NGINX Reverse Proxy Config Tool

What is this tool?

The NGINX Reverse Proxy Generator creates production-grade configurations for proxying web traffic, terminating SSL, and caching static assets.

NGINX is the industry standard for reverse proxying due to its event-driven architecture, enabling it to handle tens of thousands of concurrent connections with a minimal memory footprint. However, writing nginx.conf manually can lead to missing security headers, suboptimal caching, or incorrect WebSocket configurations. This tool visually abstracts those directives into an easy-to-use interface.

How to Use This Tool

1. Define the Server Block: Specify your domain and listen ports. The generator automatically configures HTTP to HTTPS redirection if SSL is enabled.

2. Configure the Proxy: Set your backend upstream (e.g., http://127.0.0.1:3000). The generator injects the required proxy_set_header directives to ensure the backend receives the correct original IP and protocol.

3. Enable WebSockets: If your backend uses WebSockets (e.g., Socket.io or GraphQL subscriptions), toggle WebSockets to inject the necessary Upgrade and Connection headers.

4. Security & Performance: Toggle strict security headers (HSTS, X-Frame-Options) and Gzip compression to secure your application and reduce bandwidth consumption instantly.

Best Practices

Always set `proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;` so your backend application knows the true IP address of the client, rather than NGINX's internal IP.
Enable `proxy_http_version 1.1;` when reverse proxying. NGINX defaults to HTTP/1.0 for proxies, which disables Keep-Alive connections to your backend, severely impacting performance.
Use `ssl_prefer_server_ciphers on;` and strictly define modern SSL protocols (TLSv1.2, TLSv1.3) to prevent downgrade attacks.
Offload static files to NGINX. NGINX can serve images, CSS, and JS much faster than a Node.js or Python backend.

Common Mistakes

Forgetting to include a trailing slash on `proxy_pass` when you intend to strip the URI path (or mistakenly adding it when you don't).
Failing to configure `client_max_body_size`. NGINX defaults to 1MB, which will cause 413 Request Entity Too Large errors if users try to upload standard images or files.
Using `if` inside a `location` block for routing logic. 'If is evil' in NGINX. Use `try_files` or distinct `location` blocks instead.

Security Notes

Hide the NGINX version number by setting `server_tokens off;` to prevent automated vulnerability scanners from targeting specific CVEs.
Enable Strict-Transport-Security (HSTS) with a long max-age and `includeSubDomains` to force browsers to always use HTTPS.
Implement rate limiting using `limit_req_zone` to protect your backend APIs from brute-force attacks and DDoS.

Production Tips

Enable proxy caching (`proxy_cache`) to store responses from your backend in memory/disk. This can instantly scale a slow backend to handle millions of requests.
Use the `upstream` directive to define a pool of backend servers for load balancing, even if you currently only have one server (it makes scaling later trivial).
Log in JSON format using a custom `log_format` directive to seamlessly integrate with centralized logging stacks like Elasticsearch or Datadog.

Frequently Asked Questions

Why does my WebSocket connection fail through NGINX?

WebSockets require the HTTP Connection to be 'upgraded'. NGINX does not do this by default. You must explicitly set `proxy_set_header Upgrade $http_upgrade;` and `proxy_set_header Connection "upgrade";`.

What is the difference between a Reverse Proxy and a Load Balancer?

A reverse proxy acts as an intermediary for client requests, hiding the backend server's identity. A load balancer is a specific type of reverse proxy that distributes those requests across multiple backend servers to ensure high availability.

How do I redirect www to non-www?

Create a separate `server` block that listens on the `www` domain and returns a 301 redirect to the non-www domain. Do not use rewrite rules or `if` statements for this.

How We Keep Your Configs Safe & Valid

Built-in Error Checking

Every file is checked against official rules. We catch missing fields and bad syntax. YAML indentation errors are flagged right away. Kubernetes, Terraform, and Docker specs are all covered. API versions and labels are verified too. You get valid output every time you generate.

100% Private & Local

All tools run in your browser only. Your API keys never leave your machine. We do not use any tracking scripts. No data is sent to any server. Passwords and secrets stay on your device. Crypto operations use the Web Crypto API. Your privacy is fully protected at all times.

Secure Settings by Default

Configs use safe defaults out of the box. Containers run as non-root users. Root filesystems are set to read-only. Dangerous Linux capabilities are dropped. Network policies limit pod-to-pod traffic. TLS 1.3 is enabled for web servers. Security headers are added where needed.

Ready for CI/CD & Git

Output files are ready for your Git repo. Use them with ArgoCD, Flux, or GitHub Actions. Files use clear formatting and comments. Code review is easy for your team. Indentation and key order are consistent. Test in staging before going to production. Every file is clean and well-structured.

Infrastructure as Code

Store configs in Git alongside your code. Terraform modules include typed variables. Backend configs support remote state locking. Outputs work across multiple modules. Ansible playbooks use clear task steps. Chef and Puppet configs are also supported. Every file works with version control tools.

Monitoring & Tracing

Set up Prometheus with auto-discovery rules. Create Grafana dashboards with template variables. Add alerting rules with severity labels. Use OpenTelemetry for trace collection. Forward logs to Loki or Elasticsearch. Connect to Jaeger or Tempo for tracing. Monitor metrics, logs, and traces together.

Container & Docker Safety

Dockerfiles use multi-stage builds for small images. Base images are pinned to exact versions. Dev files are excluded from final images. Health checks are added for orchestrator use. Containers switch to non-root users. Docker Compose uses named volumes and networks. Resource limits are set in deploy configs.

Multiple Output Formats

Export as YAML, JSON, HCL, or TOML. Kubernetes uses YAML with proper separators. Terraform uses HCL with correct escaping. JSON output has consistent indentation. Copy to clipboard with one click. Preview output with syntax highlighting. Line numbers help you review quickly.

NGINX Reverse Proxy Generator

NGINX Settings

Core Routing

Upstream Servers