[GH-ISSUE #668] Need help with proxying cockpit

kerem commented

2026-02-26 06:33:24 +03:00

Owner

Originally created by @bayeslearnerold on GitHub (Oct 20, 2020).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/668

Checklist

Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
Are you sure you're not using someone else's docker image?
If having problems with Lets Encrypt, have you made absolutely sure your site is accessible from outside of your network?

Describe the bug

A clear and concise description of what the bug is.
This is not a bug but request for guidance with proxying cockpit.
I'm able to proxy many services but not cockpit.

I tried to follow this guide here without success:
https://github.com/cockpit-project/cockpit/wiki/Proxying-Cockpit-over-NGINX

The result is either SSL or login loop or upon login, an error from cockpit

What exactly do I need to do when I use cockpit with nginx-proxy-manager.

What version of Nginx Proxy Manager is reported on the login page?

To Reproduce
Steps to reproduce the behavior:

Go to '...'
Click on '....'
Scroll down to '....'
See error

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Operating System

Please specify if using a Rpi, Mac, orchestration tool or any other setups that might affect the reproduction of this error.

Additional context
Add any other context about the problem here, docker version, browser version if applicable to the problem. Too much info is better than too little.

Originally created by @bayeslearnerold on GitHub (Oct 20, 2020). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/668 **Checklist** - Have you pulled and found the error with `jc21/nginx-proxy-manager:latest` docker image? - Are you sure you're not using someone else's docker image? - If having problems with Lets Encrypt, have you made absolutely sure your site is accessible from outside of your network? **Describe the bug** - A clear and concise description of what the bug is. This is not a bug but request for guidance with proxying cockpit. I'm able to proxy many services but not cockpit. I tried to follow this guide here without success: https://github.com/cockpit-project/cockpit/wiki/Proxying-Cockpit-over-NGINX The result is either SSL or login loop or upon login, an error from cockpit What exactly do I need to do when I use cockpit with nginx-proxy-manager. - What version of Nginx Proxy Manager is reported on the login page? **To Reproduce** Steps to reproduce the behavior: 1. Go to '...' 2. Click on '....' 3. Scroll down to '....' 4. See error **Expected behavior** A clear and concise description of what you expected to happen. **Screenshots** If applicable, add screenshots to help explain your problem. **Operating System** - Please specify if using a Rpi, Mac, orchestration tool or any other setups that might affect the reproduction of this error. **Additional context** Add any other context about the problem here, docker version, browser version if applicable to the problem. Too much info is better than too little.

kerem

2026-02-26 06:33:24 +03:00

closed this issue
added the
product-support
label

kerem commented

2026-02-26 06:33:25 +03:00

Author

Owner

@jc21 commented on GitHub (Oct 20, 2020):

Cockpit works easily for me. Just make sure that the protocol is https. Here's my config:

I also have NPM generate a certificate for this host.

@jc21 commented on GitHub (Oct 20, 2020): Cockpit works easily for me. Just make sure that the protocol is https. Here's my config: ![Screen Shot 2020-10-20 at 4 23 05 pm](https://user-images.githubusercontent.com/1518257/96548050-89e6fe00-12f0-11eb-9582-4b42c841fec4.png) I also have NPM generate a certificate for this host.

kerem commented

2026-02-26 06:33:25 +03:00

Author

Owner

@bayeslearnerold commented on GitHub (Oct 20, 2020):

I had similar settings, did you make any changes to cockpit conf?
The first symptom is that
With the settings (https xxx.xxx.xxx 9090) I can't login to cockpit. It redirects back to the home page.

Now after tweaking cockpit conf according to their documentation, I can't even get the home page to load.

@bayeslearnerold commented on GitHub (Oct 20, 2020): I had similar settings, did you make any changes to cockpit conf? The first symptom is that With the settings (https xxx.xxx.xxx 9090) I can't login to cockpit. It redirects back to the home page. Now after tweaking cockpit conf according to their documentation, I can't even get the home page to load.

kerem commented

2026-02-26 06:33:25 +03:00

Author

Owner

@jc21 commented on GitHub (Oct 20, 2020):

No I'm running cockpit on Centos8 stock standard install.

@jc21 commented on GitHub (Oct 20, 2020): No I'm running cockpit on Centos8 stock standard install.

kerem commented

2026-02-26 06:33:25 +03:00

Author

Owner

@techpet commented on GitHub (Mar 11, 2021):

No I'm running cockpit on Centos8 stock standard install.

It is working for me running cockpit in a docker container with the exception of the thumbnails of the uploaded images that are not shown in the dashboard (check image below - the full image is normally shown nevertheless in fullsize).

Also, I can't find how to make proxy manager work with the solution provided here. When adding a new location and adding the below info:

I get a rewrite or internal redirection cycle while internally redirecting to "/index.php" error on my proxy manager logs

@techpet commented on GitHub (Mar 11, 2021): > No I'm running cockpit on Centos8 stock standard install. It is working for me running cockpit in a docker container with the exception of the thumbnails of the uploaded images that are not shown in the dashboard (check image below - the full image is normally shown nevertheless in fullsize). ![image](https://user-images.githubusercontent.com/1122529/110729581-a5af5a00-8227-11eb-9210-8badac2cbfd2.png) Also, I can't find how to make proxy manager work with the solution provided [here](https://discourse.getcockpit.com/t/preview-of-images-not-working-for-png-and-jpg-when-using-nginx/1509/2). When adding a new location and adding the below info: ![image](https://user-images.githubusercontent.com/1122529/110729331-30438980-8227-11eb-86b4-b5fe3dc34f1e.png) I get a `rewrite or internal redirection cycle while internally redirecting to "/index.php"` error on my proxy manager logs

kerem commented

2026-02-26 06:33:25 +03:00

Author

Owner

@techpet commented on GitHub (Mar 11, 2021):

Nothing to do with nginx proxy manager in my case, it was a cockpit configuration issue. You need to set site_url parameter in cockpit config file.

@techpet commented on GitHub (Mar 11, 2021): Nothing to do with nginx proxy manager in my case, it was a cockpit configuration issue. You need to set site_url parameter in cockpit config file.

kerem commented

2026-02-26 06:33:25 +03:00

Author

Owner

@Toomoch commented on GitHub (Jul 1, 2023):

Nothing to do with nginx proxy manager in my case, it was a cockpit configuration issue. You need to set site_url parameter in cockpit config file.

I have the same problem, cockpit redirects to the home page, what did you do exactly? There is no site_url parameter

@Toomoch commented on GitHub (Jul 1, 2023): > Nothing to do with nginx proxy manager in my case, it was a cockpit configuration issue. You need to set site_url parameter in cockpit config file. I have the same problem, cockpit redirects to the home page, what did you do exactly? There is no site_url parameter

kerem commented

2026-02-26 06:33:25 +03:00

Author

Owner

@march5350 commented on GitHub (Jul 20, 2024):

I also have the same problem when trying to setup Cockpit via Nginx Proxy Manager. Dit anyone of you ever found a solution?

@march5350 commented on GitHub (Jul 20, 2024): I also have the same problem when trying to setup Cockpit via Nginx Proxy Manager. Dit anyone of you ever found a solution?

kerem commented

2026-02-26 06:33:25 +03:00

Author

Owner

@LKStu commented on GitHub (Jul 26, 2024):

I have the same problem (redirect after login). What is the solution?

@LKStu commented on GitHub (Jul 26, 2024): I have the same problem (redirect after login). What is the solution?

kerem commented

2026-02-26 06:33:25 +03:00

Author

Owner

@ElderBlade commented on GitHub (Oct 17, 2024):

I'm also having the same issue. I'm following the guide here: https://cockpit-project.org/external/wiki/Proxying-Cockpit-over-NGINX

After editing /etc/cockpit/cockpit.conf, cockpit login no longer works. I get a login error and the log shows TLS handshake error.

When I try to configure a proxy host in nginx proxy manager it shows as offline which seems to be caused by the cockpit.conf file. I'm not sure if I'm entering the custom location info correctly either. Can someone provide a screenshot of what that should look like?

@ElderBlade commented on GitHub (Oct 17, 2024): I'm also having the same issue. I'm following the guide here: https://cockpit-project.org/external/wiki/Proxying-Cockpit-over-NGINX After editing `/etc/cockpit/cockpit.conf`, cockpit login no longer works. I get a login error and the log shows TLS handshake error. When I try to configure a proxy host in nginx proxy manager it shows as offline which seems to be caused by the cockpit.conf file. I'm not sure if I'm entering the custom location info correctly either. Can someone provide a screenshot of what that should look like?

kerem commented

2026-02-26 06:33:25 +03:00

Author

Owner

@march5350 commented on GitHub (Oct 19, 2024):

@mmoore7

In the end I was able to solve it by editing the /etc/cockpit/cockpit.conf file like this:

[WebService]
AllowUnencrypted = true
Origins = http://cockpit.lan ws://cockpit.lan
ProtocolHeader = X-Forwarded-Proto

I also turned on websocket support in Nginx Proxy Manager.

After changing these settings it works for me in my local network.

@march5350 commented on GitHub (Oct 19, 2024): @mmoore7 In the end I was able to solve it by editing the /etc/cockpit/cockpit.conf file like this: [WebService] AllowUnencrypted = true Origins = http://cockpit.lan ws://cockpit.lan ProtocolHeader = X-Forwarded-Proto I also turned on websocket support in Nginx Proxy Manager. After changing these settings it works for me in my local network.

kerem commented

2026-02-26 06:33:25 +03:00

Author

Owner

@ElderBlade commented on GitHub (Oct 19, 2024):

@NAmRoD21v thanks for your reply. Unfortunately I still get the 502 bad gateway error.

I'm on Fedora Server 40.

@ElderBlade commented on GitHub (Oct 19, 2024): @NAmRoD21v thanks for your reply. Unfortunately I still get the 502 bad gateway error. I'm on Fedora Server 40.

kerem commented

2026-02-26 06:33:25 +03:00

Author

Owner

@march5350 commented on GitHub (Oct 20, 2024):

@mmoore7 How did you setup your DNS server and Nginx Proxy Manager?

@march5350 commented on GitHub (Oct 20, 2024): @mmoore7 How did you setup your DNS server and Nginx Proxy Manager?

kerem commented

2026-02-26 06:33:25 +03:00

Author

Owner

@ElderBlade commented on GitHub (Oct 20, 2024):

@NAmRoD21v

I'm using adguard as my local DNS server for Nginx Proxy manager. I have a rewrite entry in adguard for *.mydomain.com which resolves to my host machine's IP address where my services are available to the network. Here's my docker-compose.yml. I'm using podman-compose version 1.2.0, podman version 5.2.3.

version: '3'
services:
  adguard:
    image: adguard/adguardhome:latest
    container_name: adguard
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "880:80/tcp"
      - "4443:443/tcp"
      - "4443:443/udp"
      - "3000:3000/tcp"
    volumes:
      - adguard_work:/opt/adguardhome/work
      - adguard_conf:/opt/adguardhome/conf
    networks:
      - proxy_net
    restart: unless-stopped

  nginx_proxy_manager:
    image: 'jc21/nginx-proxy-manager:latest'
    container_name: npm
    ports:
      - '80:80'
      - '81:81'
      - '443:443'
    volumes:
      - nginx:/data
      - letsencrypt:/etc/letsencrypt
    networks:
      - proxy_net
      - app_net
      - home_net
    restart: unless-stopped

networks:
  proxy_net:
    name: proxy_net
    external: true
  app_net:
    name: app_net
    external: true
  home_net:
    name: home_net

volumes:
  adguard_work:
  adguard_conf:
  nginx:
  letsencrypt:

I couldn't figure out how to ensure nginx proxy manage points to my adguard dns server from docker-compose file, so I have a script that write's adguard's IP address into nginx proxy manager /etc/resolv.conf file.

#!/bin/sh

# Start the containers
/usr/bin/podman-compose up -d

# Wait for the containers to be fully up and running
sleep 15

# Get the IP address of the AdGuard container
ADGUARD_IP=$(podman inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' adguard)

# Update /etc/resolv.conf in the nginx_proxy_manager container
podman exec npm sh -c "echo 'nameserver $ADGUARD_IP' > /etc/resolv.conf"

@ElderBlade commented on GitHub (Oct 20, 2024): @NAmRoD21v I'm using adguard as my local DNS server for Nginx Proxy manager. I have a rewrite entry in adguard for `*.mydomain.com` which resolves to my host machine's IP address where my services are available to the network. Here's my docker-compose.yml. I'm using podman-compose version 1.2.0, podman version 5.2.3. ``` version: '3' services: adguard: image: adguard/adguardhome:latest container_name: adguard ports: - "53:53/tcp" - "53:53/udp" - "880:80/tcp" - "4443:443/tcp" - "4443:443/udp" - "3000:3000/tcp" volumes: - adguard_work:/opt/adguardhome/work - adguard_conf:/opt/adguardhome/conf networks: - proxy_net restart: unless-stopped nginx_proxy_manager: image: 'jc21/nginx-proxy-manager:latest' container_name: npm ports: - '80:80' - '81:81' - '443:443' volumes: - nginx:/data - letsencrypt:/etc/letsencrypt networks: - proxy_net - app_net - home_net restart: unless-stopped networks: proxy_net: name: proxy_net external: true app_net: name: app_net external: true home_net: name: home_net volumes: adguard_work: adguard_conf: nginx: letsencrypt: ``` I couldn't figure out how to ensure nginx proxy manage points to my adguard dns server from docker-compose file, so I have a script that write's adguard's IP address into nginx proxy manager `/etc/resolv.conf` file. ``` #!/bin/sh # Start the containers /usr/bin/podman-compose up -d # Wait for the containers to be fully up and running sleep 15 # Get the IP address of the AdGuard container ADGUARD_IP=$(podman inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' adguard) # Update /etc/resolv.conf in the nginx_proxy_manager container podman exec npm sh -c "echo 'nameserver $ADGUARD_IP' > /etc/resolv.conf" ```

kerem commented

2026-02-26 06:33:25 +03:00

Author

Owner

@march5350 commented on GitHub (Oct 23, 2024):

Since I don't use AdGuard, but instead use Pi-hole, I can't say for sure that I can help you. In my Pi-hole compose file I also have the following configured:

cap_add:
  - NET_ADMIN

Don't know if that is something that will help you. With Pi-hole and NPM I don't need an external script for writing IP addresses to NPM.

@march5350 commented on GitHub (Oct 23, 2024): Since I don't use AdGuard, but instead use Pi-hole, I can't say for sure that I can help you. In my Pi-hole compose file I also have the following configured: cap_add: - NET_ADMIN Don't know if that is something that will help you. With Pi-hole and NPM I don't need an external script for writing IP addresses to NPM.

kerem commented

2026-02-26 06:33:25 +03:00

Author

Owner

@ElderBlade commented on GitHub (Oct 23, 2024):

Writing the IP address is not so much related to adguard as it is to how networking works in podman and my own inexperience. I figured out how to specify IP address for my adguard container and then use the -dns variable to define that IP as the dns for nginx-proxy-manager so editing the /etc/resolv.conf file is no longer necessary.

I suspect my issue is related to SELinux because it's a security module that comes packaged with Fedora Server 40 and it's briefly mentioned in the guide above:

502 Bad Gateway & SELinux

If SELinux is enabled, change boolean setting (solves 502 gateway error):

setsebool -P httpd_can_network_connect on

When I change this setting to on, I still get the 502 gateway error. Beyond that, I'm not sure how else to troubleshoot this.

In any case, I have opened a separate issue here: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/4079

@ElderBlade commented on GitHub (Oct 23, 2024): Writing the IP address is not so much related to adguard as it is to how networking works in podman and my own inexperience. I figured out how to specify IP address for my adguard container and then use the -dns variable to define that IP as the dns for nginx-proxy-manager so editing the `/etc/resolv.conf` file is no longer necessary. I suspect my issue is related to SELinux because it's a security module that comes packaged with Fedora Server 40 and it's briefly mentioned in the guide above: ``` 502 Bad Gateway & SELinux If SELinux is enabled, change boolean setting (solves 502 gateway error): setsebool -P httpd_can_network_connect on ``` When I change this setting to on, I still get the 502 gateway error. Beyond that, I'm not sure how else to troubleshoot this. In any case, I have opened a separate issue here: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/4079

kerem commented

2026-02-26 06:33:25 +03:00

Author

Owner

@camemb3rt commented on GitHub (Mar 26, 2025):

I'm also having the same issue. I'm following the guide here: https://cockpit-project.org/external/wiki/Proxying-Cockpit-over-NGINX

After editing /etc/cockpit/cockpit.conf, cockpit login no longer works. I get a login error and the log shows TLS handshake error.

When I try to configure a proxy host in nginx proxy manager it shows as offline which seems to be caused by the cockpit.conf file. I'm not sure if I'm entering the custom location info correctly either. Can someone provide a screenshot of what that should look like?

I also changed scheme to HTTPS and enabled Websocket Support on the Details tab.
Important to mention that the .conf file only has those three lines from their example config
The location information from the "Using an external proxy" section would be used on NGINX (proper) or set up like the picture in NGINX-Proxy-Manager.

@camemb3rt commented on GitHub (Mar 26, 2025): > I'm also having the same issue. I'm following the guide here: https://cockpit-project.org/external/wiki/Proxying-Cockpit-over-NGINX > > After editing `/etc/cockpit/cockpit.conf`, cockpit login no longer works. I get a login error and the log shows TLS handshake error. > > When I try to configure a proxy host in nginx proxy manager it shows as offline which seems to be caused by the cockpit.conf file. I'm not sure if I'm entering the custom location info correctly either. Can someone provide a screenshot of what that should look like? ![Image](https://github.com/user-attachments/assets/00513538-0212-43a6-b5ed-936ba971e2e0) I also changed scheme to HTTPS and enabled Websocket Support on the Details tab. Important to mention that the .conf file only has those three lines from their example [config](https://garrett.github.io/cockpit-project.github.io/external/wiki/Proxying-Cockpit-over-NGINX) The location information from the "Using an external proxy" section would be used on NGINX (proper) or set up like the picture in NGINX-Proxy-Manager.

kerem commented

2026-02-26 06:33:25 +03:00

Author

Owner

@ElderBlade commented on GitHub (Mar 27, 2025):

It finally dawned on me that my NPM container is runnning on an isolated network, and cockpit is running on the host, which leads to a 502 bad gateway error. Setting the proxy host in NPM to host.containers.internal allows NPM to reach the service on the host.

This works on my system (Fedora 41) without having to edit/configure /etc/cockpit/cockpit.conf

@ElderBlade commented on GitHub (Mar 27, 2025): It finally dawned on me that my NPM container is runnning on an isolated network, and cockpit is running on the host, which leads to a 502 bad gateway error. Setting the proxy host in NPM to `host.containers.internal` allows NPM to reach the service on the host. ![Image](https://github.com/user-attachments/assets/78ac3ada-7e03-43ad-a143-a320aeda517f) This works on my system (Fedora 41) without having to edit/configure `/etc/cockpit/cockpit.conf`

kerem commented

2026-02-26 06:33:25 +03:00

Author

Owner

@wk1093 commented on GitHub (Mar 30, 2025):

I was having a similar issue and I fixed it by enabling "Websockets Support" on Nginx Proxy Manager.

@wk1093 commented on GitHub (Mar 30, 2025): I was having a similar issue and I fixed it by enabling "Websockets Support" on Nginx Proxy Manager.

Rows
Columns

[GH-ISSUE #668] Need help with proxying cockpit #562