Nginx config generator — reverse proxy, static site, SPA or HTTPS redirect

How to use the nginx config generator

1. Choose Use: Reverse proxy to an app, Static website, Single-page app, or HTTP → HTTPS redirect only.
2. Enter the Domain and tick Also serve www. if needed.
3. For a proxy, set the App address, such as http://127.0.0.1:3000, and tick WebSocket support if the app uses it. For static sites and SPAs, set the Web root and Long cache for static assets.
4. Choose HTTPS with Let’s Encrypt certificates, gzip compression, Security headers and Max upload size (MB, 0 = default 1 MB).
5. Save the file in /etc/nginx/conf.d/, then run sudo nginx -t && sudo systemctl reload nginx.

What it does and when to use it

nginx sits in front of your app or files and answers web requests. A small setup needs an HTTP-to-HTTPS redirect, a server with a certificate, and the right proxy headers for the app behind it. This tool writes those blocks with current syntax.

Use it when you deploy to a VPS or host a built front end. A Docker setup from the Docker Compose generator can mount this file as its nginx config. On Apache hosting, use the .htaccess generator instead, and add a Content-Security-Policy with the CSP header generator. The official nginx documentation covers every directive.

How it works

• HTTPS on: a port-80 server returns 301 to https://$host$request_uri, and the main server listens on 443 with http2 on;, TLS 1.2 and 1.3, and the Let’s Encrypt paths for your domain.
• Proxy: proxy_pass plus forwarded headers, so your app sees the real visitor IP and scheme.
• Static and SPA: root, index index.html, try_files, an optional one-year cache for assets, and a rule that denies dotfiles except .well-known.
• Security headers: X-Content-Type-Options, Referrer-Policy, X-Frame-Options, plus HSTS when HTTPS is on.

Worked examples

HTTPS reverse proxy (defaults). For example.com with www:

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

then the 443 server with client_max_body_size 10m; and proxy_pass http://127.0.0.1:3000;.

SPA over plain HTTP. Domain app.example.org, no www, web root /srv/app/dist, HTTPS off, upload size 0. The block listens on port 80 only, has root /srv/app/dist; and try_files $uri $uri/ /index.html;, and no client_max_body_size line.

WebSocket app on port 8080. App address 127.0.0.1:8080 (the tool adds http://), headers and gzip off. The location adds proxy_set_header Connection "upgrade"; and the matching Upgrade header.

Limits and tips

• Header inheritance. nginx drops server-level add_header lines inside a location that sets its own. The asset cache block sets Cache-Control, so the tool repeats the security headers there. Do the same in any location you add with its own add_header.
• HSTS is hard to undo. Browsers remember it for a year; enable it only when HTTPS works on every subdomain.
• The certbot command in the note uses your domain, plus the www name when that box is ticked.