Nginx Proxy Manager behaving funny

TrueNAS General
1

Hey all,

I have been running TrueNas for almost a year and having fun with self-hosting various services. One thing that always puzzled me are SSL certificates.

Currently I am running Nginx Proxy Manager on Truenas v25.04.2.6 (IP 192.168.1.78, ports 81/443) which runs few apps I like to access outside of my network: Actual, Immich, Invoice Ninja and Vaultgarden. All of them are accessible via Tailscale when I am not on the local network. I am not port forwarding anything. All apps runs normally via HTTP with the “not secure” label in the browser.

Here is where the NPM behaves funny.

Hosts created for Actual (actual.mydomain.duckdns.org) and Vaultgarden (vault.mydomain.duckdns.org) works fine with SSL certificate encrypted by Let’s Encrypt via DuckDNS locally and through external network via Tailscale. The other two - Immich and Invoice Ninja - are returning 502 bad gateway error. This is the log:

[11/Oct/2026:04:50:45 -0700] - 502 502 - GET https immich.mydomain.duckdns.org "/" [Client 192.168.1.69] [Length 154] [Gzip -] [Sent-to 192.168.1.78] "Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0" "http://192.168.1.78:30020/"

The only difference between the working and nonworking apps are the port numbers.

SSL certificate has wildcard generated as well for the domain. NPM is running on 30020 port.

I am stuck on this for two days, I do believe I made a mistake somewhere. Can you point me to a solution, or steps I should check to resolve this? Thank you.

Pavol

2

On system trying to connect to Immich;

openssl s_client -connect (TrueNASIP:ImmichPort)

Does it also return 502 or a ‘connection refused’? If so then you indeed have some sort of network config problem instead of ssl issue.

…If that is the case, I’m not sure if you send us over a network map & all config details or a tcp dump :stuck_out_tongue: Both I guess. Sounds like a bitch to sanitize before sharing online.

edit: a thought - I’m wondering if the working apps have an option to ‘bind to host network’ while the non-working ones don’t & if this matters in any way? Honestly thinking more about it I’m half certain that this is relevant & there is some docker tomfoolery to get forwarded on the proxy. I don’t have too much experience to add more on the matter.

3

All working and non-working apps have the same option, they are not running in a separate network, nor with the option ‘bind to host network’.

If I connect to Actual or Vaultgarden (the working apps), I can see the certificate, when I connect to Immich, this is the result

truenas_immich
truenas_immich1359×478 30.5 KB

To make it even more mysterious, even with NPM fully stopped, I can still access the Actual with a valid certificate.

4

Found a solution.

Changing the ‘Scheme’ in NPM from ‘https’ to ‘https’ did the work. All non-working apss are now working with ‘Force https’ option on the SSL tab.

For apps previously working correctly, the ‘Scheme’ must be set to ‘https’.

5

Happy to hear it’s now working for you but here’s the obligatory:

b3n8e1
b3n8e1500×559 65.7 KB