Schalter: NGINX Proxy Manager abschaltbar (externer NGINX)

Wer die HTTPS-Terminierung bereits mit einem NGINX auf einem anderen
System loest, braucht den Container nicht. NPM_ENABLED=off sorgt dafuer,
dass er gar nicht erst angelegt wird: compose bekommt dann nur noch den
Checkmk-Dienst genannt.

    NPM_ENABLED=off  ->  compose up -d checkmk
    NPM_ENABLED=on   ->  compose up -d checkmk nginx-proxy-manager

Das gilt auch fuer "pull" - abgeschaltet wird nicht einmal das Image
geladen. Beim Abschalten wird ein vorhandener Container gestoppt UND
entfernt, damit ihn weder eine Restart-Regel noch ein Reboot wieder
hochzieht.

Die Daten bleiben in jedem Fall erhalten: Konfiguration, Datenbank und
Zertifikate liegen in den Bind-Mounts unter ./data/npm, nicht im
Container. Vor dem Abschalten werden beide Verzeichnisse mit Groesse
angezeigt; beim Einschalten wird die vorhandene Konfiguration samt
Zertifikaten unveraendert wieder aufgenommen.

Bedienung:
  - Menuepunkt "Proxy Manager betreiben" unter Einstellungen -> npm
  - cmk-manage.sh npm-enable [on|off]   (ohne Argument: Stand anzeigen)
  - config set NPM_ENABLED off

"npm-enable off" gibt gleich die noetige Firewall-Regel und eine
Beispielkonfiguration fuer den externen NGINX aus - Port 5000 muss dann
fuer dessen IP erreichbar sein. Der Agent-Receiver auf Port 8000 ist
davon nicht betroffen, den sprechen die Agents ohnehin direkt an.

Damit der Schalter auch nach einem Reboot gilt, ruft die von install.sh
erzeugte systemd-Unit jetzt cmk-manage.sh auf statt compose direkt.
Bei Quadlet wird die Unit nginx-proxy-manager.container uebersprungen
und entfernt, solange der Schalter auf "off" steht.

Verifiziert mit einem compose-Stub, dass in beiden Schalterstellungen
genau die erwarteten Dienste uebergeben werden, sowie ueber das Menue.
Dokumentiert als Abschnitt 12.4 in beiden Sprachfassungen.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README_en.md

@@ -131,7 +131,7 @@ agents.
 | 80/tcp | NGINX Proxy Manager – HTTP, Let's Encrypt challenge | internet/LAN |
 | 443/tcp | NGINX Proxy Manager – HTTPS | internet/LAN |
 | 81/tcp | NGINX Proxy Manager – **admin interface** (default; changeable via [`npm-port`](#12-moving-the-admin-interface-to-a-different-port)) | admin network only! |
-| 5000/tcp | Checkmk Apache (backend) | **localhost only** – do not expose |
+| 5000/tcp | Checkmk Apache (backend) | **localhost only** – do not expose. Exception: with the Proxy Manager turned off ([12.4](#124-turning-the-proxy-manager-off-entirely-external-nginx)), open it for the external proxy's IP only |
 | 8000/tcp | Checkmk agent receiver (TLS-registered agents) | monitored hosts |
 | 6557/tcp | Livestatus (only with `CMK_LIVESTATUS_TCP=on`) | distributed sites |
 
@@ -553,6 +553,7 @@ The most important settings:
 | `CMK_LIVESTATUS_TCP` | `on` opens port 6557 for distributed monitoring |
 | `MAIL_RELAY_HOST` | SMTP relay for notifications |
 | `TZ` | time zone, e.g. `Europe/Berlin` |
+| `NPM_ENABLED` | `on`/`off` – should the Proxy Manager container run at all? See [12.4](#124-turning-the-proxy-manager-off-entirely-external-nginx) |
 | `NPM_ADMIN_PORT` | port of the Proxy Manager interface (default 81) – change only via `npm-port` or the menu |
 | `NPM_ADMIN_URL` | start page of the terminal browser; empty = derived from `NPM_ADMIN_PORT` |
 | `BACKUP_DIR` | location for backups/bundles (default `./backups`) |
@@ -1173,6 +1174,74 @@ listening on the port you want.
 > unnecessary – the environment variable will be enough. Until then, the
 > extension point is the route that needs no change to the image.
 
+### 12.4 Turning the Proxy Manager off entirely (external NGINX)
+
+If HTTPS termination is already handled elsewhere – for instance by an NGINX on
+an upstream system – the container is not needed at all. There is a switch for
+that:
+
+```bash
+sudo ./scripts/cmk-manage.sh npm-enable off    # turn off
+sudo ./scripts/cmk-manage.sh npm-enable on     # turn back on
+./scripts/cmk-manage.sh npm-enable             # show the current state
+```
+
+In the interface it is under **Einstellungen → NGINX Proxy Manager →
+"Proxy Manager betreiben"**; in `.env` it is called `NPM_ENABLED`.
+
+**What "off" means:** the container is stopped and removed, and is not created
+by `up` in the first place – `compose` is only told about the Checkmk service.
+So no image is pulled and no container is built:
+
+```
+NPM_ENABLED=off  ->  docker compose up -d checkmk
+NPM_ENABLED=on   ->  docker compose up -d checkmk nginx-proxy-manager
+```
+
+**The data stays.** Configuration, database and certificates live in the bind
+mounts `./data/npm/data` and `./data/npm/letsencrypt`, not inside the
+container. Before turning it off, the command shows both with their sizes; when
+you turn it back on, the existing configuration and certificates are picked up
+unchanged.
+
+**What to do afterwards:** the external proxy forwards to port 5000 of this
+host. That port was meant for localhost only so far and now has to be reachable
+for the proxy – as narrowly as possible:
+
+```bash
+# firewalld
+sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=<proxy-ip> port port=5000 protocol=tcp accept'
+sudo firewall-cmd --reload
+
+# ufw
+sudo ufw allow from <proxy-ip> to any port 5000 proto tcp
+```
+
+In the external NGINX:
+
+```nginx
+location / {
+    proxy_pass http://<checkmk-host>:5000;
+    proxy_set_header Host               $host;
+    proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto  $scheme;
+    client_max_body_size 0;
+    proxy_read_timeout 300s;
+}
+```
+
+`npm-enable off` prints the matching commands and this example configuration
+for you.
+
+> **The agent receiver is unaffected.** Agents talk to port 8000 of this host
+> directly, not through the proxy – so it must stay reachable for the monitored
+> systems.
+
+> **With Quadlet** ([chapter 6, option B](#option-b--podman-quadlet-podman-44-and-newer-no-compose))
+> `install.sh --quadlet` removes the `nginx-proxy-manager.container` unit while
+> the switch is `off`. If you turn it on later, simply run
+> `sudo ./install.sh --quadlet` again.
+
 ---
 
 ## 13. Firewall
@@ -1268,6 +1337,7 @@ A file chooser with directory navigation is built in.
 | `browser [--engine …]` | terminal browser in a container – operate the Proxy Manager locally |
 | `config list\|get\|set\|edit` | show and change settings in `.env` |
 | `npm-port [PORT]` | set/show the port of the Proxy Manager interface |
+| `npm-enable [on\|off]` | turn the Proxy Manager on/off (data is preserved) |
 | `cert …` | create a self-signed certificate |
 | `shell` | root shell in the Checkmk container |
 | `omd …` | any `omd` command inside the container |
@@ -1672,6 +1742,7 @@ release notes beforehand.
 | `podman-compose` not found | enable EPEL or switch to Quadlet (`./install.sh --quadlet`) |
 | `This system is not registered with an entitlement server` | RHEL without a subscription – `dnf` then supplies no packages at all. Register, mount the installation DVD as a repository, or switch to Rocky/Alma: [section 5.1](#51-unregistered-rhel-where-the-packages-come-from) |
 | `epel-release` cannot be installed | EPEL depends on Red Hat's base repositories and is no substitute for registering. Without a subscription, the Quadlet route without `podman-compose` gets you there: [chapter 6, option B](#option-b--podman-quadlet-podman-44-and-newer-no-compose) |
+| Proxy Manager container no longer starts | the switch is `off`: `cmk-manage.sh npm-enable on`. Check with `cmk-manage.sh npm-enable` |
 | Admin interface unreachable from the LAN | port 81 blocked. Move it to a free port: `cmk-manage.sh npm-port 10443` and open that in the firewall |
 | New port does not answer after `npm-port` | the Proxy Manager was not restarted: `cmk-manage.sh restart`; check the file `data/npm/data/nginx/custom/http.conf` |
 | `cmk-manage.sh` aborts with "CMK_RUNTIME … ist nicht installiert" | it now only warns and detects the runtime itself; set it cleanly with `config set CMK_RUNTIME auto` |