Network & homelab

A sanitized description of the local Docker host, firewall boundary, and application routing.

Contents

Architecture
Request flow
Nginx Proxy Manager
Container isolation
Operations

Architecture

The Fortinet firewall controls the network edge. Nginx Proxy Manager (NPM) is the approved web entry point, and Docker Compose groups each application with its supporting services. Internal addresses, credentials, firewall rules, and remote-access details are kept in protected administrator documentation.

EdgeFortinet policy and approved forwarding

Web entryNPM hostname and TLS routing

ComputeMultiple isolated Docker workloads on one host

Request flow

InternetA request arrives for an approved hostname.

FirewallOnly the intended inbound web traffic reaches NPM.

NPMThe hostname selects a proxy rule and certificate.

ApplicationNPM forwards to the correct internal port or shared Docker network.

Data servicesThe application reaches only its required private database, cache, or storage.

Nginx Proxy Manager

NPM lets multiple applications share one host and standard HTTP/HTTPS ports. Each proxy host names one domain, one upstream target, and an associated certificate. Forced HTTPS and central certificate renewal simplify operations, while authentication and authorization remain the responsibility of each application.

Container isolation and troubleshooting

Separate Compose projects make dependencies, logs, volumes, and restarts easier to reason about. A single application can be rebuilt or inspected without reinstalling the host. The isolation is deliberate rather than automatic: broad mounts, shared networks, privileged containers, and exposed ports can weaken it.

Operational checks

Confirm container health, restart policy, resource use, and upstream reachability.
Test HTTP-to-HTTPS redirects, certificate names and expiry, and application responses.
Back up stateful services and perform restoration drills.
Keep management interfaces trusted-only and document every public proxy route.