Pin a self-signed NPM or NPMplus certificate
NPMplus serves its admin port with a self-signed certificate unless DEFAULT_CERT_ID names a trusted one, and plenty of NPM installs sit behind one too. The Nginx Proxy Manager / NPMplus source can now pin it, the same way the Proxmox VE source does:
- Add the source with its
https://URL and press Test connection. Homedex refuses the certificate before sending the password and shows the SHA-256 fingerprint the server presented. - Compare it with the certificate on the server (NPMplus keeps its self-signed one at
/data/tls/dummycert.pem;openssl x509 -in dummycert.pem -noout -fingerprint -sha256prints it), paste it into Certificate fingerprint, and test again.
With a pin, Homedex trusts exactly that certificate for the login and every read, and nothing else. If the certificate changes, the source fails and shows the new fingerprint instead of trusting it. A pin is refused on an http:// URL, where the password would travel in the clear. Pin only a certificate that stays put; a Let's Encrypt certificate renews every few months, so leave the field empty for one.
Under the hood
Certificate pinning is now one shared piece used by both Proxmox VE and NPM, so any future connector for a self-signed service can use it too. Proxmox behaves exactly as before.
Upgrading
No migrations. docker compose pull then docker compose up -d. The one-file install follows the 0.2 line, so it picks this up on its own.
Container images are published to ghcr.io/harshshah0203/homedex.