Nginx Config Generator — Free Online Tool

What is Nginx Configuration Generator (Reverse Proxy, SSL, Load Balancing)?

Nginx configuration generator creates server blocks (virtual hosts) for common use cases: reverse proxy (proxy_pass to backend), SSL/TLS certificates (HTTPS with Let's Encrypt), load balancing (upstream servers), static file serving (root directive), caching (proxy_cache), rate limiting (limit_req), security headers (X-Frame-Options, CSP). Tool generates nginx.conf or site configuration files (/etc/nginx/sites-available/) with best practices: HTTP to HTTPS redirect, strong SSL ciphers (TLS 1.2+), gzip compression, security headers, access/error logs. Useful for: deploying Node.js/Python apps (reverse proxy to localhost:3000), SSL setup (certbot integration), CDN alternative (Nginx caching), API gateway (rate limiting, CORS headers), static sites (SPA serving, try_files). Works with Nginx (open-source), Nginx Plus (commercial), OpenResty (Nginx + Lua).

• Reverse proxy configuration: proxy_pass http://localhost:3000 (forward to backend Node.js, Python, Go app). proxy_set_header for headers (Host, X-Real-IP, X-Forwarded-For). WebSocket support (upgrade headers).
• SSL/TLS setup: HTTPS with certificates: ssl_certificate, ssl_certificate_key. Let's Encrypt integration (certbot --nginx). Strong ciphers (TLS 1.2+, disable SSLv3), OCSP stapling, HTTP Strict Transport Security (HSTS).
• Load balancing: upstream block: multiple backend servers (backend1:3000, backend2:3000). Load balancing methods: round-robin (default), least_conn (least connections), ip_hash (session persistence). Health checks.
• Caching: proxy_cache (cache backend responses), proxy_cache_valid (TTL: 200 1h, 404 10m). Cache bypass (query params, cookies). Reduces backend load, faster response times.
• Security & rate limiting: Rate limiting: limit_req_zone (requests per IP), limit_conn (concurrent connections). Security headers: X-Frame-Options (prevent clickjacking), X-Content-Type-Options (MIME sniffing), CSP (Content Security Policy).

Why use nginx config?

Writing Nginx config manually is complex (syntax errors, performance issues, security gaps). This tool generates production-ready configurations.

• Avoid syntax errors: Nginx config is sensitive (missing semicolon = error). Tool validates syntax, generates correct config. Test: nginx -t before reload.
• Best practices built-in: SSL ciphers (TLS 1.2+, disable weak ciphers), gzip compression (text/html, text/css, text/javascript), security headers (X-Frame-Options, HSTS), access logs (/var/log/nginx/access.log).
• Reverse proxy for apps: Deploy Node.js, Python, Go apps behind Nginx. Nginx handles SSL, static files, caching. Backend focuses on app logic. Example: Nginx on port 80/443 → proxy_pass to localhost:3000 (Node.js).
• SSL/HTTPS setup: Free SSL with Let's Encrypt (certbot --nginx). Nginx config: ssl_certificate, ssl_certificate_key, HTTP → HTTPS redirect (301). HTTPS = SEO boost, user trust, required for modern web (PWA, HTTP/2).
• Load balancing: Distribute traffic across multiple backend servers (horizontal scaling). Nginx upstream: backend1, backend2, backend3. Automatic failover (health checks). No single point of failure.
• Caching & performance: Nginx caches backend responses (proxy_cache). Reduces backend load (fewer requests), faster response (serve from cache). Example: cache API responses for 1 hour (proxy_cache_valid 200 1h).

When to use nginx config

Use whenever you deploy web applications, APIs, or static sites with Nginx.

• Reverse proxy for Node.js, Python, Go apps (Nginx on port 80/443 → app on localhost:3000).
• SSL/HTTPS setup (Let's Encrypt certificates, HTTP → HTTPS redirect).
• Load balancing (multiple backend servers, horizontal scaling, failover).
• Static file serving (SPA: React, Vue, Angular; try_files for client-side routing).
• API gateway (rate limiting, CORS headers, authentication).
• Caching (reduce backend load, CDN alternative, faster response).
• WebSocket proxy (upgrade headers for Socket.IO, WebRTC).
• Security (DDoS protection, rate limiting, security headers).

How to use nginx config

Select use case, configure options, generate nginx.conf.

1. Choose configuration type: Reverse proxy (Node.js, Python app), SSL/HTTPS (Let's Encrypt), load balancing (upstream servers), static files (SPA), API gateway (rate limiting, CORS). Or start with blank template.
2. Configure server block: server_name (domain: example.com, www.example.com), listen (port: 80, 443), root (static files: /var/www/html), index (index.html, index.php).
3. Add reverse proxy (if applicable): location /: proxy_pass http://localhost:3000 (backend app). proxy_set_header Host $host, X-Real-IP $remote_addr, X-Forwarded-For $proxy_add_x_forwarded_for. WebSocket: upgrade headers.
4. Enable SSL/HTTPS (optional): ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem, ssl_certificate_key privkey.pem. ssl_protocols TLSv1.2 TLSv1.3, ssl_ciphers (strong). HTTP → HTTPS redirect (return 301).
5. Add load balancing (optional): upstream backend { server backend1:3000; server backend2:3000; }. proxy_pass http://backend. Load balancing method: round-robin, least_conn, ip_hash.
6. Configure caching (optional): proxy_cache_path /var/cache/nginx, proxy_cache my_cache. proxy_cache_valid 200 1h, 404 10m. Cache bypass: $arg_nocache (query param), $cookie_nocache.
7. Generate and test: Click Generate to get config. Save to /etc/nginx/sites-available/example.com. Test: sudo nginx -t (check syntax). Reload: sudo systemctl reload nginx.

Key features

• Reverse proxy templates: Node.js, Python, Go, Ruby, PHP-FPM. proxy_pass, proxy_set_header (Host, X-Real-IP), WebSocket support (upgrade headers). Production-ready config.
• SSL/TLS configuration: Let's Encrypt integration, strong ciphers (TLS 1.2+), HTTP → HTTPS redirect (301), HSTS (Strict-Transport-Security), OCSP stapling. A+ SSL Labs rating.
• Load balancing: upstream block (multiple servers), methods (round-robin, least_conn, ip_hash), health checks (max_fails, fail_timeout), sticky sessions (ip_hash).
• Static file serving: root directive (/var/www/html), try_files (SPA client-side routing: try_files $uri /index.html), gzip compression (text/html, text/css, application/javascript).
• Caching: proxy_cache (cache backend responses), proxy_cache_valid (TTL), cache bypass (query params, cookies), cache purging. Reduces backend load 50-90%.
• Rate limiting: limit_req_zone (requests per IP: 10r/s), limit_conn (concurrent connections: 10), burst (allow bursts), nodelay (no queueing). DDoS protection.
• Security headers: X-Frame-Options (DENY or SAMEORIGIN), X-Content-Type-Options (nosniff), X-XSS-Protection (1; mode=block), Content-Security-Policy (CSP), Referrer-Policy.

Common use cases

• Node.js app reverse proxy: Nginx on port 80/443 → proxy_pass to localhost:3000 (Express, Next.js). Nginx handles SSL, static files, gzip. Node.js serves API, SSR. Example: server { listen 80; proxy_pass http://localhost:3000; }.
• Let's Encrypt SSL: Run certbot --nginx to get free SSL certificate. Nginx config auto-updated: ssl_certificate, ssl_certificate_key. HTTP → HTTPS redirect (301). HTTPS on port 443, HTTP redirects.
• Load balancing (3 servers): upstream backend { server backend1:3000; server backend2:3000; server backend3:3000; }. location /: proxy_pass http://backend;. Round-robin distribution (default). Health checks: max_fails 3, fail_timeout 30s.
• SPA serving (React, Vue): root /var/www/html; try_files $uri /index.html;. Serves static files from /var/www/html. Fallback to /index.html (client-side routing). Gzip: gzip_types text/css application/javascript.
• API rate limiting: limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;. location /api: limit_req zone=api burst=20 nodelay;. Limits: 10 requests/sec per IP, burst up to 20. DDoS protection.
• WebSocket proxy: proxy_pass http://localhost:3000; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection 'upgrade';. Required for Socket.IO, WebRTC. Upgrades HTTP to WebSocket.

Examples

Common Nginx configuration examples.

Node.js app on localhost:3000, Nginx on port 80

server { listen 80; server_name example.com; location / { proxy_pass http://localhost:3000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; }
}

SSL certificate from Let's Encrypt

server { listen 443 ssl; server_name example.com; ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3;
}
server { listen 80; server_name example.com; return 301 https://$host$request_uri;
}

3 backend servers: backend1:3000, backend2:3000, backend3:3000

upstream backend { server backend1:3000; server backend2:3000; server backend3:3000;
}
server { listen 80; location / { proxy_pass http://backend; }
}

React SPA with client-side routing

server { listen 80; root /var/www/html; index index.html; location / { try_files $uri /index.html; }
}

Limit API to 10 requests/sec per IP

limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
server { listen 80; location /api { limit_req zone=api burst=20 nodelay; proxy_pass http://localhost:3000; }
}

Technical reference

Nginx configuration directives and best practices:

server block

Virtual host. server { listen 80; server_name example.com; ... }. Multiple server blocks = multiple sites on one Nginx instance. Default: /etc/nginx/sites-available/ (Debian/Ubuntu).

listen

Port to listen on: listen 80 (HTTP), listen 443 ssl (HTTPS). IPv6: listen [::]:80. Default server: listen 80 default_server (catch-all).

server_name

Domain: example.com, www.example.com. Wildcard: *.example.com. Regex: ~^(.+)\.example\.com$. Multiple: server_name example.com www.example.com; (space-separated).

root

Document root: root /var/www/html;. Serves static files from this directory. Combine with try_files for SPA routing.

location

URL matching: location / (prefix match), location = /exact (exact match), location ~ \.php$ (regex), location ^~ /static (priority prefix). Nested locations allowed.

proxy_pass

Reverse proxy: proxy_pass http://localhost:3000;. Forwards requests to backend. Trailing slash matters: /api → /api, /api/ → /.

proxy_set_header

Set headers: proxy_set_header Host $host; (preserve hostname), proxy_set_header X-Real-IP $remote_addr; (client IP), X-Forwarded-For $proxy_add_x_forwarded_for; (proxy chain).

upstream

Load balancing: upstream backend { server backend1:3000; server backend2:3000; }. Methods: round-robin (default), least_conn, ip_hash. Health: max_fails 3, fail_timeout 30s.

ssl_certificate

SSL cert: ssl_certificate /path/to/fullchain.pem;. ssl_certificate_key /path/to/privkey.pem;. Let's Encrypt: /etc/letsencrypt/live/example.com/. Test: openssl s_client -connect example.com:443.

return 301

HTTP → HTTPS redirect: if ($scheme != 'https') { return 301 https://$host$request_uri; }. Or server block: listen 80; return 301 https://$host$request_uri;. 301 = permanent redirect.

Common mistakes to avoid

Missing semicolon at end of directives (syntax error)

Why it happens: Nginx requires semicolon after most directives: listen 80;, server_name example.com;. Missing semicolon = 'unexpected end of file' or 'unexpected token' error. Common when copy-pasting.

How to avoid it: Add semicolon after directives. Test config: sudo nginx -t (shows line number of syntax error). Most directives need semicolon, blocks ({ }) don't.

Wrong proxy_pass trailing slash (breaks URL paths)

Why it happens: proxy_pass http://localhost:3000 (no slash) → /api/users → http://localhost:3000/api/users. proxy_pass http://localhost:3000/ (slash) → /api/users → http://localhost:3000/users (strips /api). Trailing slash changes path rewriting.

How to avoid it: No trailing slash: proxy_pass http://localhost:3000; (keeps full path). Trailing slash: proxy_pass http://localhost:3000/; (strips location path). Choose based on backend routing.

Not testing config before reload (breaks production site)

Why it happens: Invalid config + nginx reload = Nginx fails to start, site goes down. Common errors: syntax, file paths (SSL cert not found), port conflicts. Reloading without testing = risky.

How to avoid it: Always test before reload: sudo nginx -t (checks syntax, file paths). If OK, reload: sudo systemctl reload nginx or sudo nginx -s reload. Test catches errors before production impact.

Using if ($scheme != 'https') in location block (causes issues)

Why it happens: Nginx if is tricky (not if in programming sense). if in location can break (unexpected behavior, rewrite issues). Nginx docs: 'if is evil'. Use separate server blocks for HTTP/HTTPS instead.

How to avoid it: HTTP → HTTPS redirect: use separate server block (listen 80; return 301 https://$host$request_uri;). Don't use if in location. Or use if only for simple cases (return, rewrite).

Forgetting proxy_set_header (backend doesn't see real client IP)

Why it happens: Without proxy_set_header, backend sees Nginx IP (127.0.0.1), not client IP. Logs show all requests from localhost. Can't block IPs, geolocation, rate limiting by client IP fails.

How to avoid it: Add headers: proxy_set_header Host $host; (preserve hostname), proxy_set_header X-Real-IP $remote_addr; (client IP), proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; (proxy chain). Backend reads from headers.

Frequently asked questions

What is the difference between Apache and Nginx?

Apache = process-based (one process per connection). Nginx = event-driven (asynchronous, handles many connections per process). Nginx = better performance for static files, reverse proxy, high concurrency. Apache = easier .htaccess config, better PHP support (mod_php).

Where do I put Nginx configuration files?

Main config: /etc/nginx/nginx.conf. Site configs: /etc/nginx/sites-available/ (Debian/Ubuntu) or /etc/nginx/conf.d/ (RedHat/CentOS). Enable site: symlink to /etc/nginx/sites-enabled/. Reload: sudo systemctl reload nginx.

How do I test Nginx config before reloading?

Run: sudo nginx -t. Checks syntax, file paths (SSL cert), upstream servers. Output: 'syntax is ok, test is successful' = safe to reload. Errors show line number, directive. Fix errors, test again, then reload.

What is upstream in Nginx?

upstream defines backend servers for load balancing: upstream backend { server backend1:3000; server backend2:3000; }. Use with proxy_pass http://backend;. Load balancing methods: round-robin (default), least_conn (least connections), ip_hash (sticky sessions).

How do I enable HTTPS with Let's Encrypt?

Install certbot: sudo apt install certbot python3-certbot-nginx. Run: sudo certbot --nginx -d example.com. Certbot auto-updates Nginx config (ssl_certificate, ssl_certificate_key), sets up HTTP → HTTPS redirect. Cert auto-renews (cron job).

What is try_files and when to use it?

try_files checks files in order, serves first match. Example: try_files $uri /index.html; (serve file if exists, else /index.html). Use for SPA client-side routing (React Router, Vue Router). Without try_files, direct URLs (example.com/about) → 404.

How do I debug Nginx 502 Bad Gateway?

502 = Nginx can't reach backend (proxy_pass). Check: backend running? (curl localhost:3000), firewall blocking?, wrong port?, backend crashed?. Check logs: /var/log/nginx/error.log (connection refused, timeout). Fix backend, restart Nginx.

References

• Nginx Documentation
• Nginx Beginner's Guide
• Let's Encrypt Certbot
• Nginx Reverse Proxy Guide