Nginx Proxy Manager stays a clean edge when its container alone owns the host 80/443 listeners and every proxied app rides a shared user-defined Docker network with no published app ports. Point each Proxy Host at the Compose service name and internal listen port rather than a host-mapped address, so a recreate does not leave NPM chasing a stale host port. Keep the admin UI off the open internet — bind it to localhost or an internal network and reach it over an SSH tunnel or a separate locked-down hostname — and only request certificates after the public A/AAAA for that hostname already lands on this box.

After saving a host I check that the leaf SANs cover the advertised name, that force-SSL is a single redirect hop, and that the upstream still sees the original Host plus X-Forwarded-Proto. A fresh 502 is almost always reachability from the NPM container to the service DNS name (wrong network membership or a typo’d port), not the certificate store; curl the upstream by service name from inside the NPM container first, then the same path through the public hostname, and compare status and Location so a path or scheme rewrite is not chased as an app crash.