# Using NGINX as a reverse proxy for Node-RED
**URL:** https://discourse.nodered.org/t/using-nginx-as-a-reverse-proxy-for-node-red/42793
**Category:** FAQs
**Tags:** security
**Created:** [17 March 2021 22:32 UTC](https://discourse.nodered.org/t/using-nginx-as-a-reverse-proxy-for-node-red/42793 "2021-03-17T22:32:06Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [17 March 2021 22:32 UTC](https://discourse.nodered.org/t/using-nginx-as-a-reverse-proxy-for-node-red/42793/1 "2021-03-17T22:32:07Z")
As the use of NGINX is often recommended by myself and others to help provide performance and security gains for Node-RED. I thought that I really ought to do a full write-up on how to do this.
> **[NGINX & Proxying Node RED](https://github.com/TotallyInformation/node-red-contrib-uibuilder/wiki/NGINX-&-Proxying-Node-RED)**
>
> Easily create data-driven web UI's for Node-RED. Single- & Multi-page. Multiple UI's. Work with existing web development workflows or mix and match with no-code/low-code features. - Tot...
Note that there is also another FAQ on this subject but the above gives specifics about the use of HTTP/2 and rewrite rules for handling multiple instances of Node-RED (or multiple node.js apps or using uibuilder with its custom server feature). Or indeed just proxying specific parts of Node-RED.
The configuration in this article also uses the current standards and configuration of the community version of NGINX (e.g. it does not use the `sites-available` folder).
My article does not, however, cover the installation and configuration of other tools and services such as fail-to-ban or Let's Encrypt.
[Node-red server with nginx reverse proxy howto guide - Node-RED Forum](https://discourse.nodered.org/t/node-red-server-with-nginx-reverse-proxy-howto-guide/27397/1)
### User Authentication
This is the other piece of the puzzle, doing user authentication outside of Node-RED. I still need to do an article on this and will do so when time permits.
There are doubtless various ways of doing this with NGINX but I'll first be looking at [vouch-proxy](https://github.com/vouch/vouch-proxy) which supports multiple back-end authentication services and is open source.
---
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [21 March 2021 12:48 UTC](https://discourse.nodered.org/t/using-nginx-as-a-reverse-proxy-for-node-red/42793/2 "2021-03-21T12:48:48Z")
Small additional note. If using Let's Encrypt to provide your TLS certificate and key, don't forget that it changes fairly often. When it does, you need to tell NGINX.
```bash
sudo systemctl reload nginx
```
Reload simply picks up the latest config files, it does not close any existing client connections.
You will probably want to either schedule this using CRON or add it to your Acme client script.
* * *
I use the `acme.sh` script to manage my certificates from Let's Encrypt. It has a built-in auto-reload for common web servers including NGINX.
[acmesh-official/acme.sh: A pure Unix shell script implementing ACME client protocol (github.com)](https://github.com/acmesh-official/acme.sh#3-install-the-cert-to-apachenginx-etc)
---
### Author:  [@bakman2](https://discourse.nodered.org/u/bakman2)
#### Post date: [22 March 2021 05:28 UTC](https://discourse.nodered.org/t/using-nginx-as-a-reverse-proxy-for-node-red/42793/3 "2021-03-22T05:28:45Z")
I am using [nginx proxy manager](https://nginxproxymanager.com/screenshots/) to do the heavy lifting of configuring nginx, it has built-in support for let's encrypt with a nice web interface. I am still investigating 2FA authentication with [Authelia](https://github.com/authelia/authelia).
---
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [22 March 2021 14:13 UTC](https://discourse.nodered.org/t/using-nginx-as-a-reverse-proxy-for-node-red/42793/4 "2021-03-22T14:13:09Z")
Nice. Let us know how you get on. I've actually just flipped to Caddy which seems nicer to configure and has built-in Let's Encrypt if you want it. It also configures http/2 right out of the box without any additional config.
I've also worked out how to block external access to the Editor but leave the Dashboard open and even to be able to have the Dashboard and the Editor on different ports.
It has good support for external authentication and even for MFA.
---
### Author:  [@system](https://discourse.nodered.org/u/system)
#### Post date: [16 April 2021 22:32 UTC](https://discourse.nodered.org/t/using-nginx-as-a-reverse-proxy-for-node-red/42793/5 "2021-04-16T22:32:20Z")
This topic was automatically closed after 30 days. New replies are no longer allowed.