← All tools

nginx Reverse-Proxy Generator

A proxy server block with TLS, websockets and redirects — commented line by line.

Why this exists

The same ten lines of nginx sit in front of almost every web app, and the pitfalls repeat: missing proxy headers so the app logs 127.0.0.1 for every visitor, no websocket upgrade so live features silently die, TLS configured but port 80 left serving content. Generate the block, read what each line does, then nginx -t before reload.

🔒 Runs in your browser — nothing is sent anywhere
server block
# Port 80 exists only to send everyone to HTTPS — it serves no content.
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name example.com www.example.com;

    # fullchain = your certificate first, then the intermediates —
    # the chain-order trap. Verify the pair with the key matcher first.
    ssl_certificate /etc/ssl/fullchain.pem;
    ssl_certificate_key /etc/ssl/server.key;

    # Uploads larger than this get a 413 before your app ever sees them.
    client_max_body_size 20m;

    location / {
        proxy_pass http://127.0.0.1:3000;
        # Without these, the app sees every request as coming from
        # 127.0.0.1 over http — breaks logs, rate limiting and redirects.
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}
Deploy
sudo tee /etc/nginx/sites-available/example.com.conf > /dev/null  # paste the config
sudo ln -s /etc/nginx/sites-available/example.com.conf /etc/nginx/sites-enabled/
sudo nginx -t          # ALWAYS test before reloading
sudo systemctl reload nginx   # reload, not restart — keeps connections alive
Learn the theory
📚 Deploying TLS & the chain-order trap