Putting the Wazuh dashboard behind NPM on a dedicated user-defined Docker network keeps TLS and Host routing at the edge while the dashboard container never publishes its UI port on the host. Attach both NPM and the dashboard service to that network, point the Proxy Host at the dashboard service name and internal port, enable Websockets Support for the live UI, and leave only NPM owning 80/443. Request a certificate only after the public A/AAAA for that hostname already lands on the box, and keep the NPM admin listener off the open internet.

Ops check once the host is live: leaf SAN matches the name, force-SSL is one hop, and Host plus X-Forwarded-Proto still reach the dashboard so auth redirects and absolute asset URLs stay on the public scheme. From inside the NPM container, curl the dashboard service by name on the internal port, then the same path through the public vhost; connect failures are network membership or a wrong internal port, while redirect loops usually mean the forwarded Host/Proto pair never arrived.