From 906e457fcbc3866efc5aa6082d25e2461a29e845 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Tue, 28 Jul 2026 23:01:46 +0300
Subject: [PATCH] Document the base domain proxy host in the Nginx Proxy
 Manager example

The example only covered `matrix.example.com` and the federation stream,
so people who make the playbook serve the base domain were left without a
proxy host for it. Requests for the `/.well-known/matrix/*` files on the
base domain then never reach Traefik and Nginx Proxy Manager answers with
a 404 error of its own, breaking federation and client discovery.

The nginx example already covers this by listing `example.com` in its
`server_name` directive. Serving the base domain from the Matrix server
is optional though, so the new section says so and points people whose
base domain lives elsewhere to the server delegation documentation.

Also note that a `*.example.com` wildcard certificate does not cover the
base domain itself, which is easy to get wrong when setting this up.

Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5465

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../nginx-proxy-manager/README.md             | 26 ++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/examples/reverse-proxies/nginx-proxy-manager/README.md b/examples/reverse-proxies/nginx-proxy-manager/README.md
index 99a7c42cd..db11755d7 100644
--- a/examples/reverse-proxies/nginx-proxy-manager/README.md
+++ b/examples/reverse-proxies/nginx-proxy-manager/README.md
@@ -1,7 +1,7 @@
 <!--
 SPDX-FileCopyrightText: 2024 Gouthaman Raveendran
 SPDX-FileCopyrightText: 2024 MDAD project contributors
-SPDX-FileCopyrightText: 2024 Slavi Pantaleev
+SPDX-FileCopyrightText: 2024 - 2026 Slavi Pantaleev
 SPDX-FileCopyrightText: 2024 Suguru Hirahara
 
 SPDX-License-Identifier: AGPL-3.0-or-later
@@ -60,3 +60,27 @@ SSL Certificate: matrix.example.com or *.example.com
 ```
 
 Also note, NPM would need to be configured for whatever other services you are using. For example, you would need to create additional proxy hosts for `element.example.com` or `jitsi.example.com`, which would use the forwarding port `81`.
+
+## Serving the base domain (optional)
+
+The configuration above only covers `matrix.example.com`. Many people serve their base domain (`example.com`) from somewhere else entirely, in which case there is nothing more to do here. Arrange [server delegation](../../../docs/howto-server-delegation.md) on whichever server hosts the base domain instead.
+
+If you have made this Matrix server responsible for the base domain as well (by [serving the base domain](../../../docs/configuring-playbook-base-domain-serving.md) with `matrix_static_files_container_labels_base_domain_enabled: true`), then the base domain needs a proxy host of its own. Without it, requests for `https://example.com/.well-known/matrix/server` and `https://example.com/.well-known/matrix/client` never reach Traefik, NPM answers with a `404` error of its own, and both [Federation Server Discovery](../../../docs/configuring-well-known.md#federation-server-discovery) and [Client-Server discovery](../../../docs/configuring-well-known.md#client-server-discovery) break.
+
+Add another proxy host, this time for the base domain:
+
+```md
+# Details
+# Base domain proxy config
+Domain Names: example.com
+Scheme: http
+Forward Hostname/IP: IP-ADDRESS-OF-YOUR-MATRIX
+Forward Port: 81
+
+# SSL
+# Note that a `*.example.com` wildcard certificate does not cover the base domain itself,
+# so the certificate you use here needs to include `example.com`
+SSL Certificate: example.com
+Force SSL: true
+HTTP/2 Support: true
+```