When hosting Dockerized or standalone web apps on your Synology NAS, you can expose them through a reverse-proxy rule so users can reach
https://arp-ict.nl/webapp
instead of a port-specific URL such as https://arp-ict.nl:8081.
Map incoming HTTPS traffic on /webapp to the local service:
https://arp-ict.nl/webapp → http://127.0.0.1:8081
curl -I http://127.0.0.1:8081
Open Control Panel → Login Portal → Advanced → Reverse Proxy → Create
and fill out:
| Field | Value |
|---|---|
| Description | WebApp |
| Source Protocol | HTTPS |
| Source Hostname | arp-ict.nl |
| Source Port | 443 |
| Source Path | /webapp |
| Destination Protocol | HTTP |
| Destination Hostname | 127.0.0.1 |
| Destination Port | 8081 |
Leave Destination Path empty to avoid duplicate paths.
Optional checkboxes:
Within the same rule → Custom Header → Add
| Key | Value |
|---|---|
Host |
$host |
X-Forwarded-For |
$remote_addr |
X-Forwarded-Proto |
https |
These preserve the original client information and prevent redirect loops.
Visit:
https://arp-ict.nl/webapp
The app should load through HTTPS with no port number visible.
Router forwarding remains limited to port 443.
You can expose the same container as:
https://webapp.arp-ict.nl
DSM → Reverse Proxy
| Source Hostname | Destination |
|---|---|
webapp.arp-ict.nl |
127.0.0.1:8081 |
In Cloudflare DNS
| Type | Name | Target | Proxy |
|---|---|---|---|
| CNAME | webapp |
@ |
DNS only |
| Concern | Action |
|---|---|
| Limit access | DSM Firewall → allow only LAN subnet (e.g. 192.168.1.0/24) |
| Authentication | Protect via DSM Access Control or app-level login |
| Logs | Monitor /var/log/nginx/ for reverse-proxy requests |
| TLS | Reuse existing GoDaddy/Cloudflare certificate for arp-ict.nl |
Result:
Every internal or external user can reach https://arp-ict.nl/webapp securely, without exposing any extra ports.