A practical nginx config generator for real servers
Writing an nginx server {} block from memory is where typos, missing redirects and insecure defaults creep in. This nginx config generator builds a complete, commented virtual host from a short form: the domains it answers for, whether it serves static files, a single-page app, a reverse-proxied Node/Python/Go service or a PHP-FPM site, and which extras you want — HTTP to HTTPS redirect, Let’s Encrypt paths, HTTP/2, HSTS, gzip or Brotli, long-lived caching for static assets, security headers, rate limiting, basic auth and dotfile protection.
The output follows current nginx syntax (the standalone http2 on; directive introduced in 1.25.1, Mozilla’s “intermediate” TLS profile, $connection_upgrade map for WebSockets) and leaves comments explaining each block, so the file is easy to audit and adapt. Five presets cover the common cases; every option stays editable afterwards.
The configuration is assembled by JavaScript in your browser. Paths, hostnames and upstream addresses are never sent anywhere.
How to use the Nginx Config Generator
- Pick a preset — Static site, Single-page app, Reverse proxy, PHP-FPM or Redirect-only — or set Site type yourself.
- Enter your Domains (space-separated; the first one names the file and the Let’s Encrypt certificate paths) and the Root directory, upstream URL or PHP-FPM socket.
- Tick the features you need: HTTPS redirect, HTTP/2, HSTS, WebSocket upgrade, gzip/Brotli, asset caching, security headers, rate limiting, basic auth, logs, dotfile denial.
- Adjust details such as
client_max_body_size, cache lifetime, rate and burst, or add custom headers one per line. - Press Copy config or Download .conf, place the file in
/etc/nginx/sites-available/, symlink it intosites-enabled/, then runnginx -tandsystemctl reload nginx.
Nginx Config Generator features
Two-block HTTPS layout
A port-80 block that answers ACME challenges and redirects everything else to HTTPS, plus a port-443 block with TLS 1.2/1.3, session cache, OCSP stapling and optional HTTP/2.
Reverse proxy done right
proxy_pass with Host, X-Real-IP, X-Forwarded-For/Proto/Host, HTTP/1.1 keep-alive and, when enabled, the Upgrade/Connection map and a long read timeout for WebSockets.
SPA and PHP front controllers
try_files $uri $uri/ /index.html for client-side routers with a no-cache rule for the shell, or index.php?$query_string plus a hardened fastcgi_pass location for Laravel and WordPress.
Performance extras
gzip (or Brotli if ngx_brotli is installed) for text types, and an expires/Cache-Control: immutable location for fingerprinted CSS, JS, fonts and images.
Protection
Security headers, a limit_req_zone with burst and 429 status, basic auth from an htpasswd file, and a rule that denies .git, .env and other dotfiles while still allowing .well-known.
What each option writes
| Option | Directives generated | Notes |
|---|---|---|
| HTTPS + redirect | listen 443 ssl, ssl_*, port-80 return 301 | Certificate paths default to certbot’s /etc/letsencrypt/live/<domain>/ |
| HTTP/2 | http2 on; | nginx ≥ 1.25.1; on older versions use listen 443 ssl http2; |
| HSTS | Strict-Transport-Security with one-year max-age | Only enable once every subdomain works over HTTPS |
| WebSockets | map $http_upgrade $connection_upgrade + upgrade headers | Read timeout raised to an hour so idle sockets stay open |
| Rate limiting | limit_req_zone (http context) + limit_req with burst | Keyed on client IP; put the zone line in nginx.conf if your distro does not include site files inside http {} |
| Asset caching | expires + Cache-Control: public, immutable | Only safe for files whose names change on every deploy |
Testing and applying the configuration
- Copy the file to
/etc/nginx/sites-available/example.com.conf(Debian/Ubuntu) or/etc/nginx/conf.d/(RHEL, Alpine, Docker images). - On Debian-style layouts, enable it:
ln -s /etc/nginx/sites-available/example.com.conf /etc/nginx/sites-enabled/. - Obtain certificates first if the TLS block references them:
certbot certonly --webroot -w /var/www/letsencrypt -d example.com -d www.example.com. The port-80 block’s ACME location is exactly what--webrootneeds. - Run
nginx -t. It reports the line number of any problem — a missing semicolon or an upstream that does not resolve. - Reload without downtime:
systemctl reload nginx(ornginx -s reload). Then check headers withcurl -I https://example.com, or use the security header checker.
Related generators
Containerising the same app? The Dockerfile Generator writes the image build and the Docker Compose Generator wires nginx in front of it. For Apache hosts, the .htaccess redirect generator produces the equivalent rewrite rules, and the CSP Generator builds a Content-Security-Policy header you can paste into the extra-headers box.
Nginx Config Generator FAQ
Where do I put the generated nginx config file?
On Debian and Ubuntu, in /etc/nginx/sites-available/ with a symlink in sites-enabled/. On RHEL, Fedora, Alpine and the official Docker image, drop it into /etc/nginx/conf.d/ with a .conf extension. Both locations are included inside the http {} context, which the rate-limit zone and upgrade map require.
Why are there two server blocks?
One listens on port 80 and only answers Let’s Encrypt challenges and redirects to HTTPS; the other listens on 443 and serves the site. Keeping them separate avoids accidentally serving content over plain HTTP.
Does the nginx config generator support WebSockets?
Yes. In reverse-proxy mode, tick WebSocket upgrade: the config adds a map for $connection_upgrade, passes the Upgrade and Connection headers and raises proxy_read_timeout so idle connections are not dropped after 60 seconds.
How do I create the .htpasswd file for basic auth?
Run htpasswd -c /etc/nginx/.htpasswd username (from the apache2-utils or httpd-tools package) and make the file readable by the nginx user. Add more users without -c.
My nginx is older than 1.25 — will http2 on; work?
No; that directive arrived in 1.25.1. On older builds untick HTTP/2 and change the listen line to listen 443 ssl http2;. The rest of the configuration is unchanged.
Is the generated config secure by default?
It uses modern TLS settings, adds standard security headers, blocks dotfiles and never exposes the upstream directly. It does not include a Content-Security-Policy, because that depends on your pages — build one with the CSP generator and add it to the extra headers.