🌐 Networking

Nginx Reverse Proxy for Grafana on Windows

Run Nginx as a reverse proxy in front of Grafana on Windows. Full nginx.conf configuration, WebSocket support for live dashboards, sub-path setup, HTTPS integration and troubleshooting 502 errors.

Install Nginx on Windows

Download the stable Nginx build for Windows from nginx.org. Extract to C: ginx.

# Install Nginx as a Windows Service using NSSM
# Download NSSM from https://nssm.cc/download
nssm install nginx "C:
ginx
ginx.exe"
nssm set nginx AppDirectory "C:
ginx"
nssm set nginx Start SERVICE_AUTO_START
nssm start nginx

# Or start Nginx manually from the directory:
# C:
ginx
ginx.exe

# Useful Nginx commands (run from C:
ginx)
nginx.exe -t              # Test configuration
nginx.exe -s reload       # Reload config without restart
nginx.exe -s stop         # Stop Nginx

Basic reverse proxy configuration

Edit C: ginx\conf ginx.conf. Replace the default server block with this configuration:

worker_processes  1;

events {
    worker_connections 1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile      on;
    keepalive_timeout 65;

    # Map for WebSocket upgrade (needed for Grafana Live)
    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }

    server {
        listen 80;
        server_name grafana.yourdomain.com;

        location / {
            proxy_pass         http://localhost:3000;
            proxy_http_version 1.1;

            # Standard proxy headers
            proxy_set_header   Host              $http_host;
            proxy_set_header   X-Real-IP         $remote_addr;
            proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header   X-Forwarded-Proto $scheme;

            # WebSocket support (required for Grafana Live)
            proxy_set_header   Upgrade           $http_upgrade;
            proxy_set_header   Connection        $connection_upgrade;

            # Timeouts
            proxy_read_timeout  300s;
            proxy_send_timeout  300s;
            proxy_connect_timeout 10s;

            # Buffer settings
            proxy_buffering    off;
            proxy_buffer_size  128k;
            proxy_buffers      4 256k;
        }
    }
}

HTTPS configuration (Nginx + TLS)

For HTTPS, see the HTTPS setup guide for certificate generation. Add these server blocks:

    # HTTP → HTTPS redirect
    server {
        listen 80;
        server_name grafana.yourdomain.com;
        return 301 https://$host$request_uri;
    }

    # HTTPS server
    server {
        listen 443 ssl http2;
        server_name grafana.yourdomain.com;

        ssl_certificate     C:/nginx/ssl/grafana.crt;
        ssl_certificate_key C:/nginx/ssl/grafana.key;
        ssl_protocols       TLSv1.2 TLSv1.3;
        ssl_ciphers         HIGH:!aNULL:!MD5;

        location / {
            proxy_pass http://localhost:3000;
            # ... same headers as above
        }
    }

Sub-path setup (e.g. /grafana/)

If you want Grafana served at https://yourdomain.com/grafana/ instead of the root:

# nginx.conf
location /grafana/ {
    proxy_pass http://localhost:3000/;
    rewrite ^/grafana/(.*)$ /$1 break;
    proxy_set_header Host $host;
    # ... other headers
}

And in grafana.ini:

[server]
root_url = https://yourdomain.com/grafana/
serve_from_sub_path = true

Grafana.ini settings for reverse proxy

[server]
# Must match your Nginx server_name + path
root_url = https://grafana.yourdomain.com/

[security]
# Enable secure cookies when behind HTTPS proxy
cookie_secure = true

[auth.proxy]
# If using proxy authentication (optional)
enabled = false

Restart-Service -Name "Grafana"

Troubleshooting 502 Bad Gateway

1. Is Grafana actually running?

Get-Service -Name "Grafana"
Invoke-WebRequest -Uri "http://localhost:3000" -UseBasicParsing

2. Test Nginx config

cd C:
ginx && nginx.exe -t

3. Check Nginx error log

Get-Content "C:
ginx\logs\error.log" -Tail 30

4. Confirm proxy_pass URL matches Grafana port

If you changed Grafana's port from 3000, update proxy_pass in nginx.conf to match and reload Nginx.

5. WebSocket issues (dashboard not updating live)

Ensure the map $http_upgrade block is present and the Upgrade and Connection headers are forwarded — Grafana Live uses WebSockets.