One control plane for
all your customers' nginx
Nginx Control Plane is a self-hosted, multi-tenant reverse-proxy manager. Create proxy hosts, redirects and TCP/UDP streams, issue and auto-renew Let's Encrypt certificates, and let it render and reload nginx safely — for every customer, from a single pane of glass, on your own infrastructure.
Self-hosted or managed SaaS · Multi-tenant by design · Powered by nginx & Let's Encrypt · White-label ready
Works with the stack you already run
- nginx
- Let's Encrypt
- ZeroSSL
- Google Trust Services
- Buypass
- lego · 200+ DNS providers
- Cloudflare
- AWS Route 53
- HTTP/2 · WebSockets
- TCP / UDP streams
- LDAP / Active Directory
- Docker Compose
nginx -t validatedWhy Nginx Control Plane?
Most MSPs manage nginx by hand — SSH into each box, edit vhosts, run certbot, hope the reload doesn't break. One setup per customer, no shared overview, certificates that expire when nobody's looking. Nginx Control Plane replaces the hand-editing with one consistent operating model.
End the SSH-and-vim routine
One UI for proxy hosts, redirects, TCP/UDP streams, access lists and TLS across every customer. The worker renders the nginx configuration onto a shared volume; a dedicated sidecar validates and reloads it — no more editing vhosts by hand on ten different boxes.
Certificates that renew themselves
Let's Encrypt / ACME certificates are requested automatically the moment a host is saved and renewed well before they expire — HTTP-01 or DNS-01 for wildcards. The expired-cert incident at 2 a.m. simply stops happening.
Isolation your customers can verify
Every company lives in its own PostgreSQL database. Proxy hosts, certificates, DNS credentials, access lists and the audit log are physically separated — a clear answer to the data-separation question in every audit.
Everything an MSP nginx operation needs
From onboarding a new customer to issuing a wildcard certificate at midnight — the complete lifecycle in one place.
Proxy hosts, done right
Domain(s) → upstream (http/https), forced
TLS, HSTS, HTTP/2, WebSockets, caching and exploit blocking. Drop in a
per-host nginx snippet, or switch to full manual mode
and write the vhost verbatim — always gated by nginx -t.
Redirects & TCP/UDP streams
Domain → target URL redirects with any HTTP code (301/302/…) and path preservation. Plus raw TCP/UDP stream forwarding — ingress port → target host:port — for everything that isn't HTTP.
Automatic Let's Encrypt / ACME
Certificates are requested automatically after saving and renewed before expiry — or upload your own PEM. Choose the CA: Let's Encrypt, ZeroSSL, Google Trust Services or Buypass, including External Account Binding (EAB).
HTTP-01 and DNS-01
HTTP-01 challenges are served by the built-in nginx sidecar — just
point the domain at it. Need wildcards, or is port 80
closed? DNS-01 runs through the bundled lego binary across
200+ DNS providers, fully automated.
Access lists
Protect any proxy host with Basic-Auth (htpasswd), real
LDAP / Active Directory login (nginx auth_request,
optionally restricted to a group DN) or IP allow/deny rules — mixed and
assignable per host, on cloud and on-prem nodes alike.
Live website health checks
A tile view of every proxy host with a live health check — status, response time and HTTP code. Configure the method, path, expected codes/text/headers, redirects and TLS verification per host, with a test button right there in the UI.
Access-log statistics
Per-host analysis of the nginx access log over any period: requests, visitors, bytes, top paths and IPs, status codes, browsers/OS, referrers, file types and bots — exportable to CSV, JSON or a branded PDF.
Customizable dashboards
Build the overview your team needs from modular widgets — counters (proxy hosts, certificates, streams), TLS and certificate-status donuts, certificate-expiry timelines and live host metrics (CPU, memory, disk, network) — across multiple boards, arranged by drag & drop.
On-prem nodes (pull model)
Enable a node per customer and hand them a one-line installer
(curl … | sudo bash, no Docker). It sets up native nginx
plus a systemd poller that pulls its config over HTTPS
and reloads locally — no inbound ports at the customer site.
Certificates are issued in the cloud and shipped in the bundle.
Certificate detail & export
Every certificate shows issuer, SANs, validity, serial number, SHA-256 fingerprint, the PEM and the full ACME / lego issuance log. Download the certificate, chain, key or a bundle — the private key is admin-only and audited.
Audit & nginx logs
Every security-relevant action — certificate key reveals, host changes, access-list edits, sign-ins — is recorded per company. The per-host access and error logs from nginx are one click away, so a 502 gets an answer, not guesswork.
White-label branding
Your logo across the UI and every outgoing e-mail — separate light/dark variants and optional per-company overrides. The interface is bilingual (English / German) with a light and dark theme. Your customers see your brand.
Team access that scales
Assign people to the companies they manage with per-company roles — admin, operator or read-only viewer. Groups grant access in bulk and sync from your LDAP directory, so onboarding a new technician is one assignment, not a checklist.
Maintenance & error pages
Serve a branded page when an upstream is down (502/503/504) or a host is deliberately in maintenance mode — instead of a raw nginx error. Pick from built-in animated templates (bilingual) or write your own HTML with a live preview, and assign it per proxy host.
Uptime monitoring & alerts
Watch each proxy host and get notified the moment it goes down — and again when it recovers. Offline/online transitions e-mail your report recipients and fire a JSON webhook (Slack, Teams, automation), and each customer tile shows a live gateway and on-prem node status.
How it works
From zero to a live, TLS-terminated proxy in three steps.
Connect a customer
Create a company — its PostgreSQL database is provisioned automatically. Serve traffic from the built-in nginx sidecar, or enable an on-prem node with a one-line installer to serve it at the customer site.
Define hosts & certificates
Add proxy hosts, redirects and streams; pick a CA and issue a Let's Encrypt certificate — HTTP-01, or DNS-01 with your DNS-provider credentials for wildcards. Attach access lists where you need them.
NCP renders & reloads nginx
The worker renders every company's configuration to a shared volume;
the nginx sidecar validates it with nginx -t and only then
reloads. A broken config is never applied — and every change lands in
the audit log.
A look inside the platform
Clean, fast and to the point — here with demo data: the company overview your team starts the day with, and the per-company dashboard.
Security is the default, not an add-on
A control plane holds the TLS keys and directory credentials for your customers' sites. This one is built accordingly.
nginx -t before every reload
The worker renders the config and updates a trigger file; the
sidecar validates with nginx -t and only then reloads.
A broken config is never applied — and the worker never needs a Docker
socket.
Encrypted secrets at rest
Certificate keys, ACME account keys, EAB HMACs, DNS-provider credentials and htpasswd entries are encrypted with a dedicated master key (Fernet) before they touch the database. Plaintext secrets are never returned by the API.
MFA, passkeys, LDAP & roles
Two-factor authentication (TOTP) with single-use backup codes, passwordless sign-in via passkeys (FIDO2 / WebAuthn), sign-in against your LDAP / Active Directory, and granular roles: admin, operator and read-only viewer — assignable per company.
Private keys are guarded
Downloading a certificate's private key is admin-only and written to the audit log; encrypted columns never leave the database in plaintext. Disaster recovery stays possible without ever exposing keys casually.
Complete audit trail
Every security-relevant action — certificate issuance and key reveals, host and access-list changes, user changes, sign-ins — is recorded with user, time and target, per company.
Your infrastructure, your data
Fully self-hosted. No SaaS dependency, no third party in your TLS path, no per-request cloud bill — and no lock-in: the output is plain, standard nginx configuration and PEM certificates you can read and keep.
Run it your way: self-hosted or as a managed service
Same platform, two ways to get it. And one principle that holds in both: your visitors' traffic is served by nginx on your infrastructure — with on-prem nodes it never leaves the customer site; the control plane only renders config and issues certificates.
Self-hosted
Maximum sovereignty — runs entirely on your infrastructure.
- Deployed on your servers (Docker Compose), in your network
- Full data sovereignty: platform, databases and TLS keys stay in-house
- The nginx sidecar serves ports 80/443 and your stream ports
- Guided installation and onboarding by us
- Updates delivered via your private Git remote
- Optional support & maintenance contract
Managed SaaS
We run the control plane for you — you run the proxies.
- Fully hosted and operated for you — we run the platform
- Updates, monitoring and platform backups included
- Deploy on-prem nodes so traffic is served locally at each site
- Per-company isolation and white-label branding as always
- Start in days, scale per customer
- Migration path to self-hosted at any time — no lock-in
Starter
For getting started: one team, first customers, all features included.
Professional
For growing MSPs: more customers, more domains, same control plane.
Enterprise
Custom volume, custom SLAs — let's talk about your environment.
Licensing is based on the number of managed hosts — the proxy hosts configured across all your companies — and applies to both editions. Enforcement is warn-only: nothing is ever blocked. Not sure which fits? We'll figure it out together in the demo — switching later is always possible.
Frequently asked questions
What exactly does it manage?
Your nginx reverse-proxy configuration: proxy hosts (domain → upstream, with TLS, HSTS, HTTP/2, WebSockets, caching), redirects, TCP/UDP streams, access lists and TLS certificates. From those records the worker renders nginx config files and the sidecar reloads them safely — the app steers nginx, it doesn't replace it.
How are certificates issued and renewed?
Via Let's Encrypt / ACME — requested automatically once a host has
its domains and renewed before expiry. HTTP-01 is served by the
built-in sidecar; DNS-01 runs through the bundled lego
binary (200+ DNS providers) for wildcards or closed port 80. ZeroSSL,
Google Trust Services and Buypass are supported too (with EAB), or you
can upload your own PEM certificate.
Do I still control the raw nginx config?
Yes. Add a custom nginx snippet per host, or switch a host to full
manual mode and write the vhost verbatim. Either way
every change is validated with nginx -t before it goes
live, so a typo can't take the proxy down.
Can I run nginx at the customer site?
Yes — enable an on-prem node. A one-line installer
(curl … | sudo bash, Ubuntu/Debian, no Docker) sets up
native nginx plus a systemd poller that pulls its configuration over
HTTPS and reloads locally. No inbound ports are opened at the customer;
the node phones home outbound. Certificates are issued centrally and
shipped in the bundle.
What about wildcard certificates?
Use DNS-01: add your DNS provider's credentials (200+ providers via
lego) under DNS → credentials, assign them to the
certificate, and NCP completes the DNS challenge and renewals
automatically — no port 80 required.
Can my team sign in with Active Directory?
Yes — LDAP / Active Directory sign-in with automatic user provisioning, an optional required group, LDAPS with your internal CA, plus optional TOTP two-factor authentication and passkeys. Local accounts keep working in parallel, so you can never lock yourself out.
Is it really multi-tenant?
Yes. Each company gets its own PostgreSQL database (provisioned automatically); proxy hosts, certificates, DNS credentials, access lists, streams and the audit log are physically separated. Team members only see the companies they are assigned to, with per-company roles and LDAP-synced groups.
How do I get it?
Two ways: as a self-hosted installation on your own infrastructure (Docker Compose), or as a managed SaaS where we operate the control plane for you. Book a demo and we'll walk you through the platform and the onboarding.
Book your demo
Pick a slot that suits you — we'll walk you through the platform with your use cases: your domains, your certificates, your customer structure.
Booking window doesn't open? Open the booking page · Prefer e-mail? info@nginxcontrolplane.com
Or send us a message
Questions about features, sizing or onboarding — we usually reply within one business day.