Home / Nginx

Minimal Nginx config

A small server block you can drop into /etc/nginx/sites-available/ and symlink into sites-enabled. It is intentionally short. Review it before you reload.

Kind of site Server name Space-separated hostnames

Document root

HTTP port client_max_body_size TLS port

Enable TLS (certificate files on the server)

Certificate path Private key path

Redirect HTTP to HTTPS Use older listen … ssl http2 syntax (Nginx before 1.25.1)

Listen on IPv6 as well as IPv4 Enable gzip for text and SVG Short cache headers for static assets (static sites) Hide the Nginx version (server_tokens off) Leave a webroot for HTTP-01 certificate challenges ACME webroot

Generated config

How to use this on a small VPS

Save the file as /etc/nginx/sites-available/example.com, point the symlink from sites-enabled, then run sudo nginx -t before sudo systemctl reload nginx. If the test fails, do not reload. On Fedora or some containers the same text belongs in /etc/nginx/conf.d/.

This generator does not issue certificates. Use Certbot or another ACME client, and make sure port 80 is reachable from the internet if you use an HTTP-01 challenge. The modern http2 on; line needs Nginx 1.25.1 or later; tick the older syntax if nginx -v is behind that.

It also does not replace a firewall, fail2ban, rate limiting, or a hard look at proxy_pass to an app that should only listen on localhost. Keep the app bound to 127.0.0.1 so the proxy is the only public door.