A modern, security-focused reverse proxy manager built on top of Nginx — with a clean web UI, advanced TLS management, and built-in protection features.
Caution
Migration from NPMplus required.
- Update your
compose.yamlto useghcr.io/shedowe19/shieldpm:develop - Data now lives at
/data/shieldpm(auto-migrated from/data/npmpluson first start) - Switched from Alpine to Debian Trixie — use Debian package names (e.g.
php8.2-curlinstead ofphp82-curl) - Downgrading is not possible — back up your data before upgrading
# 1. Download config
curl -o compose.yaml https://raw.githubusercontent.com/shedowe19/ShieldPM/refs/heads/develop/compose.yaml
# 2. Set your timezone and ACME email in compose.yaml, then start
docker compose up -dOpen the admin UI at https://<your-ip>:81 (self-signed certificate — accept the browser warning on first visit).
First login: There are no default credentials — the Setup Wizard creates your admin account on first visit. Automated deployments can set INITIAL_ADMIN_EMAIL and INITIAL_ADMIN_PASSWORD instead.
GeoIP Country, City, and ASN databases are prepared from the latest GeoLite.mmdb release before services start, then checked again on every start. No MaxMind credentials are required. Set GEOIP_AUTO_UPDATE=false for offline or custom databases; enable NGINX_LOAD_GEOIP2_MODULE=true to use country and ASN lookups. See GeoIP setup and startup failures.
- Reverse Proxy — Manage Nginx hosts, redirects, and streams from a clean UI
- SSL/TLS — Automatic Let's Encrypt certificates with HTTP/2 and HTTP/3 (QUIC) support
- WAF — ModSecurity with OWASP CoreRuleSet + OpenAppSec integration
- CrowdSec IPS — Community-powered intrusion prevention
- IP Firewall — Per-host IPv4/IPv6/CIDR lists, TXT/HTTPS imports, optional ASN and country rules, and a page explaining blocked requests
- Cloudflare Tunnels — Create and manage Zero Trust tunnels directly from the UI
- PHP-FPM — Optional PHP 8.2 / 8.3 / 8.4 integration
- Analytics — Built-in GoAccess dashboard on port
:91 - Auth Requests — SSO support via Authentik and similar providers
- Multi-DB — SQLite (default), MySQL/MariaDB, or PostgreSQL
- i18n — UI available in English, German, Spanish, Italian, and more
Full setup guides, configuration options, and advanced usage are in the Wiki.
Die interne Entwicklerdokumentation für Entwickler und AI-Agenten befindet sich unter:
# Required toolchain: Node.js 26+ and Yarn Classic 1.22.22
npm install --global --allow-scripts=yarn yarn@1.22.22
# Frontend
cd frontend && yarn install --frozen-lockfile && yarn dev
# Backend
cd ../backend && yarn install --frozen-lockfile && yarn dev
# Verification
cd ../backend && yarn test --run
cd ../frontend && yarn test --run && yarn buildSpecial thanks to @ZoeyVid for the foundational work on NPMplus, and to all contributors who help make ShieldPM better.
Questions or ideas? Head over to GitHub Discussions — we'd love to hear from you.
Maintained with ❤️ by the ShieldPM Contributors.