How to setup Nginx reverse proxy for VIAaaS?

[ShayBox]

I would have used a Discussion thread but it appears the permission to create new threads is disabled.

I'm trying to host a public instance of VIAaaS at https://shay.loan but I'm getting WebSocket connect: disconnected: 1006
I need to reverse proxy it through Nginx, this is my current config based on looking at many, many search results, but no matter what I try I can't get the websocket to work

server {
        server_name shay.loan;

        location / {
                proxy_pass https://127.0.0.1:25543;
                proxy_buffering off;
                include proxy_params;
        }

        location /ws {
                proxy_pass http://127.0.0.1:25543/ws;
                proxy_buffering off;
                include proxy_params;

                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
        }

}

[ShayBox]

I was finally able to get it to work! I had to enable Lets Encrypt SSL on Nginx with certbot and switch the proxy_pass to https:// and enable Full SSL on Cloudflare
This is my working config

server {
        server_name shay.loan;

        location / {
                proxy_pass https://127.0.0.1:25543;
                proxy_buffering off;
                include proxy_params;
        }

        location /ws {
                proxy_pass https://127.0.0.1:25543/ws;
                proxy_buffering off;
                include proxy_params;

                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
        }
}

[ShayBox]

I did notice a bug where adding a Microsoft account, the redirect is back to the instance running on this github which doesn't add the account to either instance, I have to manually swap the url to mine in the bar to get it to work.

[ShayBox]

I'm also unable to connect to TCPShield servers, that can be worked around somehow, unsure exactly how though, other proxies get around this.