The Old Way: nginx + DNS Wildcards#

Here’s what I used to do:

1. Configure AdGuard Home to resolve all *.navi.local subdomains to my Mac mini’s IP (192.168.0.115)
2. Set up nginx to listen on port 80 and proxy requests based on the subdomain
3. Add a new nginx location block for each service

For example, to access AdGuard Home at adguard.navi.local, I had an nginx config like this:

1
server {
2
    listen 80;
3
    server_name adguard.navi.local;
4

5
    location / {
6
        proxy_pass http://localhost:3000;
7
        proxy_set_header Host $host;
8
        proxy_set_header X-Real-IP $remote_addr;
9
    }
10
}

Every. Single. Service. Needed this boilerplate.

And I was stuck with HTTP. Getting HTTPS working with self-signed certs was more hassle than it was worth for a local setup.

Enter Portless#

Portless is a zero-config local domain proxy. You run it once, register your services with a single command, and get HTTPS local domains automatically.

No nginx configs. No certificate management. No DNS trickering beyond the initial setup.

Setting Up Portless on My Mac Mini#

The entire setup took me about 5 minutes.

1
npm install -g portless

1
portless service install --lan --ip 192.168.0.115

1
sudo code /Library/LaunchDaemons/sh.portless.proxy.plist

1
<key>ProgramArguments</key>
2
<array>
3
  <string>/path/to/node</string>
4
  <string>/path/to/portless</string>
5
  <string>proxy</string>
6
  <string>start</string>
7
  <string>--foreground</string>
8
  <string>--port</string>
9
  <string>443</string>
10
  <string>--https</string>
11
  <string>--skip-trust</string>
12
  <string>--lan</string>
13
  <string>--ip</string>
14
  <string>192.168.0.115</string>
15
</array>

1
# Stop the service
2
sudo launchctl bootout system/sh.portless.proxy
3

4
# Verify it's stopped
5
sudo launchctl list | grep portless
6

7
# Start it with the updated configuration
8
sudo launchctl bootstrap system /Library/LaunchDaemons/sh.portless.proxy.plist

1
portless alias adguard 3210

1
Alias registered: adguard.local -> 127.0.0.1:3210

What I Get Now#

After running those commands, I can access AdGuard Home from any device on my network:

1
https://adguard.local

HTTPS works. Portless automatically generates certificates from its own CA. No browser warnings.

Want to add another service? One command:

1
portless alias jellyfin 8096
2
portless alias homeassistant 8123
3
portless alias vscode 8080

Now I have:

• https://jellyfin.local
• https://homeassistant.local
• https://vscode.local

All with HTTPS. All accessible across my network using .local domains that work seamlessly via mDNS.

Checking What’s Running#

To see all registered services:

1
portless list

Output:

1
adguard → https://adguard.local
2
jellyfin → https://jellyfin.local
3
homeassistant → https://homeassistant.local
4
vscode → https://vscode.local

Clean. Simple. Exactly what you need to know.

Why This Is Better#

Compared to my old nginx setup:

Before:

• Edit nginx config file
• Test config for syntax errors
• Reload nginx service
• Hope nothing broke
• Still stuck with HTTP or deal with self-signed cert warnings

Now:

• portless alias name port
• Done

The HTTPS part alone is worth it. I don’t have to deal with browser warnings, and I don’t have to manually install root certificates on every device.

And because everything uses the .local domain, I don’t need the DNS wildcard setup anymore. Portless handles its own .local domain resolution via mDNS (Bonjour on macOS).

One Caveat

If you want devices outside your local network to access these services (via VPN, for example), you’ll still need to configure your DNS accordingly. Portless focuses on local network access, which is exactly what I needed.

When You Should Use Portless#

Portless is perfect if you:

• Run multiple services on a local server (Mac mini, Raspberry Pi, old laptop)
• Want clean domain names instead of remembering ports
• Want HTTPS on your local network without certificate headaches
• Prefer CLI tools over editing config files

It’s not trying to replace production reverse proxies. It’s solving the local development and home lab problem, and it does that exceptionally well.

My Current Setup#

My Mac mini now runs:

• AdGuard Home (DNS filtering)
• Jellyfin (media server)
• VS Code Server (remote development)
• Home Assistant (smart home hub)
• A few experimental web apps

All accessible via clean HTTPS domains. All managed with a handful of terminal commands.

I still use nginx at work for production deployments. But for my home server? Portless replaced an entire stack of configuration with a tool that just works.

If you’re running services on your local network and tired of managing reverse proxy configs, give Portless a shot. The LAN mode makes it especially useful for home servers that need to be accessible from multiple devices.

Bonus: Sharing the Certificate with Other Devices#

While Portless works great on the Mac mini where it’s installed, other devices on your network will see certificate warnings until they trust Portless’s CA certificate.

Instead of manually copying the certificate file to each device, I use serve to create a simple web page where any device can download it.

Install serve:

1
npm install -g serve

Then serve the Portless certificates directory:

1
serve ~/.portless

Now any device on your network can visit http://your-mac-ip:3000 and download the CA certificate. Once they install and trust it, all your .local domains will work without warnings.

This is especially handy when you have multiple laptops, phones, or tablets that need access to your services.

Resources#

• Portless Documentation
• Portless GitHub