Tool

Nginx Config Builder

Build Nginx server block configurations with templates and helpful hints.

Server Configuration

Server Type

Forwards incoming requests to a backend application server. Useful when your app runs on a different port (e.g., Node.js on 3000, Python on 8000). Nginx handles SSL termination and forwards requests with proper headers.

Server Name

Domain name or IP address. Use _ for catch-all or default server.

Listen Port

Port to listen on. Common: 80 (HTTP), 443 (HTTPS).

Proxy Pass URL

Backend server URL (e.g., http://localhost:3000 or http://127.0.0.1:8080).

How it works: Nginx receives requests and forwards them to your backend server. The generated config includes proper proxy headers (Host, X-Real-IP, X-Forwarded-For) so your application can identify the original client. This is essential for apps behind a reverse proxy.

Client Max Body Size

Maximum request body size (e.g., 10m, 100m).

Limits upload size. Common: 10m, 50m, 100m. Leave empty for default (1m).

Rate Limit Zone

Rate limit zone name and rate (e.g., api_limit 10r/s).

Requires a rate limit zone defined in http context. Example:limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;

Enable SSL/TLS

Custom Directives (optional)

Generated Nginx Config

server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass http://localhost:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

}

Was this tool helpful?

About the Nginx Config Builder

Nginx server blocks accumulate the same hard-won boilerplate everywhere: TLS settings that pass modern scanners, proxy headers that preserve client identity, websocket upgrade handling, gzip, and security headers. This builder generates server block configurations from structured choices, with the directives that are easy to forget and painful to debug when missing.

The proxy header block is the classic example — omit X-Forwarded-For and your application logs the proxy's IP for every client; omit the Upgrade/Connection pair and websockets fail with errors that point everywhere except the config.

Frequently asked questions

Which proxy headers must a reverse proxy set?

proxy_set_header Host $host (so the upstream sees the real hostname), X-Real-IP and X-Forwarded-For $proxy_add_x_forwarded_for (client identity), and X-Forwarded-Proto $scheme (so the app knows the original request was HTTPS and doesn't redirect-loop). For websockets add Upgrade $http_upgrade and Connection "upgrade" with proxy_http_version 1.1.

Why does nginx return 413 Request Entity Too Large?

client_max_body_size defaults to 1MB — any larger upload is rejected before reaching your application. Set it in the server or location block to match your real upload limits. Remember the application server (and any other proxy in the chain) has its own limit; the effective maximum is the smallest of them.

How should I redirect HTTP to HTTPS correctly?

A dedicated port-80 server block: return 301 https://$host$request_uri; — using $host (not a hardcoded domain) preserves subdomains, and $request_uri keeps path and query intact. Keep the ACME challenge location reachable over HTTP if you use HTTP-01 renewal, and add HSTS only once you are confident HTTPS is permanent.

Need this managed for you, not just automated?

We're also a hands-on DevOps consultancy — Kubernetes, CI/CD, and cloud infrastructure.

Explore Our Services