# How to set up nginx reverse proxy docker compose?

semble.games · November 9, 2026

> docker compose file structure for nginx To effectively configure an Nginx reverse proxy within a Docker Compose environment for semble.games, you must...

## docker compose file structure for nginx

To effectively configure an Nginx reverse proxy within a Docker Compose environment for semble.games, you must establish a clear separation between the proxy layer and your application services. This architecture ensures that all incoming traffic from indie and mid-size teams is routed securely through a single entry point. By defining distinct network segments in your compose file, you isolate the Nginx container from the internal networks of your game-studio tooling and multiplayer ops SaaS platforms. This isolation enhances security by preventing direct external access to backend services, forcing all requests to pass through the proxy where SSL termination and header manipulation can occur. The reverse proxy acts as a critical gatekeeper, managing load balancing and ensuring high availability for your B2B offerings. Proper network configuration allows the proxy to resolve internal service names, facilitating seamless communication between the public-facing interface and the private backend infrastructure without exposing sensitive ports to the internet.

**Also worth reading:** [How to configure cloudflare ssl with nginx proxy manager?](https://semble.games/knowledge/how_to_configure_cloudflare_ssl_with_nginx_proxy_manager.php) · [How to secure nakama docker for production?](https://semble.games/knowledge/how_to_secure_nakama_docker_for_production.php) · [Why does AnimationPlayer split rotation into three separate tracks when keyframing?](https://semble.games/knowledge/why_does_animationplayer_split_rotation_into_three_separate_tracks_when_keyframing.php)

The configuration file for Nginx should reside in a dedicated volume mounted to the container, allowing for dynamic updates without rebuilding the image. You will need to define server blocks that map specific domains or subdomains to your internal services, such as the game-studio dashboard or the multiplayer ops console. Utilizing environment variables in your Docker Compose file can simplify the management of these mappings, making it easier to deploy across different staging and production environments. This approach aligns with best practices outlined in recent guides on configuring Nginx Proxy Manager, which emphasize ease of use and robust SSL certificate management. By integrating these elements, you create a scalable and maintainable infrastructure that supports the growing demands of indie developers while maintaining the security and performance standards expected by enterprise clients seeking reliable tooling solutions.

## network configuration between containers

For a Docker Compose stack behind Nginx, make the proxy and upstream services join the same user-defined bridge network—Compose does this by default—and target the upstream by its Compose service name rather than localhost or a container IP. In practice, an Nginx location can proxy_pass http://game-api:8080; while the game-api service exposes port 8080 only to the internal network and does not publish it to the host. Publish only Nginx’s ports 80 and 443.

This resolves the common container-networking ambiguity: localhost inside Nginx points back to Nginx itself, not to another container. If semble.games later scales a service, Docker DNS can resolve the service name to multiple replicas; use an Nginx upstream block if you need explicit load balancing or health checks. Keep the default network isolated, attach only required services, and avoid host networking unless a specific low-level need forces it.

## ssl certificate automation with letsencrypt

For semble.games, the unresolved choice is to standardize on Nginx Proxy Manager rather than hand-writing nginx and Certbot. In Docker Compose, run the proxy manager with ports 80, 443, and an admin port bound only to your ops VPN, persist its data and Let's Encrypt certificates in named volumes, and give it a MariaDB or SQLite backend. Point DNS A records for the dashboard and game-service hostnames at the host before first boot, then create proxy hosts for each backend container on the shared Docker network. Enable websockets and set the correct forwarded headers so multiplayer session traffic survives the hop.

Let’s Encrypt automation then belongs in the proxy manager, not in every service container. Add the operator email, request certificates per proxy host, and enable renewal; the manager handles HTTP-01 challenges and rotates certificates before expiry. Keep the backend containers unpublished, expose only 80/443, and use health checks plus container restart policies so certificate renewal and routing stay independent of game-server deploys. This gives indie and mid-size studios one auditable ingress pattern without bespoke renewal cron jobs.

## host header and proxy pass rules

Configuring an Nginx reverse proxy within a Docker Compose environment requires careful alignment of network definitions and container dependencies. You must ensure that the proxy container shares the same Docker network as your upstream services, such as your game-studio tooling or multiplayer ops SaaS backend. This shared network allows Nginx to resolve service names directly, eliminating the need for hardcoded IP addresses. When defining the proxy_pass directive, you should reference the internal service name rather than localhost, ensuring that traffic flows correctly between isolated containers. Additionally, setting the proxy_set_header directives for Host and HTTP_X_Forwarded_For is critical for preserving client context across the proxy boundary. This setup prevents broken links and ensures that your B2B platform correctly identifies the originating request for security and logging purposes.

For production-grade reliability, consider integrating Nginx Proxy Manager to automate SSL certificate issuance and simplify route management without manual configuration files. This tooling reduces operational overhead by dynamically updating Nginx configurations based on database entries, which is ideal for rapidly scaling indie and mid-size team environments. By leveraging Docker Compose’s orchestration capabilities alongside a user-friendly proxy interface, you can maintain seamless connectivity for your multiplayer operations platform. This approach also facilitates easier debugging, as logs from the proxy and upstream services can be centralized. Ensure that your Docker Compose file explicitly defines health checks for each service to guarantee that the proxy only routes traffic to healthy, running containers. This robust architecture supports the high availability required for serious game development workflows while maintaining simplicity for smaller teams managing their own infrastructure.

## container health check and restart policies

For a Compose-based Nginx reverse proxy, treat the backend's health as a startup gate rather than relying on container start order. Give the game service a healthcheck that probes a lightweight endpoint, then have Nginx declare depends_on with condition: service_healthy. This prevents the proxy from accepting traffic before the API or multiplayer service can answer. Set both services to restart: unless-stopped so they recover from crashes and host reboots without fighting manual stops; use on-failure only for one-shot migration jobs. For semble.games-style B2B tooling, keep the health endpoint cheap and unauthenticated internally, and log proxy 502s separately so unhealthy upstreams are visible.

The remaining operational choice is whether Nginx should re-resolve a recreated backend. Compose DNS can change IPs, and Nginx caches upstream names at startup, so after a backend recreation you may need to reload Nginx. Use a shared Docker network, point proxy_pass at the service name, and add a lightweight watcher or deploy step that reloads Nginx when the backend container is replaced. That keeps restart policies simple while avoiding stale upstream addresses.

## nginx proxy manager vs manual config

| Factor | Nginx Proxy Manager | Manual nginx config |
| --- | --- | --- |
| Setup speed | Fast: UI-driven hosts, upstreams, and certificates | Slower: write, mount, and reload nginx.conf yourself |
| TLS/SSL | Built-in Let’s Encrypt workflow with renewals | Requires certbot or external certificate automation |
| Control | Good for common HTTP reverse proxy needs | Best for custom headers, caching, streams, and edge cases |
| Team operations | Easy handoff for small indie/mid-size teams | Git-reviewable but needs nginx expertise |

For typical Docker Compose deployments, choose Nginx Proxy Manager: it delivers host routing, Let’s Encrypt certificates, and a UI in one stack, cutting setup and handoff time. Keep manual nginx.conf when you need nonstandard stream rules, precise cache/header logic, or Git-reviewed config. At semble.games’ scale, NPM is the pragmatic default; manual config is the escape hatch.

## Quick answers

### How to handle ssl termination in docker?

Use the jwilder/nginx-proxy image with jrcs/letsencrypt-notify to automate certificate generation and renewal.

### How to route subdomains dynamically?

Set the VIRTUAL_HOST environment variable in your target container to define the domain mapping.

### How to add custom nginx config?

Mount a custom conf file into /etc/nginx/conf.d/ within the proxy container volume.

### How to ensure container restarts?

Configure restart: unless-stopped in the docker-compose.yml to maintain availability after crashes.

Canonical: https://semble.games/knowledge/how_to_set_up_nginx_reverse_proxy_docker_compose.php
Markdown: https://semble.games/knowledge/how_to_set_up_nginx_reverse_proxy_docker_compose.php/index.md