Nginx Reverse Proxy with Let's Encrypt SSL for PowerDNS-Admin on Debian 13

[Cloud-Moon]

How to Set Up Nginx Reverse Proxy with SSL (Let's Encrypt) for PowerDNS-Admin on Debian 13

Running your DNS management panel over unencrypted HTTP (port 80) exposes your admin credentials to potential interception. In this step-by-step guide, we will secure PowerDNS-Admin using Nginx as a reverse proxy and obtain a free Let's Encrypt SSL certificate on Debian 13 (Trixie).

Prerequisites

• A server running Debian 13 with PowerDNS-Admin already installed.
• A fully qualified domain name (FQDN) pointing to your server IP (e.g., ://yourdomain.com).
• Ports 80 and 443 open on your server firewall.

---

Step 1: Change PowerDNS-Admin Port in Docker
Since Nginx needs to bind to port 80 to handle web traffic, we must move our PowerDNS-Admin Docker container away from port 80.

Open your existing docker-compose.yml file:

cd pdns-admin
nano docker-compose.yml

Find the ports section and change it from "80:80" to "8080:80". It should look exactly like this:

    ports:
      - "8080:80"

Save the file and recreate the container to apply the port change:

sudo docker compose up -d --force-recreate

Note: Your web interface is now temporarily running on http://your-server-ip:8080

---

Step 2: Install Nginx and Certbot
Install Nginx web server along with Certbot and the Nginx plugin from the official Debian 13 repositories to handle automatic SSL generation:

sudo apt update
sudo apt install nginx certbot python3-certbot-nginx -y

Make sure Nginx is active and running:

sudo systemctl status nginx

---

Step 3: Configure Nginx Reverse Proxy
Create a new Nginx configuration file for your subdomain. Replace ://yourdomain.com with your actual domain name:

sudo nano /etc/nginx/sites-available/://yourdomain.com

Paste the following proxy configuration into the file:

server {
    listen 80;
    server_name ://yourdomain.com;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # Disable buffering for smoother web interface responsiveness
        proxy_buffering off;
    }
}

Enable the configuration by creating a symlink to the sites-enabled folder:

sudo ln -s /etc/nginx/sites-available/://yourdomain.com /etc/nginx/sites-enabled/

Test the Nginx configuration for syntax errors:

sudo nginx -t

If the test is successful, restart Nginx:

sudo systemctl restart nginx

---

Step 4: Obtain Let's Encrypt SSL Certificate
Run Certbot to request the SSL certificate and automatically configure the HTTPS redirect inside Nginx. Replace ://yourdomain.com with your domain name:

sudo certbot --nginx -d ://yourdomain.com

During the interactive prompt:

1. Enter your email address for renewal and security notices.
2. Agree to the Terms of Service.
3. Choose whether to share your email address.
4. Certbot will automatically deploy the certificate and update your Nginx file to force HTTP-to-HTTPS redirection.

Verify that the automatic renewal timer is working flawlessly:

sudo systemctl status certbot.timer

---

Step 5: Access Your Secured Interface
Open your web browser and go to your domain name:

https://://yourdomain.com

You will see a secure padlock icon in the URL bar. Your proxy connection is now fully encrypted, passing traffic safely through Nginx down to your isolated Docker application.

--------------------------------------------------

If you run into any Let's Encrypt challenges, proxy timeouts, or need help restricting access to specific IP ranges, leave a comment below!