Quick answer

Pick by how you like to configure, not by speed. Nginx Proxy Manager is the beginner pick: a point-and-click web UI over nginx. Caddy is config-as-code with the simplest automatic HTTPS in two lines. Traefik auto-discovers Docker containers from labels but has the steepest learning curve. All three are free, open source, and faster than any homelab needs.

By LK Wood IV · Published 2026-06-17 · Updated 2026-07-13 · ~9 min read · St. Louis County, MO

A reverse proxy is the front door to a homelab. It puts clean hostnames and automatic HTTPS in front of all your services, so jellyfin.home.lab just works instead of everyone memorizing 192.168.1.14:8096. Three names dominate the choice in 2026: Caddy, Nginx Proxy Manager (NPM), and Traefik. They’re all free, all open source, and all solve the same problem, but they have genuinely different personalities, and picking well is mostly about matching one to how you like to work. Everything below is verified against each project’s own repos and docs, with the community’s real-world consensus folded in.

Comparison matrix of Caddy, Nginx Proxy Manager, and Traefik homelab reverse proxies on license, interface, automatic HTTPS, Docker auto-discovery, learning curve, and best-fit use: Caddy is Apache 2.0 config-as-code with the most automatic HTTPS, NPM is the MIT web-GUI beginner pick with no Docker auto-discovery, and Traefik is MIT open-core with native Docker auto-discovery and the steepest learning curve.

The choice in one screen

Skip to the section that fits you, or read the whole thing. Here is the shape of the decision before the details.

CaddyNginx Proxy ManagerTraefik
LicenseApache 2.0MITMIT (open-core add-ons)
InterfaceCaddyfile (config-as-code)Web GUIConfig + Docker labels
Auto HTTPSMost automatic (LE + ZeroSSL)Per-host, via UICert resolvers (config)
Docker auto-discoveryPlugin onlyNoYes (native)
Learning curveModerateLowestSteepest
Written inGo (single binary)nginx + OpenResty + Node UI + DBGo (single binary)
GitHub stars (approx)~74k~33.5k~64k
Latest stable (mid-2026)2.11.x2.15.x3.7.x
Best forConfig-as-code, easiest TLSBeginners, GUI loversDocker/K8s dynamic labs

Star counts and versions are current as of July 2026 and drift over time; check each repo for today’s numbers.

The single most useful way to feel the difference is to watch each one do the exact same job. Here is what it takes to put HTTPS in front of one service in all three:

The same service, three ways
One job — reverse-proxy app.example.com to a container at 192.168.1.10:8080 with automatic HTTPS. Three completely different surfaces. This contrast, not benchmarks, is the actual choice.
Nginx Proxy Manager
point & click
Domainapp.example.com
Forward host192.168.1.10
Forward port8080
✓SSL tab → Request new certificate
~6 clicks · no file · no restart
Caddy
config as code
app.example.com { reverse_proxy 192.168.1.10:8080 }
3 lines · 1 file · HTTPS is automatic
Traefik
label discovery
labels: - traefik.enable=true - traefik.http.routers.app.rule= Host(`app.example.com`) - ...tls.certresolver=le
plus a one-time static config (entrypoints, cert resolver) that every service then reuses.
3+ labels per service · auto-routes on deploy
All three arrive at the identical HTTPS front door. NPM asks you to fill a form, Caddy asks you to write two lines, Traefik asks you to label a container. Pick the surface that matches how you already like to work — that, far more than speed, is what makes a proxy feel right six months later.
techfuelhq.com · minimal working config per tool, verified against each project's docs

Caddy: the simplest automatic HTTPS

Caddy is a Go-based web server and reverse proxy under Apache 2.0, fully open source with no paid tier, shipped as a single static binary (~74k GitHub stars, latest 2.11.x). Its headline feature is automatic HTTPS: the moment Caddy knows a hostname, it obtains and renews certificates in the background, using Let’s Encrypt and ZeroSSL with automatic failover, redirects HTTP to HTTPS, and even issues self-signed certs from an internal CA for local names. A working HTTPS reverse proxy is about three lines of Caddyfile, which is exactly why so many people who “just wanted it to work” ended up here. As one r/selfhosted user put it, it’s “brain dead easy… a reverse proxy in as little as 4 lines and 2 of them are the curly brackets.”

The trade-offs: there’s no built-in GUI (config is a text file), and Caddy core doesn’t natively auto-discover Docker containers. The third-party caddy-docker-proxy plugin adds that if you want it, and notably a Caddy maintainer confirms it’s “supported and a recommendation of the Caddy maintainers.” One bit of history worth knowing: Caddy briefly sold commercial licenses in 2017-2019, but permanently moved everything to open source under Apache 2.0 in October 2019, so today it’s unambiguously free. It’s the most-starred of the three and actively maintained.

Pick Caddy if you like config-as-code, want the least-fuss automatic HTTPS on the market, and don’t need a GUI.

Nginx Proxy Manager: the beginner’s favorite

NPM is a web GUI wrapped around nginx + OpenResty + Certbot, distributed as a Docker image, under the MIT license (verified against its raw LICENSE file; despite some secondhand claims that it’s GPL, it is not). You add proxy hosts in a browser, click to request a Let’s Encrypt cert, and it generates the nginx config for you. It has the lowest learning curve of the three by universal consensus, which is why it’s the standard “start here” recommendation, and it currently sits around 33.5k stars on the 2.15.x line. If you go this route, our Nginx Proxy Manager homelab setup guide walks the full install and wildcard-SSL flow.

Two honest caveats. First, its state lives in a database and generated config rather than portable code, so it isn’t naturally version-controlled; keep your own backups. Second, because NPM bundles its own stack (nginx/OpenResty, Certbot, a Node.js UI, and a database), that bundle can lag upstream security fixes, and there have been notable CVEs. The most-cited is CVE-2025-50579 (CVSS 5.3), a CORS-misconfiguration flaw reported against v2.12.3 that lets a malicious website steal an admin’s JWT token and take over the panel; it was still open on the project tracker into the 2.15.x line. The fix is discipline: keep it updated and never expose the admin UI publicly. Recent releases added TOTP two-factor auth and more DNS challenge plugins, which help.

Pick NPM if you want a point-and-click workflow for a handful of services and would rather not touch config files.

Traefik: dynamic discovery for Docker labs

Traefik (MIT, ~64k stars, latest 3.7.x) is a modern, dynamic reverse proxy built for containers, shipped as a single Go binary. Its defining trait: it auto-discovers services and builds routes at runtime by reading provider APIs. Add a few Docker labels to a container and Traefik creates the route instantly, no restart, and it does the same for Kubernetes (including the Gateway API), Consul, Nomad, and more. This is the capability NPM lacks entirely and Caddy needs a plugin for.

The cost is complexity, and the community is split on how much. Traefik divides configuration into static (startup: entrypoints, providers, certificate resolvers) and dynamic (hot-reloaded routers, services, middlewares), and you need to understand that model plus “label discipline.” Some homelabbers find it “ridiculously convoluted… six labels on every container,” while others counter that with a good base config you can get down to “just traefik.enable=true” plus a single router rule. Either way it’s the steepest learning curve here. On licensing, Traefik runs open-core: the proxy is fully free, including its OWASP Coraza WAF integration added in v3, while Traefik Labs sells optional Hub/Enterprise API-management tiers you’ll never need at home. Traefik v3 (GA 2024) also brought HTTP/3, WebAssembly middleware plugins, OpenTelemetry, and a newer experimental FastProxy engine aimed at closing its throughput gap.

Pick Traefik if your lab is Docker- or Kubernetes-heavy, you want services to register themselves as you deploy them, and you’re comfortable with the configuration model.

Which should you run?

The most useful framing from the 2026 community: people rarely pick the wrong proxy; they pick one whose operating style doesn’t match their skill level or their stack. So match it to yourself:

  • Beginner, few services, wants a GUI → Nginx Proxy Manager. Start here.
  • Wants config-as-code and the easiest automatic HTTPS, no GUI → Caddy.
  • Docker/Kubernetes-heavy, wants dynamic auto-registration → Traefik.

A common growth path is to learn on NPM, then migrate to Caddy (for config-as-code) or Traefik (for Docker discovery) as the lab matures, and that migration is easy because you can always read the generated config and copy it out. If you’re building out that Docker layer, the Docker Compose starter stack guide pairs naturally, and if you’re also choosing how to manage those containers, see Komodo vs Portainer vs Dockge.

On performance: the question everyone asks and no one needs

“Which is fastest?” is the first thing people ask and the last thing that should decide it. Real, reproducible 2026 community benchmarks do exist now, and they’re consistent about the order: nginx (the engine under NPM) leads, Caddy is a close second, and Traefik trails on raw requests-per-second and P95 latency. But look at the actual magnitudes against what a homelab does:

The performance question, settled
Roughly what each handles on a small box, from representative 2026 community benchmarks (order is consistent across tests; exact numbers vary by hardware). The bar that matters is the one at the bottom.
nginx / NPM engine~80,000 req/s
Caddy~60,000 req/s
Traefik~45,000 req/s
What a busy homelab actually needs~5-50 req/s
Yes — that sliver. Every option here clears your real load by three to four orders of magnitude.
So "which is fastest" has a real answer — nginx, then Caddy, then Traefik — and it does not matter to you. At homelab scale the proxy is never the bottleneck; your disk, your network, or the backend service is. As the top-voted reply on the big 2026 benchmark thread put it: you won't notice the difference "unless you're running websites with 50k visitors a minute."
techfuelhq.com · magnitudes representative, not a lab-grade benchmark; choose on config style, not throughput

You’ll sometimes see idle-RAM figures too (rough ballparks like ~40-50 MB for the single-binary Caddy and Traefik, more for NPM once you count its bundled nginx, Node UI, and database). Treat those as directional, not gospel, since methodology and versions aren’t standardized. The bottleneck in your lab will be your services, not the proxy in front of them.

Sources

Frequently asked questions

Which reverse proxy is easiest for a homelab beginner?
Nginx Proxy Manager (NPM), by near-universal community consensus. It’s a web GUI over nginx: you add a ‘Proxy Host’ in the browser, click to request a Let’s Encrypt certificate, and you’re done, with no config files or YAML. Caddy is the next easiest if you’re comfortable editing a short text file (its Caddyfile is famously concise), and Traefik is the steepest because of its router/middleware/provider model. Most people start on NPM and graduate to Caddy or Traefik as their lab grows.
What's the difference in how each handles automatic HTTPS?
All three automate Let’s Encrypt, but differently. Caddy is the most automatic: HTTPS turns on implicitly whenever it knows a hostname, using Let’s Encrypt and ZeroSSL with automatic failover, plus an internal CA for local names. NPM walks you through requesting and renewing a cert per host in its UI (HTTP or DNS challenge). Traefik uses ‘certificate resolvers’ defined in its static config (HTTP-01, TLS-ALPN-01, or DNS-01), which is more setup up front but fully automatic once configured.
Which reverse proxy auto-discovers Docker containers?
Traefik, and this is its defining feature. It reads Docker labels on your containers and creates routes at runtime with no restart, so a service registers itself the moment you deploy it (it does the same with Kubernetes, Consul, Nomad, and more). NPM does NOT auto-discover; you manually point each proxy host at an IP and port. Caddy doesn’t natively either, but the maintainer-endorsed caddy-docker-proxy plugin adds Traefik-style label discovery. If dynamic Docker discovery is your priority, Traefik is the natural choice.
Are Caddy, Nginx Proxy Manager, and Traefik all free and open source?
Yes, all three are free and open source. Caddy is Apache 2.0, NPM is MIT, and Traefik Proxy is MIT. Traefik follows an open-core model: the proxy is fully free (including its OWASP Coraza WAF integration), while Traefik Labs sells optional Traefik Hub and Enterprise add-ons for API management that you never need for a homelab. Caddy briefly sold commercial licenses around 2017-2019 but moved everything permanently to open source under Apache 2.0 in October 2019.
Is Nginx Proxy Manager secure enough to use?
It’s widely used and fine for most homelabs, with one caveat. Because NPM bundles its own nginx/OpenResty stack plus Certbot, a Node.js UI, and a database, that bundle can lag upstream security releases, and there have been notable CVEs. The most cited is CVE-2025-50579 (CVSS 5.3), a CORS misconfiguration reported against v2.12.3 that lets a malicious site steal JWT admin tokens; it was still open on the tracker into the 2.15.x line. Keep NPM updated, never expose its admin UI to the internet, and follow its releases. Caddy and Traefik, being single self-contained binaries, tend to ship security fixes more directly.
Which reverse proxy is fastest: Caddy, nginx, or Traefik?
In reproducible 2026 community benchmarks, nginx (the engine under NPM) is fastest, Caddy lands a close second, and Traefik trails on raw requests-per-second and P95 latency. But the numbers are enormous for all three, roughly 45,000 to 80,000 requests per second on a small box, while a busy homelab sees maybe a few dozen. The honest answer, and the top-voted one in every community thread, is that the proxy is never your bottleneck at home; your disk, network, or the backend service is. Choose on configuration style, not throughput.
Is Traefik better than Nginx Proxy Manager?
Neither is ‘better’ in the abstract; they solve the problem for different people. Traefik is better if your lab is Docker- or Kubernetes-heavy and you want services to register themselves from labels the moment you deploy them, and you’re comfortable with a static/dynamic config model. NPM is better if you want a point-and-click web UI, don’t want to touch config files, and are running a manageable set of services. Traefik trades a steeper learning curve for dynamic power; NPM trades dynamic discovery for approachability.
What is better for a homelab, Caddy or nginx?
For most self-hosters, Caddy. Raw nginx gives you total control and slightly higher throughput, but you write and maintain verbose config by hand and bolt on Certbot for TLS. Caddy gets you automatic HTTPS out of the box and a two-line reverse proxy, which is why so many homelabbers switch to it. Choose raw nginx if you specifically want its ecosystem, maximum tunability, or you’re already fluent in it; choose Caddy if you want the simplest path to a working HTTPS proxy. (Nginx Proxy Manager is a third option: nginx’s engine with a GUI on top.)

Evidence ledger

Last updated
Methodology
This homelab guide was written and edited by Lowell K. Wood IV in St. Louis County, MO. Specs, prices, commands, and version numbers are drawn from the official vendor, reseller, and project documentation current on the date above, and were verified before publishing. First-person hardware claims appear only where the article shows a verifiable artifact — a photo, receipt, or measurement — or links to the TechFuelHQ Open Bench Datasets. Every fact is human-verified against its cited source before publishing; AI assists with first-draft structure and source-gathering, not with the verdict. Full editorial standard: methodology.
Update log
  • 2026-07-13 — Last reviewed and updated.
Corrections
Spotted an error or stale price? Email hello@techfuelhq.com. Confirmed corrections are added to the update log above.

About the author

Written by Lowell K. Wood IV. Lowell builds and runs TechFuelHQ from St. Louis, Missouri, pairing thirteen-plus years of hands-on homelab, PC, server, and networking experience with cited third-party testing and first-party benchmarks on the gear he still runs. He also works ground EMS as a Nationally Registered Paramedic (NREMT).