictly. With two services, port numbers are manageable. The proxy becomes worth it the moment you want valid HTTPS or plan to add a third service, because retrofitting names later means updating every bookmark and app setting.

Can the reverse proxy run on the same machine as my apps?

Yes, and on a home server it usually should. Running it in its own container on the same host adds almost no overhead. A separate machine only makes sense when you have several hosts and want one front door for all of them.

Is a reverse proxy the same as a VPN?

No. A VPN puts your device inside the home network, while a proxy decides where incoming web requests go. Many people combine them: the VPN for remote access, the proxy for clean names and certificates once connected.

Where to Start This Weekend

Install Caddy in a container, buy or reuse a domain, and move a single low risk service behind it using the DNS challenge and a private address. Once that one name works with a valid certificate, add the rest one at a time, testing uploads and logins after each. More setups like this live in the self hosting section.