Reverse Proxy Config Generator

Builds a complete nginx server block or Caddyfile site block for proxying a domain to a local or internal upstream, with TLS termination, websocket upgrade headers, common security headers (HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy), real client IP forwarding, gzip, upload size limits, proxy timeouts, static asset caching, and an optional www to apex redirect. It can generate nginx, Caddy, or both at once.

Type a line like app.example.com -> http://127.0.0.1:3000, or fill in the domain and upstream fields directly, then toggle the options for TLS, websockets, headers, caching, and redirects. Copy the nginx block into /etc/nginx/sites-available or the Caddyfile block into /etc/caddy/Caddyfile, then reload the server.

Most nginx and Caddy examples online are partial snippets missing websocket headers, security headers, or a working TLS redirect, so you end up stitching several tabs together. This generates a complete, working config for either server in one pass, entirely in your browser: your files and inputs never leave your device.

Why does nginx need the Upgrade header for websockets?

nginx proxies HTTP/1.1 connections by default without forwarding the Connection and Upgrade headers, so a websocket handshake fails silently behind a plain proxy_pass. Setting proxy_http_version 1.1 plus proxy_set_header Upgrade $http_upgrade and Connection "upgrade" tells nginx to pass the handshake through instead of terminating it as a normal HTTP request.

Where do the TLS certificates come from?

The nginx output points at the standard certbot path, /etc/letsencrypt/live/<domain>/fullchain.pem and privkey.pem, which Certbot creates when you run certbot certonly or certbot --nginx for that domain. Caddy skips this entirely: it requests and renews certificates from Let's Encrypt automatically the first time it serves the site, so the Caddy block needs no certificate paths at all.

How do I test the config before reloading?

For nginx, run nginx -t (or sudo nginx -t), which parses every config file and reports the first syntax error with a line number, then reload with systemctl reload nginx once it passes. For Caddy, run caddy validate --config /etc/caddy/Caddyfile, or just caddy reload, which validates the new config before it swaps in and leaves the old one running if validation fails.