GrepBoardTools GrepBoard manuals ↗ Log ↗

Tools / Server config

nginx config generator

Pick what the site needs. Settings that must live in the http block (log_format, limit_req_zone) come out as a separate conf.d file.

What you type is calculated only in your browser and is not sent to a server.

Site

Domains this block answers, space separated. _ = any name (catch-all).

Static files from a folder, or pass requests to an app (reverse proxy).

Where the app listens: http://127.0.0.1:3000. No path after the port.

Pass Upgrade/Connection headers and keep idle connections up to 1 hour.

HTTPS

Listen on 443 with a certificate.

Full chain. Empty: the Let’s Encrypt path certbot creates.

Private key. Empty: the Let’s Encrypt path.

A separate port-80 block that sends everyone to https://.

listen … ssl http2 (the form nginx 1.24 on Ubuntu 24.04 understands).

Browsers refuse plain HTTP for a year. Turn on only when HTTPS works on every subdomain you use.

Also listen on [::] (Ubuntu’s default site does).

Limits, compression, logs

Largest upload, e.g. 20m. Empty: nginx default 1m (bigger uploads get 413). 0 = no limit.

Compress text, CSS, JS, JSON and SVG. Ubuntu’s nginx.conf turns gzip on but compresses only HTML.

combined is the default; with timing adds request and upstream times; JSON is one object per line.

nosniff, SAMEORIGIN framing, a referrer policy, and hide the nginx version.

Request rate limit

Limit requests per client IP.

server block — save as /etc/nginx/sites-available/example.com
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com www.example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    access_log /var/log/nginx/example.com.access.log;
    error_log  /var/log/nginx/example.com.error.log;

    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 5;
    gzip_min_length 1024;
    gzip_types text/plain text/css text/xml application/javascript application/json application/xml image/svg+xml;

    server_tokens off;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

What it does

Builds a server block for Ubuntu's /etc/nginx/sites-available/. Choose static files or a reverse proxy, then add HTTPS, upload size, compression, logging, security headers and a request rate limit. Lines that may only live in the http block — log_format, limit_req_zone, the WebSocket map — come out as a separate /etc/nginx/conf.d/ file, named after the site so several sites on one server do not clash.

Examples

You pickLines you get
Reverse proxyproxy_pass http://127.0.0.1:3000; plus Host, X-Forwarded-For, X-Forwarded-Proto headers
WebSocketproxy_set_header Upgrade $http_upgrade; and Connection through a map
HTTP → HTTPSa port-80 block with return 301 https://$host$request_uri;
20 MB uploadsclient_max_body_size 20m; (default 1m, larger requests get 413)
Rate limitlimit_req_zone … rate=10r/s; (conf.d) + limit_req zone=… burst=20 nodelay;
Log with timingrt=$request_time uct=… urt=$upstream_response_time

Common mistakes

  • log_format or limit_req_zone inside a server block — nginx -t rejects them with "directive is not allowed here". They belong in the http block (conf.d/*.conf on Ubuntu).
  • Enabling HTTPS before the certificate exists — nginx -t fails when the ssl_certificate file is missing. Get the certificate first, or start with HTTPS off.
  • server_name _ next to Ubuntu's default site — the default site (sites-enabled/default) also uses _, so nginx warns "conflicting server name". If your block is meant to catch everything, remove the default site's link.
  • burst=0 — nginx rejects 0. To allow no burst, leave burst out (this tool does that for 0).

How it was checked

Before publishing, 52 option combinations were checked with nginx -t from Ubuntu 24.04's nginx 1.24 package, unpacked without installing (no daemon started). The http block repeats Ubuntu's nginx.conf with paths changed, certificates were throwaway self-signed ones, some combinations ran next to Ubuntu's default site, and one run put three sites on the same server. A pass required zero warnings ([warn]) — 66 checks in total. This is a syntax check: whether your app answers still has to be tested.

FAQ

What is the difference between sites-available and sites-enabled?

Ubuntu's nginx.conf reads only sites-enabled/. Keep the file in sites-available/ and enable it with an ln -s link in sites-enabled/. Removing the link turns the site off and keeps the file.

Restart or reload after a change?

Check with sudo nginx -t, then sudo systemctl reload nginx. A reload swaps workers to the new config without dropping open connections, and if the new config is broken nginx keeps running the old one.

Is what I type sent to a server?

No. The config is built in your browser. Domains, paths and upstream addresses are not sent to a server and are not passed to the analytics or ads this site uses. See the privacy notice.

Related manuals on GrepBoard