I have a VPS and want to host several web applications on it using Docker Compose. Right now, each project includes its own Nginx container, and the services communicate over an internal Docker network. I'm wondering whether that setup is unnecessary or counterproductive. Would it be better to run one shared Nginx reverse proxy and certificate manager for all applications, or should each project have its own Nginx and Certbot containers?
5 Answers
Keep the backend services private whenever possible. You can either attach Nginx to the relevant Docker networks or bind application ports to localhost rather than exposing them on every interface. Avoid having multiple Certbot containers write to the same certificate directory, since that can cause conflicts. Whatever setup you choose, test certificate renewal and make sure Nginx reloads correctly afterward.
You can keep using Nginx and pair it with an ACME client such as Certbot or an Nginx certificate companion. A single certificate-management setup can issue and renew certificates for multiple virtual hosts. Wildcard certificates using DNS validation are another option, especially if you control the domain DNS and want one certificate covering many subdomains.
A hosted DNS or proxy service can also manage certificates, depending on your requirements. Regardless of the certificate provider, the typical design is still one public-facing proxy with only ports 80 and 443 exposed, while the application containers communicate over private Docker networks. Tools such as Traefik are another established option for automatically discovering containers and routing traffic to them.
For a single VPS, one reverse proxy is usually enough. Let one Nginx container bind to ports 80 and 443, then connect it to the private Docker networks containing the applications it needs to reach. Each application can remain isolated in its own Compose setup while Nginx routes requests based on the domain name.
Caddy and Traefik can simplify this because they handle reverse proxy configuration and HTTPS renewal automatically. They’re worth considering for a hobby server, but switching isn’t required. A single Nginx container is perfectly reasonable if you’re comfortable maintaining the configuration yourself.
Caddy is convenient because it automatically renews certificates, but Nginx is still a good choice when you want more explicit control over the configuration.
I’d prefer to stick with Nginx because I already know it and don’t want to avoid learning the more complex configuration. I mainly want to make sure the container layout is sensible.