# Nginx Proxy Manager

Nginx Proxy Manager provides the reverse-proxy and TLS termination gateway for web services hosted on Nautilus.

## Deployment layout

- **Compose:** `/srv/docker/npm/docker-compose.yml`
- **Static configuration/source:** no additional mounted static configuration or local build source
- **Non-secret environment:** `DISABLE_IPV6=true` is declared in Compose; there is no project-local `.env`
- **Secrets:** no separately mounted secret file; application-generated JWT keys, database-held credentials,
certificate private keys, and ACME account material remain inside protected application-managed state
- **NVMe application state:** `/srv/appdata/npm/data` and `/srv/appdata/npm/letsencrypt`
- **Bulk HDD data:** none
- **Other mounts:** none

Secrets are never committed to this repository. Nginx Proxy Manager generates
and maintains its JWT keys, database-held credentials, certificate private keys,
and ACME account material inside the protected application-state directories.

## Dependencies and recovery

- **Networks/dependencies:** Nginx Proxy Manager defines the shared `npm_proxy` bridge with subnet `192.168.96.0/21`
and MTU `1420`, uses `192.168.96.10`, publishes host TCP ports 80 and 443, and is the reverse-proxy dependency for
most web-facing projects
- **Back up:** `/srv/appdata/npm/data` and `/srv/appdata/npm/letsencrypt` together from one stopped or otherwise
consistent snapshot
- **Re-creatable:** the container image, logs, caches, and transient ACME challenge working files