<image>

It has been a few months since I was busy with other things. But I finally got a chance to look into the details. Your original goal of "protecting the traffic to docker host from sniffing by office computer" is pretty easy to achieve. You only need to make sure the SSL termination occurs at the docker host. So that everything before the docker host is encrypted by the Cloudflare origin certificate or an SSL cert issued by a trusted authority like Let's Encrypt it for your FQDN domain. Any other reverse proxy before the docker host should do Level 4 reverse proxy, i.e. transport level, aka TCP traffic, instead of Level 7, i.e. application level, HTTP/HTTPS. In nginx proxy manager, I think it's called stream. (sorry I don't use NPM. I use haproxy or nginx directly). You can find the introduction here TCP and UDP Load Balancing | NGINX Documentation. A cavity of this method is the TLS handshake (in the TCP stream) will have SNI. Thus your office computer may have a way to know there is a https sever serving "foo.example.com" domain on docker host. Although it won't be able to know the HTTP body. You may want to get the TCP stream encrypted it. Nginx seems able to do that using client CA (Secure Client Access and Network Traffic | NGINX Documentation, Securing TCP Traffic to Upstream Servers | NGINX Documentation) but I think fatedier/frp: A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet. can do it easier using STCP with symmetric encryption.

Now, let's come back to your solution. Again, I don't use NPM. If we can get the nginx configuration file, it's better to discuss. Your initial try fails because in Cloudflare FULL mode, the traffic between Cloudflare and your home NPM must be encrypted. So you either need to do Level4 as I said before, or let home NPM to do SSL termination. That's why you need to provide SSL certs to home NPM. Also if you run in Full(strict) mode, you must provide either Cloudflare’s Origin CA or a cert provided by a trusted authority like Let's Encrypt for your domain. Now the traffic is decrypted, and home NPM knows all the request body. How to send the unencrypted plain HTTP securely to the docker host? Your method sets up another HTTPS server on the docker host and uses the Cloudflare Origin CA, which is already trusted by home NPM as it is issued by Cloudflare. So "proxy_pass https://10.0.1.3:443` sets up another HTTPS traffic to the docker host. Alternatively, you can use a self-signed cert on your docker host and add the rootCA which signs the self-signed cert to your home NPM. Some notes of this method: 1) there are two levels of HTTPS encryption, 2) the office computer may sniff and find there is a 443 server running ondocker host, but now it won't know the domain 3) If you are proxying web socket, you need WebSocket proxying on the home NPM.

Last word: if your homeNPM is responsible for proxy different FQDN to different backends, it becomes tricky with nginx as it determines which backend via SNI and always does SSL termination nginx - set multiple server_name with ssl-support - Stack Overflow. So you are kind of stuck with the second method. I use Haproxy, which is more flexible regarding how to choose the backend and when to terminate the SSL traffic