nginx-proxy VS vouch-proxy

I have an express API that runs on EC2 and I am using nginx-proxy

If Traefik is not your thing Im happily using https://github.com/nginx-proxy/nginx-proxy and sslip.io for local docker compose development.

And then even plain nginx to proxy to non docker services...

(And ipv6 for really short urls. E.g. `example.com.--1.sslip.io` etc)

I wanted to share with you an exciting new tool that simplifies the process of interacting with the NGINX Proxy Manager API. It's a TypeScript tool that generates API requests based on environment variables within a Docker container. This tool is heavy influenced by the https://github.com/nginx-proxy/nginx-proxy but it works with npm.

I use an automatically configuring reverse proxy - there's several to choose from, but the nginx-docker image is really nice, and comes with another image to do automatic SSL with certbot (if you wanted to host things externally).

Docker runs on the 3B+ so you could use this [Github] or the one I have deployed here [NGINX Proxy Manager site] amongst others.

- and this

docker compose + wildcard dns + reverse proxy that covers all widecard subdomains + https://github.com/nginx-proxy/nginx-proxy (not to be confused with nginx itself) then setup a container for each app and set a subdomain for it, you can add ssl if you have a public domain or use self signed certs (but you need to distribute it to all machines and devices)

setting up letsencrypt with nginx-proxy and acme-companion

We use the nginx-proxy docker image. Auto-configuring reverse proxy with support for certbot. Never been easier - just put your domain and certbot details in your container env, and it does the rest.

I just use the nginx-proxy image, makes it all super easy, auto-configuring, and all domain/cert information is stored against the project rather than the proxy.

Look into vouch proxy

Vouch proxy is designed for this usage: https://github.com/vouch/vouch-proxy I don't think there are any nice UIs to configure it though so you'll need to be familiar with running it yourself.

Not sure this is a "best practice", but it lets me keep control of the Ingress resources inside their YAML configs. I've also layered Vouch Proxy into the ingress configurations to require SSO/MFA auth to access the resources behind the Ingress. Cloudflare has the ability to do this, but I found it cumbersome to keep track of the configs outside the K8s cluster.

I've used vouch proxy for my own stuff previously, before more recently moving to Cloudflare Access. vouch can be slightly janky at times to get working right, but once set up, it's been solid.

For example: nginx -> Vouch proxy -> KeyCloak -> Jellyfin

While this works, we were hoping to make access a bit easier with say an OpenID Connect SSO and reverse-proxy solution. I've seen Vouch Proxy, https://github.com/vouch/vouch-proxy which is really just SSO on top of nginx, but I'm wondering if there's a simpler way to do this.

You seem to be quite knowledgeable and a minimal provider with just the bare minimum would suffice for you. Have a look at Vouch Proxy, it does one thing and it does it well.