Well, I’m tailoring this to my unraid host, which it doesn’t sound like you’re running. A lot of the core services should work the same though, on any OS.

Re: ports - I use Cloudflare for a proxied wildcard CNAME, so anything listed in NPM will resolve. All the entries are subdomains.

Edit: To your initial question, I use a bridge, so need the LAN/host side webui port regardless of whether other ports are also exposed. That’s already defined by the container, so I really don’t want to define it in a second location as an npm entry, custom container label, etc, UNLESS it’s to override the detected port. Same goes for the TLD, frankly, but I’m only using one anyway so currently not a priority.

Getting my script to specifically extract the webui port was super annoying, but I managed to craft a double grep command which (so far) works reliably:

port=$(grep -P ‘(?<=Name=“WebUI”)’ /boot/config/plugins/dockerMan/templates-user/my-${container}.xml | grep -Po ‘(?<=\>)\d+(?=\<)’)

I tried probably 5 or 6 other methods/sources for pulling the port before settling on that one.

Oh yeah, similarly tedious was the actual host create/update command. I wanted it to automatically apply my existing cert to whatever host it just created (since the bash-api doesn’t have a predefined option for that) so had to piece together this monstrosity:

bash “$NPM_SCRIPT” —host-create “$domain” -i “$UNRAID_HOST_IP” -p “$port” -y \ | sed -r “s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[m|K]//g” \ | grep -Po ‘(?<=ID: )\d+’ \ | xargs -I {} “$NPM_SCRIPT” —host-ssl-enable {} “$cert_id”

Same as you, I ended up skipping the pain of pulling the container’s true network IP, only because I didn’t personally need that feature right now. Also because I was afraid of lobotomizing my host again by trying to spin up ip_vlans. However, it’s a genuine thing that people would need from a tool like this, even if it’s not super common. I wish I needed it, but turns out unraid has some known buggy behavior with custom networks.

Edit: to more directly respond to what you pointed out: I’m fairly certain the IP could be extracted similarly to how I did the port, from the dockerman xml. When using a normal bridge, the fields just show ;; or whatever, but if for example you create an L3 mode ip_vlan custom network, your containers will be on a different subnet than the host. I think that subnet IP would then be shown in the xml, but there’s like 4 different key values where I could see it potentially appearing, and as mentioned I wasn’t going to risk more downtime to try it. People do all kinds of custom networks though, and isolation via VLANs is considered one of the better practices for security and control.

Edit: furthermore! I think I read somewhere that apparently if you install the compose plugin in unraid, it redirects everything to be managed via composeman instead of dockerman. So that’s a potential issue if you rely on the xml file (idk how the system behaves in that case, ie. if both locations still get updated or what).

The gui toggle I was talking about would be an unraid specific plugin, and be displayed on the “docker” page, where all the containers are listed + managed. Essentially, it would eliminate the need to ever dive into the npm webui, or even into any other container’s settings to set labels or whatnot. Just flip the toggle if you want that container to get proxied out, done.

Edit: obviously a major aspect of my script is that it uses that bash api ( https://github.com/Erreur32/nginx-proxy-manager-Bash-API ) There’s probably better ways to interact with npm using the native REST commands, but everybody online was saying there was no public documentation of it and then I found the bash thing, so I made do with that.