Putting nginx in front of an application is the most common way to serve it on ports 80 and 443, terminate TLS, and hide process management behind a stable address - yet the server block that does the job is almost always copied from an old blog post, half understood, and quietly wrong somewhere: missing X-Forwarded-For, a proxy_pass trailing-slash surprise, no Upgrade headers for WebSockets, or upload limits that reject perfectly legitimate requests. Nginx Reverse Proxy Config Generator replaces that copy-paste ritual with a short form: enter your public domain and backend address, flip the switches you need, and get a complete, consistently formatted server block built from current best practice.
The core of the output is a location block wired for proxying. Every generated config sets Host, X-Real-IP, X-Forwarded-For and X-Forwarded-Proto headers, because virtually every framework behind a proxy - Express, Django, Rails, Spring - depends on those to reconstruct original client IPs and scheme information; omitting them breaks rate limiters, logging and absolute-URL generation in subtle ways. proxy_http_version 1.1 is included so keepalive behaviour is predictable, and enabling the WebSocket option adds the $http_upgrade/Connection header pair that lets the handshake pass through unchanged.
SSL mode produces the canonical two-block layout rather than a single mixed block. Port 80 handles certificate logistics first: with the ACME toggle enabled, a dedicated ^~ /.well-known/acme-challenge/ location keeps certbot webroot renewals working even while every other HTTP request is redirected, and the remaining traffic gets a clean 301 to the HTTPS host. The port 443 block carries the certificate and key paths using the conventional Let's Encrypt live directory for your domain, restricts protocols to TLSv1.2 and TLSv1.3, enables HTTP/2 with the modern http2 on; directive, and sends an HSTS header so compliant browsers stop trying plain HTTP altogether.
The remaining options cover the operational details that bite in production. The path prefix field scopes the proxy: leave it blank for location /, or enter /api/ and only that subtree is forwarded while the rest of the site stays free for static files or another app - the generator deliberately omits a trailing slash on proxy_pass so the full original URI reaches the backend untouched. Timeout presets map to sensible profiles - Standard for ordinary APIs, Long for sluggish backends, Streaming which raises read timeout to an hour and disables proxy_buffering for server-sent events. The upload selector writes client_max_body_size at server level, including the explicit 0 that removes the limit entirely when you genuinely need unrestricted uploads.
The generated file also doubles as a teaching reference because every line it emits has a reason you can name. When a proxied app starts failing, the usual symptoms map directly onto directives this tool controls: a 502 Bad Gateway means nginx reached nothing at the backend address (wrong host or port), while a 504 Gateway Timeout means the backend accepted the connection but exceeded the read timeout - which is exactly what the timeout presets adjust. A WebSocket that connects locally but dies behind the proxy almost always means the upgrade headers are missing; a form upload that fails around 1 MB on default installs is client_max_body_size doing its job. Because each knob is labelled with the directive it produces, the tool works as documentation as much as generation.
It also composes cleanly with the rest of an nginx setup instead of fighting it. The output contains only proxying concerns - no gzip rules, cache zones, rate limits or security headers beyond HSTS - so you can layer dedicated configs for those alongside it without directive collisions, or drop extra location blocks into the generated server block to serve static assets directly from disk and skip the upstream hop entirely. Compatibility-wise the config targets modern nginx: the http2 on; syntax requires nginx 1.25.1 or newer, and older installs can swap it for the classic listen 443 ssl http2; form with a one-line edit. Every result is verified before you ever see it: the generator re-parses its own output with a built-in nginx tokenizer and surfaces any structural complaint alongside the config, so what lands in your clipboard is syntactically balanced - braces matched, semicolons present, quoting intact. Stat cards summarize directive and block counts so you can eyeball complexity at a glance, and copy, download and print exports are one click away. Everything runs locally in your browser; your domains and backend addresses never leave the page. Paste the file into sites-available or conf.d, run nginx -t, reload, and the proxy is live.