5. Setting up the reverse proxy

It is recommended that you have a reverse proxy in front of MyFin, doing so will allow you to setup a trusted SSL certificate and have an extra layer of protection.

5.1 Access Nginx Proxy manager#

We should now have everything up and running, waiting to be configured. In your favourite web browser, go to the url using either the IP address of your server or using the domain name if you did the DNS Override step.

In this case it will be either: http://192.168.1.250:81 or http://yourdomain.com:81

You will be presented with the Nginx proxy manager UI.

Login using the following details:

The default username is admin@example.com and the default password is changeme

Note

Change the Nginx Proxy Manager UI username and password as soon as possible

It is recommended to do it right away before you continue

This guide explains how to configure Nginx Proxy Manager (NPM) so that requests for yourdomain.com are securely forwarded to your MyFin server.

In this guide we will:

• Create a Proxy Host for yourdomain.com
• Forward requests to the MyFin container
• Obtain a Let’s Encrypt SSL certificate using the Cloudflare DNS Challenge
• Force all traffic to use HTTPS

Ensure you have the following information available.

5.2 Creating a Cloudflare API Token#

If you do not already have an API Token, create one in the Cloudflare Dashboard.

Navigate to:

My Profile → API Tokens

Click:

Create Token

Use the Edit Zone DNS template (or create a custom token).

Grant the following permissions:

Restrict the token to your domain.

Example:

yourdomain.com

Click Continue.

Finally, click Create Token and copy the generated token.

Important

Store the token securely. Cloudflare only displays it once.

5.3 Create a Proxy Host#

Navigate to:

Hosts → Proxy Hosts

Click Add Proxy Host.

Enter the following information.

Enable the following options:

• ✓ Block Common Exploits
• ✓ Websockets Support

Leave the remaining settings as their defaults.

Why use myfin?

Because MyFin and Nginx Proxy Manager are on the same Docker network, Docker automatically resolves the container name myfin to the correct IP address.

5.4 Configure SSL#

Open the SSL tab.

Configure the following options.

Enable:

• ✓ Force SSL
• ✓ HTTP/2 Support
• ✓ HSTS (Optional)

5.5 Configure the Cloudflare DNS Challenge#

When prompted, select Cloudflare as the DNS provider.

Paste your Cloudflare API Token into the API Token field.

Click Save.

Nginx Proxy Manager will now:

1. Create a temporary DNS TXT record.
2. Verify ownership of your domain.
3. Obtain a Let’s Encrypt certificate.
4. Automatically renew the certificate before it expires.

Note

DNS Challenge works even if your server is not accessible from the Internet, making it ideal for Cloudflare Tunnel deployments.

5.6 Verify the Certificate#

Once the Proxy Host has been created, open:

https://yourdomain.com

You should see:

• A valid HTTPS connection
• No browser certificate warnings
• MyFin loading successfully

5.7 Troubleshooting#

5.7.1 Certificate request fails#

Verify that:

• Your domain is managed by Cloudflare.
• The API Token has the required permissions.
• The token is restricted to the correct zone.
• Your domain name is entered correctly.

5.7.2 Gateway Timeout (502)#

Check that:

• The MyFin container is running.
• The container name is myfin.
• The Forward Port matches your application’s internal port.
• Both MyFin and Nginx Proxy Manager are connected to the same Docker network.

5.7.3 SSL Certificate does not renew#

Ensure the Cloudflare API Token is still valid and has not been revoked.

Nginx Proxy Manager will automatically renew certificates approximately 30 days before expiry.

5.8 Result#

Your deployment is now configured as follows:

Remote Users
      │
      ▼
Cloudflare
      │
      ▼
Cloudflare Tunnel
      │
      ▼
Nginx Proxy Manager
      │
      ▼
MyFin

Local Users
      │
      ▼
Local DNS Override
      │
      ▼
Nginx Proxy Manager
      │
      ▼
MyFin

Both local and remote users access https://yourdomain.com using the same domain name and the same SSL certificate, providing a seamless and secure experience regardless of their location.