Top picks by use case
| Use case | Recommended | Why |
|---|---|---|
| Simplest setup, TLS just works | Caddy | One-line Caddyfile, automatic Let's Encrypt |
| GUI-driven, no config files | Nginx Proxy Manager | Web UI for everything |
| Container-heavy, dynamic stack | Traefik | Auto-discovers Docker labels and Kubernetes |
| Production / high-performance | NGINX or HAProxy | Battle-tested, fast, predictable |
| Edge / multi-region | Cloudflare in front + any of above | DDoS protection, global anycast |
The main contenders
The reverse proxy that makes TLS trivial. A two-line Caddyfile gets you a fully working HTTPS reverse proxy with automatic Let's Encrypt issuance and renewal — no certbot, no nginx vhost gymnastics. HTTP/2 and HTTP/3 by default. Plugin system for OAuth, Cloudflare DNS challenge, etc.
Best for: homelabs, small servers, anyone who values "it just works" over maximum tunability.
NGINX with a web UI bolted on. Click to add a proxy host, choose a Let's Encrypt cert, save. Excellent for users who don't want to edit config files. Stores configs in a SQLite database — slightly harder to back up than file-based configs but workable.
Best for: new self-hosters, users who actively prefer a UI, "set it and forget it" deployments.
Auto-discovers containers via Docker labels: add traefik.http.routers.foo.rule=Host(`foo.example.com`) to a container and Traefik picks it up. No editing the proxy config when you add services. Native Kubernetes Ingress support. Built-in dashboard.
Best for: Docker-heavy homelabs, anyone who adds/removes containers often, Kubernetes deployments.
The reverse proxy that runs much of the internet. Fastest, most predictable, most documented. TLS automation requires pairing with certbot. Configuration is file-based and uses NGINX's own syntax. Steeper learning curve than Caddy but the ceiling is much higher.
Best for: users coming from production ops, anyone who values stability and tunability over convenience.
HAProxy is the load balancer of choice for high-traffic deployments — extremely fast, granular L4/L7 control. Envoy is the proxy at the heart of most service meshes; overkill for homelab but worth knowing if you're working at scale.
Best for: specialized production workloads, service mesh deployments.
How they compare on TLS
| Proxy | TLS automation | DNS challenge support |
|---|---|---|
| Caddy | Automatic, default | Via plugin |
| NPM | UI button | Yes, multiple providers |
| Traefik | Automatic with config | Yes, many providers |
| NGINX | Pair with certbot | Via certbot plugins |
| HAProxy | Manual or via certbot | Via certbot |
Config style — pick one you'll be happy reading in two years
- Caddyfile: dead simple, minimal, ergonomic for human writing.
- NPM: no config files — but harder to source-control or migrate.
- Traefik: YAML files or Docker labels — labels mean each service declares its own routing.
- NGINX: proprietary directive syntax, very mature, large community of examples.
The right choice often comes down to: "how do I want to express new routes — by editing one file, by changing a label, or by clicking a UI?"
Common patterns
- Subdomain-per-app:
vault.example.com→ Vaultwarden,photos.example.com→ Immich. Cleanest URL story; needs a wildcard cert or many individual certs. - Wildcard cert via DNS challenge: one cert covering
*.example.com. All major proxies support this with a Cloudflare/Route53/etc plugin. - Auth in front: Authelia or Authentik between the proxy and the app for SSO across self-hosted apps.
- Cloudflare in front: use a CNAME to a Cloudflare tunnel or Cloudflare proxy. Hides your home IP and adds DDoS protection.
What about Cloudflare Tunnels and Tailscale Funnel?
Both are alternatives to a public reverse proxy — they expose specific services without you opening a port on your home router. Cloudflare Tunnels are zero-config for HTTPS but route through Cloudflare. Tailscale Funnel is similar via Tailscale's edge. For services only you need to access, neither beats a Tailscale private network with no public surface at all.
Frequently Asked Questions
Do I need a reverse proxy if I only access apps locally?
Strictly no. But a reverse proxy still helps locally — TLS even on a LAN, friendly hostnames instead of 192.168.1.50:8123, easy redirects. Many homelabbers run one even without exposing anything publicly.
Is Caddy as fast as NGINX?
Close enough that it doesn't matter for homelab traffic. At hundreds of thousands of requests/second, NGINX edges ahead. For home use, both saturate your upstream long before the proxy becomes the bottleneck.
How do I get a cert for a domain that doesn't resolve publicly?
Use the DNS-01 challenge — Caddy / NPM / Traefik all support it with a Cloudflare or other DNS provider plugin. You get real Let's Encrypt certs for internal-only domains.
Can I run two reverse proxies side-by-side?
Not on the same ports. You can chain them (Cloudflare → home Caddy → individual app proxies on different hosts), but two listening on 443 on the same host is a conflict. Pick one as your edge.
What's the best for Kubernetes?
Traefik or Ingress-NGINX (the K8s-specific NGINX flavor) are the most common ingress controllers. Caddy has a controller but smaller community. For most K8s deployments, Traefik or Ingress-NGINX is the safer pick.