Here’s a new NGINX config which works very well for my purposes:
proxy_cache_path /var/cache/nginx/homeassistant_ingress keys_zone=homeassistant_ingress:1m max_size=2m; # cache for access tokens
map $http_upgrade $connection_upgrade { # handles websocket request to has backend
default upgrade;
'' close;
}
server {
include snippets/server.conf;
include snippets/ssl.conf;
listen 443 ssl http2;
server_name myhass.domain.tld;
set $homeassistant 'http://homeassistant:8123'; # homeassistant backend
location ~ '^/ingress/app1/(?<bearer>[^/]+)' { # Adds a subdir in the format https://myhass.domain.tld/ingress/app1/longlivedaccesstoken-from-has/ and extracts the access token to variable bearer
set $ingress 'http://192.168.1.14:80'; # Proxy backend
proxy_set_header Authorization "Basic xxxxxxxxxxxxxxxxxx"; # Adds basic auth to proxy backend, if needed
rewrite ^/ingress/[^/]+/[^/]+(/.*)$ $1 break; # rewrites /ingress/app1/token to /
auth_request /ingress/authorize; # validate has access token
proxy_pass $ingress; # proxy pass to backend
}
location ~ '^/ingress/zwave/(?<bearer>[^/]+)' { # Adds a subdir in the format https://myhass.domain.tld/ingress/zwave/longlivedaccesstoken-from-has/ and extracts the access token to variable bearer
set $ingress 'http://zwave:8091'; # zwave2mqtt backend
proxy_set_header X-External-Path $request_uri; # required for zwave2mqtt - see manual on github
rewrite ^/ingress/[^/]+/[^/]+(/.*)$ $1 break; # rewrites /ingress/zwave/token to /
auth_request /ingress/authorize; # validate has access token
proxy_pass $ingress; # proxy pass to backend
}
location ~ '^/ingress/authorize$' { # checks access token using has api
proxy_pass_request_body off; # disable body, because not needed
proxy_set_header Content-Length "";
proxy_set_header Authorization "Bearer $bearer"; # adds bearer token from above (has long lived access token) to the request
proxy_cache homeassistant_ingress; # name of proxy cache (1st line)
proxy_cache_key $bearer; # item to cache
proxy_cache_valid 200 60s; # caches successful checked tokens for 1 minute. so we dont't have to call has api for every request
proxy_ignore_headers Cache-Control Expires Set-Cookie; # ignores cache header. required for caching the token
internal; # makes site not accessable form external
proxy_pass $homeassistant/api/; # proxy pass to hass api
}
location ~ '^/' { # location for has webinterface
include snippets/proxy.conf;
proxy_pass $homeassistant;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
}
So after you got a long lived access token from has, you can add a iframe panel to lovelace ui with the following url: /ingress/zwave/39q48pzm59t8qg34938434pq83z3485 mz239453485435/
asuming your token is 39q48pzm59t8qg34938434pq83z3485 mz239453485435
Please notice the slash after the access token.
for futher questions feel free to ask me 
