Monitoring Nginx Proxy Manager with Vigilmon

Nginx Proxy Manager (NPM) is a popular reverse proxy with a point-and-click GUI for managing proxy hosts, SSL certificates, and access lists. Because it routes traffic to every other service in your homelab or VPS setup, NPM is a single point of failure worth monitoring carefully. Vigilmon can watch NPM's admin UI, its proxy targets, and the SSL certificates it manages — giving you end-to-end visibility across your entire reverse proxy stack.

What You'll Set Up

• HTTP monitor for the NPM admin interface (port 81)
• Health checks for proxied services through NPM
• SSL certificate expiry alerts for proxied domains
• Proxy availability checks to catch misconfigured or downed proxy targets

Prerequisites

• Nginx Proxy Manager running via Docker Compose (the standard deployment)
• Admin UI accessible on port 81
• At least one active proxy host pointing to a backend service
• A free Vigilmon account

Step 1: Monitor the NPM Admin Interface

The NPM admin UI runs on port 81. Monitoring it confirms that the NPM container is up, the Node.js backend is responding, and you can still manage your proxy configuration.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. URL: http://<your-npm-host>:81 (e.g. http://192.168.1.10:81).
4. Set Expected HTTP status to 200.
5. Set Check interval to 2 minutes.
6. Click Save.

This catches Docker container crashes, OOM kills, and port conflicts that would prevent anyone from managing proxy hosts.

Step 2: Monitor Proxied Services Through NPM

The most important thing to monitor is whether your proxied services are reachable through NPM — because that's the path your users take. A backend service can be healthy internally while NPM's proxy rule is misconfigured or the upstream IP has changed.

For each critical proxied service, add a Vigilmon HTTP monitor using the public domain NPM forwards to:

1. Add Monitor → HTTP / HTTPS.
2. URL: https://app.yourdomain.com (your NPM proxy host, not the backend IP).
3. Set Expected HTTP status to 200 (or 301/302 for services that redirect).
4. Set Check interval to 1 minute for critical services.
5. Under Advanced, set Expected body contains to a unique string from the proxied app's response (e.g. "status":"ok" or an HTML title) to detect cases where NPM returns a proxy error page with a 200 status.
6. Click Save.

Repeat for each proxied service. Vigilmon's multi-monitor dashboard gives you a single view of your entire reverse-proxied stack.

Step 3: Detect NPM Proxy Errors

When NPM can't reach a backend, it returns a 502 Bad Gateway or 504 Gateway Timeout — both of which Vigilmon catches automatically if your expected status is 200. To make this explicit:

1. On each proxied service monitor, confirm Expected HTTP status is set to 200.
2. Set Consecutive failures before alert to 1 for critical services — a single 502 from a reverse proxy usually means the backend is completely unreachable, not just slow.

You can also add an Expected body does not contain rule with the string 502 Bad Gateway for services that might return 200 with an error body embedded (less common but possible with some error pages).

Step 4: SSL Certificate Expiry Alerts

NPM manages Let's Encrypt certificates for all your proxy hosts. A renewal failure leaves a certificate expiring silently — no browser warning until the cert is already expired.

For each domain NPM manages SSL for:

1. Add Monitor → SSL Certificate.
2. Enter the domain: https://app.yourdomain.com.
3. Set Alert when certificate expires in less than 30 days.
4. Click Save.

Add one SSL monitor per domain. NPM renews Let's Encrypt certificates at 30 days before expiry by default, so a 30-day alert window gives you time to diagnose renewal failures (port 80 blocked by firewall, ACME challenge failing) before the cert expires.

Step 5: Monitor NPM's Internal API (Optional)

NPM exposes a REST API used by its own frontend at http://<host>:81/api. You can use this as a deeper health signal:

1. Add Monitor → HTTP / HTTPS.
2. URL: http://<your-npm-host>:81/api.
3. Set Expected HTTP status to 200 or 401 — the API returns 401 Unauthorized for unauthenticated requests, which still confirms the backend API is running.
4. Set Check interval to 5 minutes.
5. Click Save.

A 200 or 401 on /api proves the Node.js API process is alive. A timeout or 502 means the API has crashed even if the nginx layer is still up.

Step 6: Alert Channels and Maintenance Windows

1. In Vigilmon, go to Alert Channels and connect Slack, email, or a webhook (PagerDuty, Discord).
2. Add a Maintenance window for NPM updates — the container typically restarts in under 30 seconds but long enough to trigger a single-probe alert.
3. For the admin UI monitor, set Consecutive failures to 2; for proxied service monitors, consider 1 if those services are customer-facing.

Going Further

• NPM + Crowdsec: If you use Crowdsec's nginx bouncer with NPM, monitor your Crowdsec API health separately — a crashed bouncer can block legitimate traffic while NPM appears healthy.
• Wildcard domains: NPM supports wildcard SSL certificates via DNS challenge. Monitor the wildcard domain's cert the same way — https://*.yourdomain.com certificates share an expiry date.
• Load balancing: NPM supports upstream groups for load balancing. Add monitors for each upstream host individually so you can tell if one backend has dropped out of rotation.

With Vigilmon watching the NPM admin UI, your proxied services, and every SSL certificate in your stack, you'll catch reverse proxy failures the moment they happen — not when users start reporting broken links.