2021/04/22

Adding a reverse proxy for the Plex web UI in nginx is a little harder than just passing all its requests to port 3200. Luckily, with just one snippet of nginx configuration, we can reverse proxy Plex easily, even with authentication. My configuration allows you to run Plex from within a folder (e.g. your-domain.net/plex), so you don't need to add a special subdomain just to access Plex.

Prerequisites

• an installation of Plex
• an installation of nginx

Setting up the reverse proxy

In your preferred server block, add the following location block. I will go over the most important lines to explain why they are included.

location /plex/ {
    rewrite /plex(/.*) $1 break;

    proxy_pass http://localhost:3200;
    proxy_http_version 1.1;
    proxy_set_header Accept-Encoding "";
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $http_host;
    proxy_cache_bypass $http_upgrade;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_redirect off;

    sub_filter '/web/' '/plex/web/';
    sub_filter_types *;
    sub_filter_once off;
}

• rewrite /plex(/.*) $1 break; makes sure that the "/plex" part of the URL doesn't get fed to Plex's web server (it expects URLs to start at the root).
• proxy_pass is just a normal reverse proxy entry. I assume that you're running Plex on the same machine as nginx. If not, change localhost to the IP of your Plex server.
• sub_filter entries have been added because Plex actually hardcodes some paths in the DOM to the webroot! This means that the browser will try to load resources from /web/ instead of /plex/web, effectively reversing our reverse proxy.

Setting up Plex

If you restart your nginx service and try to visit your new Plex URL, you might get the message that you need to login. If you want to be able to access your Plex server without authentication, even if plex.tv goes down (which it often does), enter your local IP range (e.g. 192.168.1.0/24) in the Plex settings under Network > List of IP addresses and networks that are allowed without auth. This could mean, however, that everyone who's able to access your reverse proxy url will be able to access your Plex server in this way, since Plex only sees "local" requests (I could be wrong, though -- I haven't tested this). You might also need to enter your server's new URL in the Plex settings under Network > Custom server access URLs.