SWAG
Nginx reverse proxy with automated TLS certificates and fail2ban
3.7k stars 277 forks last commit first released GPL-3.0
Actively maintained
Last commit 25 Jul 2026.
SWAG (Secure Web Application Gateway) is a LinuxServer.io-maintained container image that provides an Nginx web server and reverse proxy with automated TLS certificate issuance and renewal via an embedded ACME client. It is commonly used as a front door for self-hosted applications, handling HTTPS termination and reusable proxy configurations.
Key Features
- Nginx web server and reverse proxy for routing multiple apps behind one domain
- Automated certificate issuance and renewal using Certbot (ACME) with Let’s Encrypt or ZeroSSL
- Supports HTTP and DNS-based validation, including wildcard certificates (via DNS plugins)
- Includes preset reverse proxy configuration templates for many popular services
- Optional PHP support for serving dynamic web content
- Built-in fail2ban for intrusion prevention (with optional firewall rule integration)
Use Cases
- Expose multiple self-hosted services securely over HTTPS with subdomains
- Terminate TLS centrally and share generated certificates with other containers
- Host a small web site or landing page alongside reverse-proxied applications
Limitations and Considerations
- Certificate issuance depends on correct inbound port forwarding (HTTP validation) or supported DNS provider credentials (DNS validation)
- Some Certbot DNS plugins may require additional packages/mods if not included in the base image
SWAG is a practical choice when you want a repeatable, containerized Nginx reverse proxy setup with integrated ACME automation and extra security tooling. It fits especially well in Docker-based homelabs that rely on subdomains and standardized proxy templates.
Categories:
Tags:
Tech Stack:
Similar to SWAG
Nginx Proxy Manager
Web UI to manage Nginx reverse proxy hosts and SSL certificates
Nginx Proxy Manager is a web-based admin panel for managing Nginx reverse proxy hosts, redirects, streams, and Let’s Encrypt SSL certificates via Docker.
GoDoxy
Reverse proxy and container orchestrator for self-hosters
High-performance reverse proxy and container orchestrator with Web UI, automatic Docker/Podman route discovery, idle-sleep, access control, and automated Let's Encrypt support.
Wiredoor
Ingress-as-a-service to expose private services via WireGuard and NGINX
Self-hosted ingress platform that exposes internal HTTP/TCP services to the internet through reverse WireGuard tunnels, with NGINX routing and automatic TLS certificates.
Nginx UI
Web UI for managing Nginx configurations, certificates, and logs
Self-hosted web interface to manage Nginx configs, reload safely, issue Let’s Encrypt certificates, view logs, monitor server stats, and manage multiple nodes.
NetGoat
Self-hostable reverse proxy and traffic manager with WAF features
NetGoat is a self-hostable reverse proxy and traffic management platform offering Cloudflare-like features such as TLS termination, rate limiting, WAF-style filtering, and dashboards.
Self-Hosted Gateway
Docker-native reverse proxy over WireGuard to expose local services
Automates Reverse Proxy-over-VPN (RPoVPN) using WireGuard, Caddy and NGINX to expose Docker Compose services to the public Internet with automated TLS.