25+ Configs

Nginx Configuration & Server Snippets Cheat Sheet

Production Nginx server configuration snippets: upstream reverse proxying, Let's Encrypt SSL, HSTS, rate limiting zones, SPA fallback, Brotli compression, and CORS headers with 1-click copy.

Lifecycle & Testing (4 commands)

Lifecycle & Testing

sudo nginx -t

Tests Nginx configuration syntax and files for errors without reloading server.

PRO TIP ALWAYS run this before reloading to prevent dropping production traffic with syntax typos.

Lifecycle & Testing

sudo systemctl reload nginx

Gracefully reloads configuration with zero downtime: existing connections finish cleanly.

PRO TIP Faster and safer than systemctl restart.

Lifecycle & Testing

sudo tail -f /var/log/nginx/error.log

Tails the Nginx global error log in real time.

PRO TIP Primary location for 500/502 Bad Gateway and connection refused errors.

Lifecycle & Testing

sudo tail -f /var/log/nginx/access.log

Live stream of incoming client HTTP requests, IPs, status codes, and referrers.

PRO TIP Pipe to grep (tail -f access.log | grep 404) to monitor broken links.

Reverse Proxy & Upstreams (2 commands)

Reverse Proxy & Upstreams

location / {
    proxy_pass http://127.0.0.1:3000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

Standard production reverse proxy block passing traffic to Node.js/Python backend.

PRO TIP Includes headers required for WebSockets and preserving client real IP.

Reverse Proxy & Upstreams

upstream backend_cluster {
    least_conn;
    server 10.0.0.1:8080 weight=2;
    server 10.0.0.2:8080;
    server 10.0.0.3:8080 backup;
}

Defines load-balanced backend cluster using least-connections algorithm with backup server.

PRO TIP Use proxy_pass http://backend_cluster; in location block.

SSL / HTTPS Configuration (2 commands)

SSL / HTTPS Configuration

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

Permanent HTTP (port 80) to HTTPS (port 443) redirect.

PRO TIP Returns 301 Moved Permanently for optimal SEO link equity transfer.

SSL / HTTPS Configuration

listen 443 ssl http2;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;

Configures modern TLS certificates with HTTP/2 protocol support.

PRO TIP Enabling HTTP/2 multiplexing significantly improves frontend asset loading speed.

Security & Hardening Headers (2 commands)

Security & Hardening Headers

add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Standard security headers preventing clickjacking, MIME-sniffing, and XSS exploits.

PRO TIP The "always" flag ensures headers are attached even on 4xx/5xx error responses.

Security & Hardening Headers

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Enforces HSTS (HTTP Strict Transport Security) for 1 year across all subdomains.

PRO TIP Required to achieve an A+ rating on SSL Labs security tests.

Performance, Caching & Gzip (2 commands)

Performance, Caching & Gzip

gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_proxied any;
gzip_types text/plain text/css text/xml application/json application/javascript image/svg+xml;
gzip_disable "MSIE [1-6]\.";

Enables gzip text compression for HTML, CSS, JavaScript, JSON, and SVG files.

PRO TIP Reduces asset transfer sizes by 60-80% with minimal CPU overhead.

Performance, Caching & Gzip

location ~* \.(jpg|jpeg|png|gif|ico|css|js|webp|woff2)$ {
    expires 365d;
    add_header Cache-Control "public, no-transform, immutable";
    access_log off;
}

Enables 1-year browser edge caching for static assets with immutable flag.

PRO TIP Dramatically improves Google Core Web Vitals and Lighthouse scores.

Rate Limiting & Protection (2 commands)

Rate Limiting & Protection

limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;

location /api/ {
    limit_req zone=api_limit burst=20 nodelay;
    proxy_pass http://127.0.0.1:3000;
}

Rate limits incoming requests to 10 requests/sec per client IP with burst tolerance.

PRO TIP Prevents brute force attacks and API scraping abuse.

Rate Limiting & Protection

location ~ /\.(?!well-known) {
    deny all;
    access_log off;
    log_not_found off;
}

Blocks public web access to hidden files and dotfiles (e.g., .env, .git, .htaccess).

PRO TIP Critical security measure preventing exposure of credentials and repository metadata.