Nginx config generator
Pick a pattern and options and get a complete, commented-by-notes nginx server block with sensible TLS and proxy defaults.
An nginx server block you can trust
nginx configuration is concise but unforgiving. A missing proxy_set_header, a trailing slash in the wrong place in proxy_pass, or a forgotten always on an add_header line can cost an afternoon. Most deployments need the same few patterns: a reverse proxy for an application server, a static site, a single-page app, TLS with a redirect from HTTP, compression and sane security headers.
Choose the pattern, enter the server name and upstream (or web root), and tick the features you want. The generator writes a complete server block with an upstream for the backend, HTTP to HTTPS redirect, modern TLS settings (TLS 1.2 and 1.3), HTTP/2, HSTS, gzip, security headers, proxy headers, WebSocket support, optional rate limiting and load balancing across several backends. Single-page apps get the try_files fallback to index.html and long-lived caching for fingerprinted assets.
Behaviour worth knowing
proxy_pass http://backend;forwards the original path;proxy_pass http://backend/app/;rewrites the matched location prefix.add_headerlines in a location replace the ones inherited from the server block; repeat them where needed.- WebSockets need HTTP/1.1 and the
UpgradeandConnectionheaders. - The
http2 on;directive requires nginx 1.25.1 or later; older versions uselisten 443 ssl http2;.
The certificate paths follow the Let's Encrypt (certbot) layout; change them if yours differ. Review the file against your distribution's nginx version, then test with nginx -t. Nothing you enter leaves your browser.
Frequently asked questions
Why does the config use an upstream block?
An upstream names a group of backend servers. It lets nginx keep connections to the backend open (keepalive), balance across several servers and change the backend in one place. With one server it still helps with connection reuse.
What are the X-Forwarded headers for?
Behind a proxy the application sees nginx as the client. X-Forwarded-For carries the real client address and X-Forwarded-Proto the original scheme (http or https). Frameworks such as Spring Boot need to be told to trust them (server.forward-headers-strategy).
Why is the HTTP to HTTPS redirect a separate server block?
Port 80 and port 443 are different listeners. A small server block on port 80 answers every request with a 301 to the HTTPS URL, keeping the main block free of redirect logic.
How do I test the configuration safely?
Run sudo nginx -t to check the syntax, then sudo systemctl reload nginx, which applies the change without dropping connections.