Nginx & Caddy Reverse Proxy, WebSocket, CORS & TLS Config Generator

Generate hardened production nginx.conf virtual hosts and equivalent Caddyfile blocks for reverse-proxied APIs, WebSockets, Server-Sent Events (SSE), HTTP/2 + HTTP/3 QUIC, and strict security headers—100% locally in your browser.

1. Generated Nginx Virtual Host (/etc/nginx/conf.d/app.conf)

2. Equivalent Caddy v2 Configuration (/etc/caddy/Caddyfile)

Nginx Reverse-Proxy Architecture & Pitfalls in Production

By default, Nginx speaks HTTP/1.0 without keepalive pooling to upstream backends, closing the local TCP socket after every proxied request. Under high concurrency, omitting an explicit upstream keepalive pool and proxy_http_version 1.1; quickly exhausts ephemeral local ports (TIME_WAIT socket starvation) and triggers intermittent HTTP 502 Bad Gateway or HTTP 499 Client Closed Request errors. The configuration generated above enforces persistent upstream HTTP/1.1 connection reuse while safely clearing the client Connection header on standard requests and promoting it to upgrade via a dedicated map $http_upgrade $connection_upgrade block whenever a browser initiates a WebSocket handshake.

For Server-Sent Events (SSE), gRPC-Web, and streaming LLM inference APIs, Nginx's default response buffer (proxy_buffering on) silently holds small token chunks in memory until an 8 KiB page fills up—making real-time responses appear frozen until completion. Toggling SSE / LLM Streaming injects proxy_buffering off; and X-Accel-Buffering: no alongside extended proxy_read_timeout thresholds so chunks flush immediately over TLS. Need to verify your deployed X.509 certificate chain or open TCP/UDP port 443 for HTTP/3 QUIC? Pair this config with the Offline SSL Certificate Decoder and Port 443 Firewall Guide.