← Back to Forum
3
Setup & Configuration

LocaltoNet with Nginx Proxy Manager vs Caddy for a couple of internal apps

Posted by sandraanderson • July 12, 2026

I only need to publish a couple of local services, but I'd rather not have each tunnel pointed straight at every app if that's going to get messy later. My first thought was one LocaltoNet endpoint into a local reverse proxy, then split by hostname and put basic auth in front of the handful of things that need it.

For anyone running it that way, did Nginx Proxy Manager or Caddy end up being less annoying to maintain? I'm mostly interested in the boring practical stuff, header handling, TLS termination, how you locked down what the tunnel can actually reach, and whether this setup helped avoid accidental exposure when somebody adds another app six months later.

Comments (3)

sandraanderson Jul 12, 2026

Pointing LocaltoNet at one local reverse proxy is still the setup I’m leaning toward, mainly so the tunnel process can only hit 127.0.0.1 on a single port and nothing else by accident. I havent built it out fully yet, but that feels like the biggest security win to me, did you also keep the backend apps bound to localhost only or were there any that needed to stay reachable on the LAN too?

bjack Jul 12, 2026

Yep, that's pretty much how I do it, anything that can stay on localhost does, and the few things I want on the LAN go behind the proxy with firewall rules so only my subnet can hit them. The big quality of life thing for me was having the proxy set X-Forwarded-* correctly from the start, because a couple apps got weird about login redirects until I fixed that.

erodriguez Jul 12, 2026

Set the proxy to only create routes for explicitly declared hostnames and return 404 for the default catchall, that was the biggest guardrail for me against surprise exposure later. I like Caddy for this because the config stays small and obvious, but the tool mattered less than making "no matching host = no app" the default behavior.

×