Nginx Config Generator

Build an nginx server block for a static site, SPA, reverse proxy, or PHP app — with TLS, caching, and security headers.

Options

example.com.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
  • Save to /etc/nginx/sites-available/, symlink into sites-enabled/, then run nginx -t before systemctl reload nginx.
  • nginx -t is not optional — a reload with a bad config fails and can leave you serving nothing.
  • The Let's Encrypt paths assume certbot has already issued a certificate for this domain. The ACME challenge location is served over HTTP so renewals keep working.
  • Rate limiting declares a zone in the http context — move that line into nginx.conf if you include this file from inside an existing server block.

Your Data Never Leaves Your Device

Every tool runs entirely in your browser. Nothing you type is uploaded, stored, or logged on our servers.

100% Client-Side

The Nginx Config Generator produces a complete server block for the four shapes most deployments take: a static site, a single-page app, a reverse proxy in front of an application server, and PHP over FastCGI. TLS, gzip, asset caching, security headers, per-site logs, and rate limiting are all optional additions.

Several defaults exist because their absence causes specific, annoying failures. An SPA gets try_files … /index.html so a refreshed deep link does not 404. A reverse proxy gets the Upgrade and Connection headers, without which WebSockets simply will not connect, plus the X-Forwarded-* set so the app behind it can see the real client and scheme. And when TLS is enabled, the HTTP server still serves /.well-known/acme-challenge/ rather than redirecting it — redirecting that path is what quietly breaks Let's Encrypt renewal two months later.

FAQ

On Debian and Ubuntu, save it in /etc/nginx/sites-available/ and symlink it into sites-enabled/. On RHEL-family systems use /etc/nginx/conf.d/ with a .conf extension. Then run nginx -t and reload.

It validates the configuration without applying it. Reloading with a broken config fails, and depending on how nginx was started you can end up with no worker serving traffic — a syntax check takes a second and avoids that entirely.

A static site should 404 on unknown paths. A single-page app must fall back to /index.html so the client-side router can handle the URL — otherwise a deep link or a page refresh returns 404.

Behind a proxy the application sees nginx as the client. X-Real-IP and X-Forwarded-For carry the original address, X-Forwarded-Proto tells the app the request was HTTPS, and the Upgrade and Connection headers are what allow WebSocket connections through.

If you use Let's Encrypt with the webroot method, yes. Renewal fetches a file over plain HTTP, so redirecting all HTTP traffic to HTTPS without excluding /.well-known/acme-challenge/ silently breaks renewals a couple of months later.

limit_req_zone must be declared in the http context, not inside a server. If you include this file from within an existing server block, move that line up into nginx.conf.

Related Tools