# nginx Reverse Proxy Wizard Guide

Step through domain, upstream, TLS and extras to get a reverse proxy server block.

- Tool: https://ilham.dev/tools/nginx-reverse-proxy-wizard/
- Guide URL: https://ilham.dev/guides/nginx-reverse-proxy-wizard/
- Tool guides index: https://ilham.dev/guides/tools/
- Broader guide: Nginx Reverse Proxy Configuration (https://ilham.dev/guides/nginx-reverse-proxy/)

## What it does

A guided way to write a reverse proxy server block. Step through the domain, the upstream pool (one or more hosts, a balancing method and keepalive), TLS with a plain-HTTP redirect, and the extras an app usually needs — WebSocket upgrade, streaming, security headers and upload size. The config is built live beside the steps and can be copied or downloaded.

## Use the tool

Open https://ilham.dev/tools/nginx-reverse-proxy-wizard/, add the input the tool asks for, run it, and check the output before using it elsewhere.

## Input and output

- Input: text.
- Output: text.
- Category: Workflow.

## Privacy and processing
Processing happens locally in your browser. This tool does not upload the input to ilham.dev.

## Common use cases
- add a reverse proxy step by step
- fix common proxy errors

## Questions

### Why is there an upstream block instead of a plain proxy_pass?

An upstream block lets nginx pool several backends, apply a balancing method, and reuse connections with keepalive. A bare proxy_pass to one host opens a new connection per request. The wizard always writes an upstream so the config can grow without being rewritten.

### Why does the WebSocket option add a map block?

nginx cannot choose between the upgrade and close values inline, and the Connection header has to match the request. The map block turns $http_upgrade into $connection_upgrade once, and the location uses it. Without the map, the header would be wrong for either WebSockets or ordinary requests.

### Does the app see the real client IP?

The location forwards X-Real-IP, X-Forwarded-For and X-Forwarded-Proto, so the app can read the original client and scheme. Make sure the app trusts those headers only from nginx, or a client could spoof them.

### Why skip keepalive when the target is https?

Keepalive to an upstream needs HTTP/1.1 over a plain connection to reuse cleanly. An https target means a TLS handshake per connection, so the wizard leaves keepalive out and says so rather than pretending it helps.