nginx -t && systemctl reload nginx

Reverse Proxy Config Builder

Point a domain at a service running on a port. Pick nginx or Caddy and get a config with the headers that self-hosted apps actually need.

host:port of the service.
Nextcloud and media apps need this raised.
Behaviour
Generated configuration
Install and reload

The headers self-hosted apps depend on

Behind a proxy an application sees the proxy as its client, which breaks anything that logs IPs, rate limits, or builds absolute URLs. X-Real-IP and X-Forwarded-For carry the original address; X-Forwarded-Proto tells the app it was reached over HTTPS so it stops generating http:// links and redirect loops. Omit that last one and Nextcloud, Jellyfin, and most others will misbehave in ways that look like application bugs. WebSocket apps additionally need the Upgrade and Connection headers or live updates silently fail.

nginx and Caddy reverse proxy config for self-hosted services

This reverse proxy generator writes a working server block for putting a domain in front of a service on a local port. It handles the TLS listener and HTTP redirect, the forwarded headers self-hosted applications need, WebSocket upgrade for live updates, client_max_body_size for large uploads, and buffering options for streaming endpoints. Caddy output is included for anyone who would rather not manage certificates by hand.

Reverse proxy FAQ

nginx or Caddy for a home server?

Caddy obtains and renews TLS certificates automatically with no extra tooling, and its config is much shorter, which makes it the easier choice for a homelab. nginx has broader documentation, more third-party examples, and is what you will meet professionally. Neither is wrong.

Why does my app redirect endlessly or generate http:// links?

The application does not know it was reached over HTTPS, so it builds URLs with the wrong scheme. Send X-Forwarded-Proto $scheme, and check the application also has its own setting for trusting proxy headers. Many require both.

My uploads fail at a certain size. Where is the limit?

nginx defaults client_max_body_size to 1MB and returns 413 above it. Raise it in the server block, and remember the application usually has its own limit too, plus PHP's upload_max_filesize and post_max_size if it is a PHP app.

Do I need to open the upstream port in my firewall?

No, and you should not. Bind the service to 127.0.0.1 so only the proxy can reach it, and open only 80 and 443. If the service listens on 0.0.0.0 people can bypass your proxy, and with it your TLS and any authentication you added there.

More Linux command tools

Crontab Generator Build cron schedule expressions visually, with plain-English previews of when your job will run. tar Builder Compose tar archive and extract commands with the right compression flags, without memorizing xvzf incantations. systemd Unit Builder Generate systemd service files with restart policies, dependencies, and sandboxing options. chmod / chown Builder Work out permission octals and ownership commands with a visual rwx matrix. rsync Builder Build rsync sync and backup commands with delete safety, excludes, and SSH transport options. SSH Config Builder Generate ~/.ssh/config host blocks with keys, jump hosts, and connection keepalives. find Builder Compose find commands with type, name, time, and size filters, plus prune lists and safe actions. /etc/fstab Builder Build fstab mount lines with the right options, dump, and pass ordering for disks and network shares. OpenSSL CSR Builder Generate certificate signing request commands with subject fields and SAN entries filled in. journalctl Query Builder Compose systemd journal queries with unit, boot, priority, time-range, and grep filters. docker run Builder Build docker run commands with ports, volumes, env vars, and restart policies. Podman-compatible. ufw Rule Builder Build ufw firewall rules with allow/deny/limit actions, source restrictions, and comments. systemd Timer Builder Generate paired .timer and .service units with OnCalendar schedules, persistence, and randomised delay. WireGuard Config Generator Produce matching server and peer configs with AllowedIPs, DNS, keepalive, and NAT forwarding rules. Docker Compose Generator Build a docker-compose.yml with volumes, environment, ports, restart policy, and healthcheck. nftables Rule Builder Generate nftables rules and a stateful starter ruleset for the inet filter table. Samba and NFS Share Builder Create an smb.conf share block or an /etc/exports line, with the client mount commands. useradd / usermod Builder Build user creation and modification commands without accidentally wiping group membership. sed Command Builder Compose substitution, deletion, and insertion commands with safe in-place editing and backups. LVM Command Builder Get the full command sequence for creating, extending, and snapshotting logical volumes. restic / Borg Backup Builder Build init, backup, retention, and restore commands for restic or BorgBackup repositories. tcpdump Filter Builder Assemble BPF capture filters by host, port, and protocol, with rotation and Wireshark output. dd Bootable USB Builder Write an ISO to a USB drive, with the device identification and checksum checks to run first. ffmpeg Command Builder Convert, compress, trim, scale, and extract audio with the arguments in the right order. umask Calculator See what a umask produces for new files and directories, and where to set it persistently. GPG Command Builder Verify signed downloads, generate keys, and sign files or git commits without guessing flags. Subnet Calculator Work out network, broadcast, host range, and masks for any IPv4 or IPv6 CIDR block, and split networks into subnets. curl Command Builder Build curl requests with methods, headers, JSON or form bodies, uploads, auth, retries, and timeouts. ssh-keygen Builder Generate Ed25519, RSA, or FIDO2 security key SSH keys, then install them with ssh-copy-id. sudoers Rule Builder Write sudoers.d rules with run-as targets, NOPASSWD, and limited command lists, validated with visudo. logrotate Config Generator Generate /etc/logrotate.d files with rotation schedules, retention, compression, and postrotate reloads. Podman Quadlet Generator Turn a container into a systemd service with a Quadlet .container file, rootless or rootful. Netplan Config Generator Write Netplan YAML for static IPs, DHCP, bridges, and VLANs on Ubuntu, applied safely with netplan try. grep Command Builder Build recursive grep searches with regex modes, context lines, and include or exclude filters, plus the ripgrep equivalent.

View all tools →