Practical architecture for combining Pi-hole and Nginx Proxy Manager

Overview: Roles of Each Component
Pi-hole
Runs local DNS (port 53)
Serves as the DNS resolver for your network
Provides local DNS records so devices resolve service names (e.g., 
home.lab, 
jellyfin.lab)
Does not need to serve HTTP(80) or HTTPS(443)
Nginx Proxy Manager (NPM)
Handles all HTTP/HTTPS traffic for services
Manages SSL certificates (Let’s Encrypt if you choose)
Routes incoming application requests to internal services on different ports/IPs
Key Principle
Pi-hole handles DNS resolution only.
NPM handles web traffic routing and HTTPS termination.
This clear separation avoids conflicts and makes management scalable.
✔️ Best Architecture (Most Reliable)
1) Move Pi-hole’s Web UI off Port 80/443
By default Pi-hole binds its web UI to port 80/443. This collides with NPM.
Change Pi-hole Admin UI to a different port (e.g., 
8081, 
8888):
On Pi-hole host: change Lighttpd config so 
/admin listens on 
8081
DNS on Pi-hole still runs on port 53 and is unaffected by this change
This allows NPM to own 80/443 exclusively. (bolet.io)
2) Local DNS Records in Pi-hole for All Reverse-Proxied Hosts
Create 
A records that point friendly domains to NPM’s IP.
Example:
pihole.lab.zn80.net     → 192.168.10.105
jellyfin.lab.zn80.net   → 192.168.10.105
bookstack.lab.zn80.net  → 192.168.10.105
Reasoning:
Devices query Pi-hole DNS and get your internal names
NPM then routes based on Host header
Pi-hole is the DNS source of truth for your LAN. (ReproDev)
3) Configure NPM Proxy Hosts for Each Service
Inside NPM Proxy Hosts:
Domain/Hostname
Forward To
Port
Notes
pihole.lab.zn80.net
192.168.10.105
8081
Pi-hole admin UI
jellyfin.lab.zn80.net
192.168.10.xxx
8096
Jellyfin service
bookstack.lab.zn80.net
…
…
Other services
Important details
For Pi-hole you may need to forward 
/admin correct paths
Enable SSL for all hosts (ideally) via Let’s Encrypt (even internal DNS)
If Let’s Encrypt can’t validate via DNS challenge for internal domains, you can use a local CA or self-signed cert and manage trust in your clients. (Reddit)
This makes everything clean to access via Hostnames exclusively:
https://jellyfin.lab.zn80.net
https://pihole.lab.zn80.net/admin
4) Maintain Internal DNS Instead of Wildcard DNS (Optional but safer)
You could be tempted to use a wildcard (
*.lab.zn80.net → 192.168.10.105), but that is less safe and confusing for certificate validation and service discovery.
Better pattern:
Pi-hole local DNS → explicit A records per hostname
Pi-hole → NPM IP
NPM → internal service
Explicit records help:
TTL management
SSL certificate issuance
Troubleshooting
🧠 Why This Is the Best Way
✅ DNS + Reverse Proxy are cleanly separated
Pi-hole isn’t serving HTTP, so there’s no port conflict.
NPM can handle 80/443 without interference.
✅ You achieve real HTTPS for internal domains
Every service can have a valid certificate via NPM.
✅ Easy, scalable, and future-proof
Adding a new service is trivial:
Add A record in Pi-hole
Add Proxy Host in NPM
Done
✅ Works with VPN / local DNS clients
If your devices use Pi-hole’s DNS (wired/wireless/VPN), they resolve domain names that NPM can proxy. (Pi-hole Userspace)
🛠 Detailed Implementation
A) Change Pi-hole web interface port
Edit 
/etc/lighttpd/lighttpd.conf:
server.port = 8081
Restart:
sudo systemctl restart lighttpd
B) Add DNS entries in Pi-hole
In Pi-hole:
Local DNS → DNS Records
Examples:
pihole.lab.zn80.net → 192.168.10.105
jellyfin.lab.zn80.net → 192.168.10.105
C) In NPM, add Proxy Hosts
For each service:
Domain names: your local domain
Forward hostname: actual service IP/port (Pi-hole admin UI at 8081)
SSL:
Request new cert (if public domain or DNS challenge available)
Or use local CA / self-signed trusted cert
Set common options:
Block exploits: enabled
Expires headers: optional
Websockets: if needed
🚫 What Not to Do
❌ Don’t proxy Pi-hole DNS-port
Do not try to proxy port 53 through NPM. DNS must be direct.
❌ Don’t expose Pi-hole admin UI publicly
Pi-hole should only be accessible from your LAN or VPN.
❌ Don’t use wildcards unless you know certificate chain
Wildcard DNS can break HTTPS if certificates aren’t matching.
📌 Final Result You Should See
After setup:
nslookup pihole.lab.zn80.net      # → 192.168.10.105
nslookup jellyfin.lab.zn80.net    # → 192.168.10.105
Browser:
https://pihole.lab.zn80.net/admin  # SSL
https://jellyfin.lab.zn80.net      # SSL
Pi-hole DNS works, NPM handles web access, and everything is secure, consistent, and manageable.