All Tools View Categories About Contact Privacy

Nginx Reverse Proxy Config Generator

Generate a complete proxy_pass server block - SSL, WebSockets, forwarded headers and timeout tuning included.

Runs entirely in your browser - nothing is uploaded and no cloud connection is made.
Your generated config will appear here.
0
directives
0
blocks
0
lines

About Nginx Reverse Proxy Config Generator

Putting nginx in front of an application is the most common way to serve it on ports 80 and 443, terminate TLS, and hide process management behind a stable address - yet the server block that does the job is almost always copied from an old blog post, half understood, and quietly wrong somewhere: missing X-Forwarded-For, a proxy_pass trailing-slash surprise, no Upgrade headers for WebSockets, or upload limits that reject perfectly legitimate requests. Nginx Reverse Proxy Config Generator replaces that copy-paste ritual with a short form: enter your public domain and backend address, flip the switches you need, and get a complete, consistently formatted server block built from current best practice.

The core of the output is a location block wired for proxying. Every generated config sets Host, X-Real-IP, X-Forwarded-For and X-Forwarded-Proto headers, because virtually every framework behind a proxy - Express, Django, Rails, Spring - depends on those to reconstruct original client IPs and scheme information; omitting them breaks rate limiters, logging and absolute-URL generation in subtle ways. proxy_http_version 1.1 is included so keepalive behaviour is predictable, and enabling the WebSocket option adds the $http_upgrade/Connection header pair that lets the handshake pass through unchanged.

SSL mode produces the canonical two-block layout rather than a single mixed block. Port 80 handles certificate logistics first: with the ACME toggle enabled, a dedicated ^~ /.well-known/acme-challenge/ location keeps certbot webroot renewals working even while every other HTTP request is redirected, and the remaining traffic gets a clean 301 to the HTTPS host. The port 443 block carries the certificate and key paths using the conventional Let's Encrypt live directory for your domain, restricts protocols to TLSv1.2 and TLSv1.3, enables HTTP/2 with the modern http2 on; directive, and sends an HSTS header so compliant browsers stop trying plain HTTP altogether.

The remaining options cover the operational details that bite in production. The path prefix field scopes the proxy: leave it blank for location /, or enter /api/ and only that subtree is forwarded while the rest of the site stays free for static files or another app - the generator deliberately omits a trailing slash on proxy_pass so the full original URI reaches the backend untouched. Timeout presets map to sensible profiles - Standard for ordinary APIs, Long for sluggish backends, Streaming which raises read timeout to an hour and disables proxy_buffering for server-sent events. The upload selector writes client_max_body_size at server level, including the explicit 0 that removes the limit entirely when you genuinely need unrestricted uploads.

The generated file also doubles as a teaching reference because every line it emits has a reason you can name. When a proxied app starts failing, the usual symptoms map directly onto directives this tool controls: a 502 Bad Gateway means nginx reached nothing at the backend address (wrong host or port), while a 504 Gateway Timeout means the backend accepted the connection but exceeded the read timeout - which is exactly what the timeout presets adjust. A WebSocket that connects locally but dies behind the proxy almost always means the upgrade headers are missing; a form upload that fails around 1 MB on default installs is client_max_body_size doing its job. Because each knob is labelled with the directive it produces, the tool works as documentation as much as generation.

It also composes cleanly with the rest of an nginx setup instead of fighting it. The output contains only proxying concerns - no gzip rules, cache zones, rate limits or security headers beyond HSTS - so you can layer dedicated configs for those alongside it without directive collisions, or drop extra location blocks into the generated server block to serve static assets directly from disk and skip the upstream hop entirely. Compatibility-wise the config targets modern nginx: the http2 on; syntax requires nginx 1.25.1 or newer, and older installs can swap it for the classic listen 443 ssl http2; form with a one-line edit. Every result is verified before you ever see it: the generator re-parses its own output with a built-in nginx tokenizer and surfaces any structural complaint alongside the config, so what lands in your clipboard is syntactically balanced - braces matched, semicolons present, quoting intact. Stat cards summarize directive and block counts so you can eyeball complexity at a glance, and copy, download and print exports are one click away. Everything runs locally in your browser; your domains and backend addresses never leave the page. Paste the file into sites-available or conf.d, run nginx -t, reload, and the proxy is live.

Features

  • Complete server block - listen, server_name, proxied location and headers assembled from a three-field form.
  • Correct proxy header set - Host, X-Real-IP, X-Forwarded-For and X-Forwarded-Proto written automatically.
  • Two-block SSL layout - port 80 redirect block plus a 443 block with cert paths, TLSv1.2/1.3 and HTTP/2.
  • Certbot-safe ACME location - optional ^~ /.well-known/acme-challenge/ root that survives the HTTP-to-HTTPS redirect.
  • HSTS included with SSL - Strict-Transport-Security emitted only when HTTPS mode is active.
  • WebSocket support - HTTP/1.1 upgrade and connection headers added on demand.
  • Path-prefix scoping - proxy a subtree like /api/ without touching the rest of the site.
  • Three timeout presets - standard, long-running and streaming with buffering disabled.
  • Upload limit control - client_max_body_size selectable from 1m to unlimited.
  • Self-verifying output - the config is re-parsed internally before display and any anomaly is reported.
  • Live statistics - directive count, block count and line count for the generated file.
  • Copy / Download / Print exports, with sample data and one-click reset.

How to Use

  1. Enter your domain - the public hostname visitors type, e.g. app.example.com. Wildcards like *.example.com are accepted.
  2. Enter the backend address - where nginx should forward requests, e.g. http://127.0.0.1:3000. Both http and https upstreams work.
  3. Set the path prefix if you want a subtree proxied instead of the whole site - leave empty for /.
  4. Flip the switches: enable SSL for the two-block HTTPS layout, WebSockets for upgrade headers, and the ACME location if you renew certificates via certbot webroot.
  5. Pick upload and timeout behaviour from the selectors - they translate directly into client_max_body_size and the proxy timeout family.
  6. Click Generate (or Load sample first to see a fully worked example) and review the config plus its statistics.
  7. Export with Copy or Download, save it under /etc/nginx/sites-available/ (or conf.d/), enable it, then validate with nginx -t and reload.

Examples

Example 1 - Node.js app. Domain app.example.com, backend http://127.0.0.1:3000, no prefix, no SSL: you get a single port-80 server block whose root location forwards everything to localhost:3000 with the full forwarded-header set.

Example 2 - HTTPS API subtree. Domain www.example.com, backend http://10.0.0.5:8000, prefix /api/, SSL on: port 80 redirects to HTTPS (ACME path preserved), and only /api/ traffic is proxied on 443 while the rest of the site stays free.

Example 3 - WebSocket chat. Backend http://127.0.0.1:9001 with WebSockets enabled adds proxy_set_header Upgrade $http_upgrade; and proxy_set_header Connection "upgrade"; plus HTTP/1.1, so socket.io or raw ws handshakes succeed through nginx.

Example 4 - Docker container. A container publishing 127.0.0.1:8080 becomes the backend; choose the Streaming preset and the config disables proxy buffering with a 3600s read timeout for event streams.

Example 5 - Large uploads. An internal tool at upload.intranet.local receiving video files: set the upload selector to Unlimited and the generated server block contains client_max_body_size 0; so nginx stops rejecting multi-gigabyte POST bodies.

Benefits

  • No stale blog snippets - output reflects current conventions: modern http2 on; syntax, TLSv1.3, explicit HTTP/1.1 upstream protocol.
  • Headers done right the first time - the four forwarded headers frameworks rely on are always present.
  • Renewal-proof HTTPS - the ACME location keeps certbot webroot renewals alive after the redirect goes live.
  • Syntactically self-checked - internal re-parsing catches brace/semicolon mistakes before they reach your server.
  • Fast - a working, formatted config in seconds, ready for nginx -t and reload.
  • Private by design - domains and backend addresses are processed only in your browser.

Frequently Asked Questions

Where do I put the generated config?
Save it as a new file such as <code>/etc/nginx/sites-available/example.com</code>, then symlink it into <code>/etc/nginx/sites-enabled/</code> and reload nginx. On CentOS-style installs without sites-enabled, drop it in <code>/etc/nginx/conf.d/</code> instead. Always run <code>nginx -t</code> before reloading.
Why does SSL mode produce two server blocks?
The first block listens on port 80, serves the ACME challenge path for certificate renewal, and redirects everything else to HTTPS. The second block listens on 443 with the certificate paths and holds the actual proxy location. This is the standard split recommended for Let's Encrypt setups.
Does the tool connect to my server or run nginx?
No. It only produces configuration text based on the values you enter. Nothing is executed, probed or uploaded - generation happens entirely in your browser.
How does the WebSocket option change the output?
It adds <code>proxy_http_version 1.1</code> plus <code>Upgrade</code> and <code>Connection</code> headers to the proxied location, which is required for nginx to forward the HTTP/1.1 handshake that WebSocket connections need.
What does the path prefix field do?
It controls the <code>location</code> block that receives proxied traffic. Leave it empty for a whole-site proxy (<code>location /</code>) or enter something like <code>/api/</code> to proxy only requests under that path while other paths are served normally.
Is the generated syntax checked?
Yes. After building the configuration the tool re-parses its own output with a built-in nginx config tokenizer and reports any structural problems, so bracket or semicolon mistakes cannot slip through silently.
Which timeout preset should I choose?
Standard (60s) suits normal request/response APIs. Long (300s) helps slow backends and large uploads. Streaming disables response buffering with a 3600s read timeout for SSE or long-lived connections beyond WebSockets.
Can I proxy multiple backends or add load balancing?
This tool targets the common single-upstream case and keeps the config minimal. For weighted servers, least_conn selection or health-check style setups you need an upstream block - use a dedicated load balancer generator for that.
Do certificate files get created for me?
No. In SSL mode the config references the conventional Let's Encrypt live paths for your domain. You obtain the actual certificates with certbot or your own CA; the ACME toggle additionally adds the challenge location certbot's webroot mode expects.