If you’ve read the previous post about building a production-grade homelab with Kubernetes and GitOps, you know the stack runs Traefik as the cluster ingress controller, routing every internal service through wildcard TLS and managing it all as code. What that post didn’t mention is that a second reverse proxy was also running alongside it — Nginx Proxy Manager, sitting as a Docker container on TrueNAS, handling a separate handful of services.
That was the weakest link in the whole setup. This is the short version of how it got fixed.
The Problem: Two Proxies, One Point of Failure
Nginx Proxy Manager made sense when it was first set up — clean UI, automatic Let’s Encrypt certificates, and already available as a TrueNAS app. For a handful of services like Plex, Uptime Kuma, the TrueNAS web UI, and Nexus, it worked fine.
The issue wasn’t functionality, it was architecture. TrueNAS is a single point of failure: no clustering, no replicas, no high availability. If TrueNAS goes down, storage goes with it — and so does every service sitting behind that proxy. Meanwhile, Traefik was already running highly available across six Kubernetes nodes, managing TLS automatically and entirely as version-controlled YAML.
Running two separate proxies also meant a constant small decision every time a new service got added: which one does this go behind? That’s friction that compounds, and it’s the kind of inconsistency that makes things easy to lose track of.
The fix was obvious — consolidate everything onto Traefik and retire Nginx Proxy Manager.
How the Migration Worked
Before writing any new configuration, the existing Nginx Proxy Manager setup was exported in full — every proxied service, its backend, and any special handling it needed — so nothing would get missed or have to be reverse-engineered from memory. From there, each one was translated into the Traefik equivalent and added to the same GitOps-managed configuration that already ran the rest of the cluster’s ingress.
A couple of services that were duplicates or specific to the old tool itself were simply dropped along the way rather than migrated. Everything else — TLS handling, header rewriting, WebSocket support, and routing to services running outside the cluster on the network — has a direct equivalent in Traefik, so the migration was mostly mechanical translation rather than a redesign.
The whole thing was rolled out the same way every other change to the cluster is: as a pull request to a Git repository, deployed automatically by the CI/CD pipeline once merged. No manual UI clicking, no one-off changes made directly against a running system.
The Result
What used to be split across two tools with two very different failure modes is now a single ingress controller managing everything, with TLS certificates issued and renewed automatically. Nginx Proxy Manager and its TrueNAS dependency are retired.
The bigger win isn’t really about Traefik versus Nginx Proxy Manager specifically — it’s that there’s now exactly one place to add or change how a service is exposed, and that change goes through the same version-controlled, reviewable process as everything else in the homelab. No more deciding which proxy something belongs behind, and nothing left depending on a single box that was never meant to be a point of failure for the whole network.
Jeremy Blackburn is a systems and infrastructure engineer and principal of Initech Advising LLC. He helps organizations modernize infrastructure and build reliable platforms at scale.