nginx Reverse Proxy Wizard Guide
Step through domain, upstream, TLS and extras to get a reverse proxy server block.
A short companion for nginx Reverse Proxy Wizard: when it is useful, what it expects, and what to check before using the result.
What it does
A guided way to write a reverse proxy server block. Step through the domain, the upstream pool (one or more hosts, a balancing method and keepalive), TLS with a plain-HTTP redirect, and the extras an app usually needs — WebSocket upgrade, streaming, security headers and upload size. The config is built live beside the steps and can be copied or downloaded.
Use the tool
Open nginx Reverse Proxy Wizard, add the input the tool asks for, run it, and check the output before using it elsewhere.
Input and output
- Input: text.
- Output: text.
- Category: Workflow.
Privacy and processing
Processing happens locally in your browser. This tool does not upload the input to ilham.dev.
Common use cases
- add a reverse proxy step by step
- fix common proxy errors
Questions
Why is there an upstream block instead of a plain proxy_pass?
An upstream block lets nginx pool several backends, apply a balancing method, and reuse connections with keepalive. A bare proxy_pass to one host opens a new connection per request. The wizard always writes an upstream so the config can grow without being rewritten.
Why does the WebSocket option add a map block?
nginx cannot choose between the upgrade and close values inline, and the Connection header has to match the request. The map block turns $http_upgrade into $connection_upgrade once, and the location uses it. Without the map, the header would be wrong for either WebSockets or ordinary requests.
Does the app see the real client IP?
The location forwards X-Real-IP, X-Forwarded-For and X-Forwarded-Proto, so the app can read the original client and scheme. Make sure the app trusts those headers only from nginx, or a client could spoof them.
Why skip keepalive when the target is https?
Keepalive to an upstream needs HTTP/1.1 over a plain connection to reuse cleanly. An https target means a TLS handshake per connection, so the wizard leaves keepalive out and says so rather than pretending it helps.
Related guide
For broader background, see Nginx Reverse Proxy Configuration.