Nginx Proxy Manager 2.12 failures and the shift toward Caddy autonomy

Nginx Proxy Manager 2.12 failures

The Nginx Proxy Manager 2.12.4 update for TrueNAS SCALE introduces four distinct failures. The Cloudflare plugin fails because the system rewrites /app/global/certbot-dns-plugins.json at startup, which strips the Cloudflare entry. Users must run sudo docker exec -it ix-nginx-proxy-manager-npm-1 sh -c "sed -i 's/cloudflare==4.0.*/cloudflare/' /app/global/certbot-dns-plugins.json" to repair the JSON entry. Nginx also fails to start because running the container with a non-root PUID or PGID, such as 568, prevents the system from writing to /run/nginx/nginx.pid. Setting the User ID and Group ID to 0 in the app configuration fixes this permission issue. The startup script /etc/s6-overlay/s6-rc.d/prepare/30-ownership.sh also loses its content, which removes lines for certbot plugins. Setting the environment variable S6_STAGE2_HOOK to sed -i 2,$d /etc/s6-overlay/s6-rc.d/prepare/30-ownership.sh prevents this wipe. Finally, the container becomes unhealthy because DNS servers like 217.169.20.21 and 217.169.20.20 become unreachable from inside the container. I would skip version 2.12.4 and roll back to 2.11.1 to avoid these specific service interruptions.

Caddy autonomy and the Gateway API

Caddy provides better autonomy for teams through its Admin API and the move toward the Kubernetes Gateway API. The Ingress-NGINX retirement in March 2026 demonstrates the limitations of the old Ingress API. That old API had a flat resource model with no role separation, caused annotation sprawl, and lacked support for modern protocols like native gRPC routing, TCP/UDP load balancing, and advanced TLS configuration. The Gateway API introduces three layers: GatewayClass for infrastructure, Gateway for operators, and Routes for application developers. This structure allows infrastructure teams to provision gateways, platform teams to set policies, and application developers to define routing logic with proper RBAC boundaries. Caddy mimics this separation by allowing administrators to use the @id key to assign unique names to JSON configuration segments. This allows a team to manage their own subdomains through the API at paths like /id/team-1, which expands to /config/apps/http/servers/srv0/routes/0/handle/0. Administrators can configure Caddy with the remote address of the admin server along with the Access Control List for what users of certain public keys are allowed to call what HTTP methods on certain paths of the Caddy admin API. If you manage multiple subdomains, you can assign each team a designated directory of configuration files guarded by file system ACLs. Caddy also uses mTLS to authenticate clients by extracting public keys from TLS certificates in base64-encoded DER format. Configuring identity tells Caddy to obtain a TLS certificate for the admin endpoint, and this identity configuration works with the remote key to allow HTTPS communication with the admin API. For an external FQDN, Caddy obtains certificates from a public CA, while for an internal FQDN, it falls back to Caddy’s own PKI.

Security and SSL implementation

Security flaws and Let’s Encrypt challenges define the state of self-hosted proxy adoption. The Nginx Proxy Manager container contains over 400 vulnerabilities, many of which hold scores above 9.0. The base debian:bookworm-slim image alone contains 76 vulnerabilities from its toolchains. Because the project builds upon docker-nginx-full, the toolchains introduce many additional vulnerabilities into the layered docker files. The image size is also significantly large.

One user attempting to add SSL via Certbot with the manual challenge encountered issues because the site header showed "X-Frame-Options: DENY". The manual command sudo ./certbot-auto certonly --manual --preferred-challenges=http --apache-challenge-location=/etc/apache2/conf.d/ --apache-server-root=/etc/apache2 produced logs showing the ACME process, specifically requesting a new order from https://acme-v02.api.letsencrypt.org/acme/order/47427381/215065384. The request for sldev11.com and www.sldev11.com completed the HTTP-01 challenge, but the certificate did not add to the site. Will the v3 release address these image size concerns effectively? The maintainer plans to move to a Go-based version with Chakra UI in v3.