Thanks for the response! I’ll try out your config suggestions.

In terms of naysayers, Thomas Rücker — Icecast maintainer — has a couple responses against reverse-proxying Icecast:
http://serverfault.com/a/648763
http://serverfault.com/a/739187
http://superuser.com/a/945785
http://stackoverflow.com/a/31858521

And there have been a few other places people have spoken against it:
http://lists.xiph.org/pipermail/icecast/2016-January/013653.html
http://lists.xiph.org/pipermail/icecast/2014-May/012835.html
https://wiki.xiph.org/Icecast_Server/known_reverse_proxy_restrictions

And I’m sure I encountered a few others in my searching that would take some more digging to find. There were a few people that had Apache reverse proxies that were not battle-tested, and someone had a workaround built with Node but that seemed a little hacked together.

Is this the “private repo” you’re referring to for KH? https://github.com/karlheyes/icecast-kh. It seems relatively up-to-date to me.

In response to your second reply, I don’t need NGINX as load balancer. Restrictive network environment means we’re restricted to one outbound port (long story), and I need to reverse proxy a webserver running a simple Flask & WebSockets server to some of the routes.