DevOps

Nginx Config Generator

Visually generate hardened Nginx server blocks for Reverse Proxies, SPAs, PHP-FPM, and SSL. Optimize gzip compression and security headers instantly.

Generated nginx.conf
# HTTP -> HTTPS Redirect
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com www.example.com;

    # SSL Certificates (Let's Encrypt Certbot default paths)
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    # Logging
    access_log /var/log/nginx/example.com.access.log;
    error_log /var/log/nginx/example.com.error.log warn;

    # Security Headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    # Gzip Compression
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}
Quick Install Instructions

Save as /etc/nginx/sites-available/example.com.conf, then symlink to sites-enabled:

sudo ln -s /etc/nginx/sites-available/example.com.conf /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

Complete Guide to Modern Nginx Server Configurations

Nginx powers over a third of all websites on the internet, yet crafting a secure, performant `nginx.conf` file manually remains intimidating. A single missing `proxy_set_header` or improper `try_files` order can cause broken WebSocket connections, routing loops, or security vulnerabilities like clickjacking.

1. Reverse Proxy for Modern App Frameworks

When routing incoming requests to a Node.js, Next.js, FastAPI, Flask, or Go service running on an internal port (e.g. `127.0.0.1:3000`), Nginx acts as the gatekeeper. It terminates SSL, buffers large client uploads, and forwards client headers.

location / {
    proxy_pass http://127.0.0.1:3000;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}

2. Single Page Application (SPA) Routing & Caching

Single Page Applications compiled with Vite, Webpack, or CRA produce static assets with unique content hashes. Our SPA preset automatically adds 1-year immutable caching headers to fonts, images, and compiled bundles while preventing caching on `index.html`.

3. Hardened Security Headers & Gzip Compression

Default Nginx installations omit essential security headers. Our generator automatically emits `X-Frame-Options: SAMEORIGIN` (mitigates clickjacking), `X-Content-Type-Options: nosniff` (stops MIME sniffing), and `Strict-Transport-Security` (forces HTTPS).

How to Use

  1. 1

    Select Configuration Preset

    Choose Reverse Proxy for Node/Python/Go apps, SPA for React/Vue, or PHP-FPM for Laravel/WordPress.

  2. 2

    Enter Domain & Port

    Specify your domain name (e.g. example.com) and your internal backend upstream port.

  3. 3

    Enable SSL & Security

    Toggle Let's Encrypt SSL paths, HTTP/2, HSTS, gzip compression, and security headers.

  4. 4

    Copy or Download

    Copy the config directly to your clipboard or download it as a .conf file ready for /etc/nginx/sites-available.

Frequently Asked Questions

How do I configure Nginx as a reverse proxy for a Node.js or Python backend?+

Select the 'Reverse Proxy' preset, set your upstream URL (e.g. http://127.0.0.1:3000), and enable WebSocket support. The generated config includes proxy_pass, Host, and X-Forwarded-For headers so your backend receives the real client IP.

Why do Single Page Apps (React/Vue/Vite) need try_files $uri $uri/ /index.html?+

When a user refreshes a sub-route (e.g. /dashboard) on a client-side SPA, Nginx looks for a physical directory named /dashboard. The 'try_files $uri $uri/ /index.html' directive instructs Nginx to fall back to index.html so React Router or Vue Router can handle the client-side routing instead of returning a 404.

Where do I save the generated nginx.conf file on Ubuntu/Debian?+

Save it to '/etc/nginx/sites-available/yourdomain.com.conf'. Then create a symbolic link in '/etc/nginx/sites-enabled/': 'sudo ln -s /etc/nginx/sites-available/yourdomain.com.conf /etc/nginx/sites-enabled/'. Test with 'sudo nginx -t' and reload with 'sudo systemctl reload nginx'.

Does this tool automatically include Let's Encrypt SSL paths?+

Yes. When SSL is enabled, the generator pre-configures standard Certbot paths ('/etc/letsencrypt/live/domain/fullchain.pem' and 'privkey.pem') alongside HTTP/2 and modern TLS cipher suites.