Nginx Config Generator

How to use it

1. Enter your domain and choose whether www should work too — one name becomes the main address, the other redirects to it.
2. Pick what nginx serves: an app behind it that speaks HTTP (Node.js, Python, a container) or static files from a folder. PHP-FPM needs FastCGI rules instead: see the guides for WordPress and Laravel.
3. Choose HTTPS: a free Let’s Encrypt certificate, your own certificate, or plain HTTP.
4. Copy the config, then follow the commands under it. They are different on Ubuntu / Debian (sites-available + a link in sites-enabled) and on RHEL / Rocky / AlmaLinux (conf.d).

Always run sudo nginx -t before reloading. If the test fails, nginx keeps running with the old config and tells you the file and line of the problem.

What you get

• Redirects in one place: plain HTTP goes to HTTPS, and the other name (www or not) goes to the main address, with a single 301.
• Modern TLS: TLS 1.2 and 1.3 only, with session settings that work with every current browser.
• Reverse proxy headers: your app receives the real client address (X-Real-IP, X-Forwarded-For) and knows the request came over HTTPS (X-Forwarded-Proto).
• Security headers sent on every response, including error pages.
• Caching: long browser caching for static assets, or an nginx cache in front of your app.

Common commands

sudo nginx -t                           # check every config file
sudo systemctl reload nginx             # apply it without dropping connections
sudo nginx -T | less                    # the full config nginx actually uses
sudo tail -f /var/log/nginx/error.log   # what goes wrong, live
sudo certbot renew --dry-run            # test Let's Encrypt renewal

FAQ

Why does Certbot stop nginx?

The generator uses Certbot’s standalone mode: for a few seconds, Certbot itself answers Let’s Encrypt’s check on port 80, so nginx has to step aside. It works on a fresh server with no config yet, and renewals do the same automatically. If you’d rather not stop nginx, use certbot --webroot instead and serve /.well-known/acme-challenge/ from that folder on port 80.

My app gets 502 Bad Gateway behind nginx

nginx is fine; it can’t reach the app. The error log tells you why — see Nginx “502 Bad Gateway”: find the cause in the error log. On RHEL-family systems, SELinux blocks nginx from connecting to apps until you allow it with sudo setsebool -P httpd_can_network_connect 1.

nginx won’t start: “Address already in use”

Another program already has port 80 or 443 — often Apache. See find who is using port 80.

What does “nginx 1.25.1 or newer” change?

Since 1.25.1, HTTP/2 is turned on with http2 on; and the older listen 443 ssl http2; form prints a warning. Ubuntu 24.04 and RHEL 9 ship older versions, so the option is off by default. Check yours with nginx -v.

The browser says “too many redirects”

Two parts of your setup disagree about the right address, often Cloudflare and the HTTPS redirect. See ERR_TOO_MANY_REDIRECTS.

My site gives a 504 Gateway Time-out

Nginx gave up waiting for your application. Find out what’s slow before raising the limit: see Nginx 504 Gateway Time-out.

Certbot failed to get a certificate

Let’s Encrypt has to reach this server from the internet. The error’s type says what went wrong: see Certbot failed to authenticate.

Is there a guide for my app?

Complete configs, with the app’s own settings: Node.js and Express, Next.js, FastAPI, Django, React or Vite, WordPress, Laravel, Docker Compose and Ghost.

I get a 403 Forbidden

The error log says why: a missing index file, permissions, or SELinux. See Nginx 403 Forbidden. To check the headers you’re really sending, use the HTTP Headers Analyzer.