compose.yaml

name: npmplus
services:
  npmplus:
    container_name: npmplus
    restart: unless-stopped
    image: docker.io/zoeyvid/npmplus:latest # or ghcr.io/zoeyvid/npmplus:latest
    pull_policy: always
    network_mode: host
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
      - SETGID
#      - BPF # required if you set NGINX_QUIC_BPF to true
#      - PERFMON # required if you set NGINX_QUIC_BPF to true
#      - NET_ADMIN # required if you set NGINX_QUIC_BPF to true
#      - SETUID # required if you change PUID/PGID or you enable the inbuilt php-fpm
#      - CHOWN # required if you change PUID/PGID
#      - FOWNER # required if you change PUID/PGID
#      - DAC_OVERRIDE # required if you change PUID/PGID
#      - NET_RAW # required if you need the ping command inside the NPMplus container
    security_opt:
      - no-new-privileges:true
#    dns: # only set this if you need/want to override the default DNS server
#      - 192.168.1.1 # default for unifi/opnsense/pfsense
#      - 192.168.8.1 # default for glinet
#      - 192.168.178.1 # default for avm/fritz
#      - 94.140.14.15 # Public AdGuard DNS
#      - 94.140.15.16 # Public AdGuard DNS
#      - 2a10:50c0::bad1:ff # Public AdGuard DNS
#      - 2a10:50c0::bad2:ff # Public AdGuard DNS
    volumes:
      - "/opt/npmplus:/data"
#      - "/var/www:/var/www" # optional, if you want to use NPMplus directly as a webserver for html/php
#      - "/path/to/old/npm/letsencrypt/folder:/etc/letsencrypt" # Only needed for initial migration from original nginx-proxy-manager to this fork, remove after migration
    environment:
      - "TZ=your-timezone" # set timezone, required, set it to one of the values from the "TZ identifier" https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List
#      - "ACME_EMAIL=your-email" # email address to use for acme, required for zerossl and google public ca
#      - "ACME_SERVER=https://dv.acme-v02.api.pki.goog/directory (google public ca) / https://acme.zerossl.com/v2/DV90 (zerossl)" # acme server used when requesting/renewing certs using certbot, default: https://acme-v02.api.letsencrypt.org/directory (letsencrypt)
#      - "ACME_EAB_KID=123456789abcdef" # Key Identifier for External Account Binding for the acme server, not supported by letsencrypt, optional for zerossl (Login on their site => Developer), but required for google public ca: https://cloud.google.com/certificate-manager/docs/public-ca-tutorial?hl=de#request-key-hmac
#      - "ACME_EAB_HMAC_KEY=123456789abcdef" # HMAC key for External Account Binding for the acme server, not supported by letsencrypt, optional for zerossl (Login on their site => Developer), but required for google public ca: https://cloud.google.com/certificate-manager/docs/public-ca-tutorial?hl=de#request-key-hmac
#      - "ACME_PROFILE=shortlived" # sets the profile to be used from the acme server, when using letsencrypt shortlived is used by default else it defaults to "none" (the default ca profile), supported by letsencrypt (https://letsencrypt.org/docs/profiles) - clients incorrectly requiring a Certificate Common Name in a cert break when using certs from the shortlived/tlsserver profile
#      - "ACME_MUST_STAPLE=true" # enables must-staple, default false (default is true when using zerossl), I recommend enabling this if your CA supports it, supported by zerossl, google public ca ignores this, unsupported by letsencrypt (will fail), overrides ACME_OCSP_STAPLING to true
#      - "ACME_OCSP_STAPLING=true" # enables ocsp stapling, default false (default is true when using google public ca or zerossl), I recommend enabling this if your CA supports it, supported by zerossl and google public ca, this will disable tls certificate compression
#      - "ACME_KEY_TYPE=rsa" # which key type to use ecdsa or rsa, default and recommended: ecdsa
#      - "ACME_KEY_SIZE=2048" # key size for ACME cert, for ecdsa: secp256r1, secp384r1, secp521r1 (default and recommended: secp384r1), for rsa: 2048, 3072, 4096 (default and recommended: 4096)
#      - "ACME_SERVER_TLS_VERIFY=false" # enables checking if ACME_SERVER has a valid TLS cert, default and recommended true
#      - "CUSTOM_OCSP_STAPLING=true" # enables ocsp stapling for custom certs, default false, I recommend enabling this if your custom certs support it, this will disable tls certificate compression
#      - "PUID=1000" # set user id, needs to be a number greater or equal to 99, or equal to 0, default 0 (root), if network mode host is used and PUID changed, you may need to set sysctl net.ipv4.ip_unprivileged_port_start=0 to bind ports like 80 or 443, please note that this will allow all non-root services to bind ports below 1024
#      - "PGID=1000" # set group id, needs to be a number greater or equal to 99, or equal to 0, default 0 (root), requires non-zero PUID
#      - "NPM_PORT=82" # Port the NPM UI should be bound to, default 81, change this if you want to run multiple npm instances in network mode host
#      - "IPV4_BINDING=127.0.0.1" # IPv4 address to bind, defaults to all
#      - "NPM_IPV4_BINDING=127.0.0.1" # IPv4 address to bind for the NPM UI, defaults to all
#      - "IPV6_BINDING=[::1]" # IPv6 address to bind, defaults to all
#      - "NPM_IPV6_BINDING=[::1]" # IPv6 address to bind for the NPM UI, defaults to all
#      - "DISABLE_IPV6=true" # fully disables listening on IPv6 and the IPv6 resolver of nginx, overrides IPV6_BINDING/NPM_IPV6_BINDING, default false
#      - "NPM_LISTEN_LOCALHOST=true" # Binds the NPM UI only to localhost (IPv4+IPv6), overrides NPM_IPV4_BINDING/NPM_IPV6_BINDING, default false
#      - "DEFAULT_CERT_ID=1" # ID of cert to use instead of dummycerts, default 0/unset/dummycerts
#      - "HTTP_PORT=8080" # tcp port to use for http traffic, changing this may break certbot http challenge, default 80
#      - "HTTPS_PORT=8443" # udp and tcp port to use for https traffic, changing this may break certbot http challenge, default 443
#      - "DISABLE_HTTP=true" # prevents nginx from listening on port 80, default false
#      - "LISTEN_PROXY_PROTOCOL=true" # should listeners of http(s) hosts (proxy/redirect/dead and default) use proxy protocol instead of http(s)? default false, overrides DISABLE_H3_QUIC, LISTEN_PROXY_PROTOCOL_HTTP and LISTEN_PROXY_PROTOCOL_HTTPS to true
#      - "LISTEN_PROXY_PROTOCOL_HTTP=true" # should listeners of http hosts (proxy/redirect/dead and default) use proxy protocol instead of http? default false
#      - "LISTEN_PROXY_PROTOCOL_HTTPS=true" # should listeners of https hosts (proxy/redirect/dead and default) use proxy protocol instead of https? default false, overrides DISABLE_H3_QUIC to true
#      - "DISABLE_H3_QUIC=true" # prevents nginx from listening on port 443 udp for default host and all your hosts, this will fully disable HTTP/3 and QUIC, even if you enable it inside the UI, not recommended, default false
#      - "ENABLE_MPTCP=true" # enables multipathtcp, required network_mode host, recommended, default false
#      - "NGINX_QUIC_BPF=true" # enables nginx's quic_bpf (https://nginx.org/en/docs/http/ngx_http_v3_module.html#quic_bpf), you must also add caps to the NPMplus container (see cap_add of this compose file) to use this, recommended, default false
#      - "NGINX_LOG_NOT_FOUND=true" # Log 404 errors to the docker logs, unrelated to access logs, default false
#      - "NGINX_WORKER_PROCESSES=8" # value of worker_processes, default and recommended: auto
#      - "NGINX_WORKER_CONNECTIONS=1024" # value of worker_connections, default: 512
#      - "NGINX_FORCE_X25519MLKEM768=true" # forces usage of X25519MLKEM768 by disabling everything else (including TLS1.2), default false (overrides NGINX_DISABLE_TLS12 to true and NGINX_TRUST_SECPR1 to false), please note that browsers most browsers support it, but other application may not support this
#      - "NGINX_DISABLE_TLS12=true" # disabled TLS1.2, default false, TLS1.2 can still be assumed to be secure with the settings NPMplus uses, but if you know all your clients support TLS1.3 this allows you to disable it
#      - "NGINX_TRUST_SECPR1=false" # enables secp521r1:secp384r1:secp256r1 ecdh curves, default true, disable if all your clients support X25519MLKEM768 or x25519
#      - "NGINX_TRUST_RSA_PKCS1=true" # enables rsa_pkcs1_sha512:rsa_pkcs1_sha384:rsa_pkcs1_sha256 sigalgs, default false, enable if your use a RSA key and your client doesn't support RSA-PSS sigalgs
#      - "DISABLE_NGINX_BEAUTIFIER=true" # disables nginxbeautifier, useful when it fails parsing non-standard custom/advanced configs, default false
#      - "LOGROTATE=true" # Enables writing http access logs to /opt/npmplus/nginx/logs/access.log, stream access logs to /opt/npmplus/nginx/logs/stream.log and enables daily logrotation, default false
#      - "LOGROTATIONS=7" # Set how often the access.log should be rotated until it is deleted, default 3
#      - "TRUST_IP=10.0.0.0/8 192.168.1.5" # Space separated list of reverse proxy IPs/subnets to trust for the X-Forwarded-For header, so nginx will see the real client IPs, default empty
#      - "TRUST_CLOUDFLARE=true" # Enables fetching/whitelisting IPs from cloudflare, so nginx will see the real client IPs, default false
#      - "CERTBOT_RUN_INTERVAL=72" # Set how many hours should be between certbot trying to renew your certs if needed, default 3
#      - "ECH_ROTATION_INTERVAL=3" # Set how many hours should be between the runs of your ech cron script, default 1
#      - "GOA=true" # Enables goaccess (and overrides LOGROTATE to true), served under /goaccess of the NPMplus web UI, only reachable for logged in admins, default false --- if you download the GeoLite2-Country.mmdb, GeoLite2-City.mmdb AND GeoLite2-ASN.mmdb file from MaxMind and place them in /opt/npmplus/goaccess/geoip it will automatically enable GeoIP in goaccess after restarting NPMplus (no need to change GOACLA below), you may also enable the geoipupdate container below (please change the timezone)
#      - "GOACLA=--agent-list --real-os --double-decode --anonymize-ip --anonymize-level=2 --keep-last=7 --with-output-resolver --no-query-string" # Arguments that should be passed to goaccess, default: --agent-list --real-os --double-decode --anonymize-ip --anonymize-level=1 --keep-last=30 --with-output-resolver --no-query-string
#      - "PHP83=true" # Activate PHP83, default false, supported, but not recommended, you should prefer to use a dedicated php-fpm container
#      - "PHP83_APKS=php83-curl php83-openssl" # Add php extensions, also enables PHP83, see available packages here: https://pkgs.alpinelinux.org/packages?branch=v3.21&repo=community&arch=x86_64&name=php83-*, default none, requires PHP83
#      - "PHP84=true" # Activate PHP84, default false, supported, but not recommended, you should prefer to use a dedicated php-fpm container
#      - "PHP84_APKS=php84-curl php84-openssl" # Add php extensions, also enables PHP84, see available packages here: https://pkgs.alpinelinux.org/packages?branch=v3.21&repo=community&arch=x86_64&name=php84-*, default none, requires PHP84
#      - "PHP85=true" # Activate PHP85, default false, supported, but not recommended, you should prefer to use a dedicated php-fpm container
#      - "PHP85_APKS=php85-curl php85-openssl" # Add php extensions, also enables PHP85, see available packages here: https://pkgs.alpinelinux.org/packages?branch=v3.21&repo=community&arch=x86_64&name=php85-*, default none, requires PHP85
#      - "PHP_APKS=php-pecl-apcu php-pecl-redis" # Add php extensions, see available packages here: https://pkgs.alpinelinux.org/packages?branch=v3.21&repo=community&arch=x86_64&name=php-*, default none, requires PHP83, PHP84 and/or PHP85, not recommended, please use PHP83_APKS, PHP84_APKS or PHP85_APKS
#      - "INITIAL_ADMIN_EMAIL=<initial@email.tld>" # email to use instead of admin@example.org on first start of NPMplus for the initial user
#      - "INITIAL_ADMIN_PASSWORD=<initial-password>" # password to use instead of a random password which is logged on first start of NPMplus for the initial user
#      - "INITIAL_DEFAULT_PAGE=444" # default page to set on first start of NPMplus for the initial user, default congratulations, can be one of: 404, 444, redirect, congratulations or html
#      - "DISABLE_GRAVATAR=true" # disables usage of gravatar images, users need to update theier profile for this to apply, default false
#      - "COOKIE_SECRET=some-random-string" # by default a new secret to encrypt/decrypt cookies is used after each restart, to keep cookies valid after restarts you can set a static secret here
#      - "ENABLE_PRERUN=true" # see readme, default off
#      - "NGINX_LOAD_NJS_MODULE=true" # loads the njs module, requires manual configuration, default false
#      - "NGINX_LOAD_GEOIP2_MODULE=true" # loads the geoip2 module, requires manual configuration, default false
#      - "NGINX_LOAD_LDAP_MODULE=true" # loads the ldap module, requires manual configuration, default false
#      - "NGINX_LOAD_NTLM_MODULE=true" # loads the ntlm module, requires manual configuration, default false
#      - "NGINX_LOAD_VHOST_TRAFFIC_STATUS_MODULE=true" # loads the virtual host traffic status module, requires manual configuration, default false
#      - "OIDC_REDIRECT_DOMAIN=<domain-ip>[:<port>]" # redirect domain/ip (+ port) for oidc, without scheme and without path, redirect url will be https://$OIDC_REDIRECT_DOMAIN/api/oidc/callback
#      - "OIDC_ISSUER_URL=https://..." # issuer url for oidc
#      - "NODE_TLS_REJECT_UNAUTHORIZED=0" # if your issuer uses a self signed cert you may need to set this, but please note that this will disable cert verification for all requests done by the backend (not nginx), like to github for version checks, gravatar, reachability checks or cloudflare for IP updates
#      - "OIDC_CLIENT_ID=..." # client id for oidc
#      - "OIDC_CLIENT_SECRET=..." # client secret for oidc
#      - "OIDC_REQUIRE_VERIFIED_EMAIL=false" # requires the email sent by the OIDC Provider to be marked as verified, default true
#      - "OIDC_DISABLE_PASSWORD=true" # disables plain email/password login, default false
#      - "OIDC_SKIP_MFA=true" # skips the second factor after a successful OIDC login, default false
#      - "AUTH_REQUEST_ANUBIS_UPSTREAM=http://127.0.0.1:8923" # scheme + ip/hostname/domain (+ port) to internal anubis, without path, this is unrelated to OIDC
#      - "AUTH_REQUEST_TINYAUTH_UPSTREAM=http://127.0.0.1:3000" # scheme + ip/hostname/domain (+ port) to internal tinyauth, without path, this is unrelated to OIDC
#      - "AUTH_REQUEST_OAUTH2PROXY_UPSTREAM=http://127.0.0.1:4180" # scheme + ip/hostname/domain (+ port) to internal oauth2proxy, without path, this is unrelated to OIDC
#      - "AUTH_REQUEST_VOIDAUTH_UPSTREAM=http://127.0.0.1:3000" # scheme + ip/hostname/domain (+ port) to internal oauth2proxy, without path, this is unrelated to OIDC
#      - "AUTH_REQUEST_AUTHELIA_UPSTREAM=http://127.0.0.1:9091" # scheme + ip/hostname/domain (+ port) to internal authelia, without path, this is unrelated to OIDC
#      - "AUTH_REQUEST_AUTHENTIK_UPSTREAM=https://127.0.0.1:9443" # scheme + ip/hostname/domain (+ port) to internal authentik, without path, currently only works with embedded outpost, this is unrelated to OIDC

# This can be used to enable crowdsec, see README for a guide
#  crowdsec:
#    container_name: crowdsec
#    restart: unless-stopped
#    image: docker.io/crowdsecurity/crowdsec:latest
#    pull_policy: always
#    network_mode: bridge
#    ports:
#      - "127.0.0.1:7422:7422"
#      - "127.0.0.1:8080:8080"
#    environment:
#      - "TZ=your-timezone" # needs to be changed
#      - "USE_WAL=true"
#      - "COLLECTIONS=ZoeyVid/npmplus"
#    volumes:
#      - "/opt/crowdsec/conf:/etc/crowdsec"
#      - "/opt/crowdsec/data:/var/lib/crowdsec/data"
#      - "/opt/npmplus/nginx/logs:/opt/npmplus/nginx/logs:ro"

# See the readme on how to configure your proxy hosts to use anubis and what needs to be changes in the botPolicy to make it work
#  anubis:
#    container_name: npmplus-anubis
#    restart: unless-stopped
#    image: ghcr.io/techarohq/anubis:latest
#    pull_policy: always
#    network_mode: bridge
#    ports:
#      - "127.0.0.1:8923:8923"
#    environment:
#      - "TZ=your-timezone" # needs to be changed
#      - "TARGET= " # important: this needs to be and stay one single space
#      - "POLICY_FNAME=/etc/botPolicies.yaml" # required so the status codes can be changed
#    volumes:
#      - "/opt/anubis.yaml:/etc/botPolicies.yaml:ro" # since a file is mounted here, you first need to create it before deploying this container, you can download the default file from here: https://raw.githubusercontent.com/TecharoHQ/anubis/refs/heads/main/data/botPolicies.yaml

# This can be used with GOA=true to keep the geoip database updated, environment variables must be configured
#  geoipupdate:
#    container_name: npmplus-geoipupdate
#    restart: unless-stopped
#    image: ghcr.io/maxmind/geoipupdate:latest
#    pull_policy: always
#    network_mode: bridge
#    environment:
#      - "TZ=your-timezone" # needs to be changed
#      - "GEOIPUPDATE_EDITION_IDS=GeoLite2-Country GeoLite2-City GeoLite2-ASN"
#      - "GEOIPUPDATE_ACCOUNT_ID=<your-account-id>" # needs to be changed
#      - "GEOIPUPDATE_LICENSE_KEY=<your-license-key>" # needs to be changed
#      - "GEOIPUPDATE_FREQUENCY=24"
#    volumes:
#      - "/opt/npmplus/goaccess/geoip:/usr/share/GeoIP"

# This can be used with DISABLE_HTTP=true, to force HTTPS redirects for every host
#  npmplus-caddy:
#    container_name: npmplus-caddy
#    restart: unless-stopped
#    image: docker.io/zoeyvid/npmplus:caddy
#    pull_policy: always
#    network_mode: bridge
#    ports:
#      - "80:80"
#    environment:
#      - "TZ=your-timezone"