diff --git a/templates/nginx.default.conf.j2 b/templates/nginx.default.conf.j2
index 00974f5..85ccb94 100644
--- a/templates/nginx.default.conf.j2
+++ b/templates/nginx.default.conf.j2
@@ -24,14 +24,92 @@ server {
 {% endif %}
 
   location /wicket/resource/ {
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    # Required for new HTTP-based CLI
+    proxy_request_buffering off;
+    proxy_buffering off; # Required for HTTP-based CLI to work over SSL
+    proxy_set_header Connection ""; # Clear for keepalive
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Forwarded-Server $host;
+    proxy_set_header X-Forwarded-Port $server_port;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Original-URI $request_uri;
+    proxy_set_header Authorization "Bearer $auth_token";
+    proxy_set_header remote_user "$remote_user";
     proxy_pass http://_inception-server;
   }
 
   location /favicon.ico {
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    # Required for new HTTP-based CLI
+    proxy_request_buffering off;
+    proxy_buffering off; # Required for HTTP-based CLI to work over SSL
+    proxy_set_header Connection ""; # Clear for keepalive
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Forwarded-Server $host;
+    proxy_set_header X-Forwarded-Port $server_port;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Original-URI $request_uri;
+    proxy_set_header Authorization "Bearer $auth_token";
+    proxy_set_header remote_user "$remote_user";
+    proxy_pass http://_inception-server;
+  }
+
+  location /favicon.png {
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    # Required for new HTTP-based CLI
+    proxy_request_buffering off;
+    proxy_buffering off; # Required for HTTP-based CLI to work over SSL
+    proxy_set_header Connection ""; # Clear for keepalive
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Forwarded-Server $host;
+    proxy_set_header X-Forwarded-Port $server_port;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Original-URI $request_uri;
+    proxy_set_header Authorization "Bearer $auth_token";
+    proxy_set_header remote_user "$remote_user";
     proxy_pass http://_inception-server;
   }
 
   location /spinner.gif {
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    # Required for new HTTP-based CLI
+    proxy_request_buffering off;
+    proxy_buffering off; # Required for HTTP-based CLI to work over SSL
+    proxy_set_header Connection ""; # Clear for keepalive
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Forwarded-Server $host;
+    proxy_set_header X-Forwarded-Port $server_port;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Original-URI $request_uri;
+    proxy_set_header Authorization "Bearer $auth_token";
+    proxy_set_header remote_user "$remote_user";
+    proxy_pass http://_inception-server;
+  }
+
+  location /images/ {
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    # Required for new HTTP-based CLI
+    proxy_request_buffering off;
+    proxy_buffering off; # Required for HTTP-based CLI to work over SSL
+    proxy_set_header Connection ""; # Clear for keepalive
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Forwarded-Server $host;
+    proxy_set_header X-Forwarded-Port $server_port;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Original-URI $request_uri;
+    proxy_set_header Authorization "Bearer $auth_token";
+    proxy_set_header remote_user "$remote_user";
     proxy_pass http://_inception-server;
   }