Nginx config generator

Fill in your domain and say whether nginx should serve files or pass requests to an app. You get a server block to put in /etc/nginx/conf.d or sites-available.

nginx config

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css text/xml application/json application/javascript application/xml image/svg+xml;

    root /var/www/example.com/html;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }

    location ~* \.(?:css|js|png|jpe?g|gif|webp|svg|ico|woff2?)$ {
        expires 30d;
        add_header Cache-Control "public";
    }
}

Test before you reload: run nginx -t, then reload nginx. The certificate paths assume Let's Encrypt (certbot) and the files must exist before nginx will start with them. Check the nginx documentation for your version.

Runs in your browser: nothing you enter is sent anywhere.

How to use it

Enter the domain and choose static files or a reverse proxy.
For static files set the document root. For a proxy enter the address of your app.
Choose HTTPS, gzip and caching.
Copy the result, save it in your nginx configuration, run nginx -t and reload.

What you get

A server block with server_name for the domain, and optionally its www form.
With HTTPS: a second block on port 80 that redirects to https://$host$request_uri, and a TLS block with ssl_certificate paths and TLS 1.2 and 1.3.
Gzip for text-based types, with gzip_vary on.
For static sites: try_files, optionally falling back to /index.html, and expires 30d for common asset types.
For a proxy: proxy_pass with Host, X-Real-IP, X-Forwarded-For and X-Forwarded-Proto headers.

Example

Domain example.com, reverse proxy to http://127.0.0.1:3000 with HTTPS gives a redirect block and a TLS block whose location / passes requests to port 3000.

Tips

Caching for 30 days works best with file names that change when content changes, such as app.3f2a.js.
On nginx 1.25.1 and newer you can add http2 on; to the TLS block.

Frequently asked questions

Where do I put the generated file?

On Debian and Ubuntu, save it in /etc/nginx/sites-available/ and link it into sites-enabled/. On other systems, or inside Docker, a file in /etc/nginx/conf.d/ ending in .conf is read. Then run nginx -t and reload.

Why are there two server blocks with HTTPS on?

The first listens on port 80 and answers every request with a 301 redirect to the https address. The second listens on port 443 with the certificate and serves the site.

How do I get the certificate?

The paths follow the layout certbot uses, /etc/letsencrypt/live/your-domain/. Certbot can create the files first; nginx will not start with certificate paths that do not exist. If you issue them another way, change the two paths.

What does the WebSocket option add?

It forwards the Upgrade and Connection headers and uses HTTP/1.1 to the upstream, which a WebSocket handshake needs.

Is the output safe to use as is?

It is a sound starting point, not a security review. Values you type are checked so they cannot add extra directives, but tune headers, limits and TLS options for your site.

More in Developer

All tools in this category: Developer ·Updated November 3, 2026