Proxies & Observability: Nginx, Traefik, Sysctl, PromQL

Traffic in, signals out: the proxy terminates TLS and routes requests, the kernel buffers the bytes, and Prometheus plus Grafana prove it all works. These five tools generate each layer from its inputs: Nginx Reverse Proxy Wizard, Traefik Router Generator, Linux Sysctl Tuner, PromQL Builder & Validator, and Grafana Panel Generator.

Nginx upstreams and Traefik routers without YAML anxiety

generateNginxConfig emits upstream blocks with server 127.0.0.1:3000 weight=N lines, then a server block with server_name, listen 443 ssl http2, and ssl_certificate plus ssl_certificate_key paths. Port 80 gets a return 301 https://$host$request_uri redirect when SSL is on. Each location carries proxy_pass, proxy_http_version 1.1, and the canonical proxy_set_header quartet — Host, X-Real-IP, X-Forwarded-For, X-Forwarded-Proto — with proxy_connect_timeout, proxy_read_timeout, and proxy_send_timeout threaded through. WebSocket locations add proxy_set_header Upgrade $http_upgrade and Connection $connection_upgrade, and the generator prepends the required map $http_upgrade $connection_upgrade block automatically. Extras include gzip on with JSON and SVG MIME types plus client_max_body_size, while validateNginxConfig flags a missing domain or an empty location list.

upstream backend_1 {
    server 127.0.0.1:3000 weight=2;
}
location /api {
    proxy_pass http://backend_1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
}

generateTraefikConfig writes the http: tree — routers:, services:, middlewares: — with rules composed by buildTraefikRule from Host(), PathPrefix(), and HeadersRegexp() clauses joined with &&. Routers bind a service, optional tls: {}, and a middlewares: list; services expose a loadBalancer with servers: URLs and passHostHeader. Middlewares cover redirectScheme, basicAuth, rateLimit, stripPrefix, and headers, and any entryPointsNote is appended as a # EntryPoints: comment.

Size kernel buffers from bandwidth-delay product

calculateSysctl starts from real physics: BDP equals bandwidth in bits per second times round-trip time in seconds, divided by 8. A 4/3 headroom factor covers TCP window scaling and scheduling variance, with a 4 MiB floor so slow links still get usable buffers.

Input example	BDP	maxBuffer
1000 Mbps × 20 ms	2,500,000 bytes	3,333,334 bytes
100 Mbps × 50 ms	625,000 bytes	833,334 bytes

The result lands in net.core.rmem_max and net.core.wmem_max, plus the net.ipv4.tcp_rmem and net.ipv4.tcp_wmem triplets. Queues follow the workload profile — web-server and k8s-node get net.core.somaxconn 4096 with tcp_max_syn_backlog 8192, database gets 2048/4096 with vm.swappiness 1, file-server gets 1024/2048 with swappiness 20. RAM-scaled keys round out the file: fs.file-max at 262,144 handles per GB and fs.inotify.max_user_watches at 8,192 per GB.

Queries you can alert on, panels you can import

buildPromQL assembles metric{label="value"} selectors, wraps them in rate(), irate(), or increase() with a [5m] range vector and optional offset, adds sum by (labels) grouping, and finishes with histogram_quantile(0.95, …) when set. validatePromQL checks balanced parentheses, rejects unknown functions, errors when rate lacks a range vector, and warns on likely non-counters. generateAlertRuleYaml packages expressions into groups: with alert, expr, for, labels, and annotations.

generateGrafanaPanelJSON scaffolds an importable panel for six types — timeseries, stat, gauge, barGauge, table, logs — with datasource, fieldConfig.defaults carrying unit, min, max, and absolute thresholds steps, plus overrides, legend/tooltip options, and targets with expr and legendFormat. validateGrafanaPanel enforces the 24-column gridPos fit, recognized types, valid colors, and strictly increasing threshold values.

Try Them

• Nginx Reverse Proxy Wizard — generate upstream, location, WebSocket, and SSL server blocks.
• Traefik Router Generator — compose router rules, services, and middlewares YAML.
• Linux Sysctl Tuner — compute BDP-based buffers and profile-tuned sysctl.conf.
• PromQL Builder & Validator — build rate and histogram queries plus alert rules.
• Grafana Panel Generator — scaffold panel JSON with thresholds and datasources.