Nginx Config Generator
Generate Nginx reverse proxy configs with SSL, gzip, and caching.
Last updated: August 2026
server {
listen 80;
server_name www.example.com;
return 301 https://example.com$request_uri;
}
server {
listen 80;
server_name example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl http2;
server_name example.com;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
gzip on;
gzip_types text/plain text/css application/json application/javascript text/xml;
gzip_min_length 256;
location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff2?)$ {
expires 30d;
add_header Cache-Control "public, immutable";
}
location / {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
Was this tool helpful?
Generating a reverse proxy block
This generator builds an Nginx server block that terminates TLS, forwards requests to an upstream application, and optionally enables gzip and static caching. Rather than memorizing directive names and their exact placement, you describe the upstream, the domain, and the certificate paths, and it emits a config you can drop into sites-available.
When you reach for it
Typical when putting Nginx in front of a Node, Python, or Go service that listens on a local port, when adding HTTPS to an app that only speaks HTTP, or when standing up a new site and you want sensible compression and header defaults without hand-writing the whole file.
Example
server {
listen 443 ssl;
server_name app.example.com;
ssl_certificate /etc/letsencrypt/live/app.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/app.example.com/privkey.pem;
gzip on;
gzip_types text/css application/javascript application/json;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}Common pitfalls
The famous one is the trailing slash on proxy_pass. With proxy_pass http://backend/; (trailing slash) Nginx strips the matched location prefix before forwarding; without it, the full original path is passed through. That single slash decides whether /api/users hits the upstream as /users or /api/users, and it is the usual cause of mystery 404s behind a proxy. Also remember to forward X-Forwarded-Proto, or an app behind TLS will think requests arrived over plain HTTP and may build broken redirect URLs.
FAQ
Why does my app see HTTP instead of HTTPS? Nginx terminated TLS, so set X-Forwarded-Proto $scheme and configure the app to trust it.
WebSockets drop after upgrading, why? You need to pass the Upgrade and Connection headers in the location block, otherwise the connection falls back to plain HTTP.
Which cert file goes where? Use the full chain for ssl_certificate, not just the leaf, so the intermediate is sent. Verify it afterward with the SSL checker.