Server config builders

proxy_pass and the trailing slash: tap the proxy_pass line and it works an example through. With a URI part (proxy_pass http://app/; — even a lone /) the matched location prefix is replaced: location /api/ + http://app/ sends /api/users/42 as /users/42. Without one (http://app) the URI is passed unchanged. location /api + http://app/ gives //users/42.

Checks (on the generated config and on yours): unbalanced braces, a missing ; (when the next line’s directive is swallowed as an argument), directives in the wrong context (proxy_pass in server, upstream in server), unknown directives, duplicates, a URI part in proxy_pass inside a regex location, limit_req with an undefined zone, a TLS listener without a certificate, the deprecated listen … http2, old TLS versions, WebSocket headers without proxy_http_version 1.1, and add_header lines in a location that silently drop the server’s headers (HSTS).

limit_req simulation: one client sends N requests at once, a steady stream, or both; the chart shows which are served at once, queued (and for how long) or refused, and the bucket level. It follows ngx_http_limit_req_module.c: the per-key excess drains at the rate and grows by one per request; above burst the request is refused; otherwise it waits excess ÷ rate seconds — or not at all with nodelay.

Checks: missing ExecStart, shell syntax in ExecStart (it is not run by a shell), keys in the wrong section or misspelt, Restart=always with Type=oneshot, After=network-online.target without Wants=, secrets in Environment= (readable by every user), timers without a trigger, invalid OnCalendar= expressions.

Exposure estimate: each hardening setting, met or not, weighted, scored 0–10 with the same verdict words as systemd-analyze security (PERFECT, SAFE, OK, MEDIUM, EXPOSED, UNSAFE). It is an approximation with fewer settings and weights modelled on systemd’s table — run systemd-analyze security <unit> for the real figure.

OnCalendar: type an expression and get the normalized form and the next elapse times, like systemd-analyze calendar --iterations=8, in your time zone or UTC. Weekdays (Mon..Fri, Sat,Sun), dates with *, lists, ranges a..b, repetitions a/step, ~ for days counted from the end of the month, and the shorthands (daily, weekly, quarterly…).

The nginx checks cover structure, contexts and the mistakes listed above for nginx’s own modules; they do not open included files, resolve names, test certificates or know third-party modules (they are reported as unknown). Run nginx -t on the server.

The Caddyfile check is structural; subdirectives inside a directive’s block are not validated (use caddy validate).

systemd: the exposure score is an estimate, not systemd-analyze security. OnCalendar time zones other than UTC and the local one are not evaluated; a leap-second :60 and years before 1970 are not accepted.

SSH: Match exec, canonical, final, localuser and tagged are not evaluated, Include is not followed, and tokens other than %h are not expanded.

TLS profiles are copied from Mozilla’s guidelines 5.7 (ssl-config.mozilla.org); check the generator for later revisions. Let’s Encrypt stopped OCSP in 2025, so stapling is off by default.