SpeedDrain
Server Blocks · Reverse Proxy · Let's Encrypt SSL · HTTP/2 · WebSockets

Nginx Configuration & Server Block Generator

Build production-ready, hardened Nginx virtual host configurations with optimized reverse proxies, TLS 1.3 certificates, WebSocket support, and static asset caching.

Server Block Parameters:

Generated /etc/nginx/sites-available/example.com.conf:
# Redirect HTTP and www to apex HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    return 301 https://example.com$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com;
    client_max_body_size 50M;

    # SSL Certificates & Modern TLS Hardening
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

    # Recommended Security Headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;

    # Gzip Compression
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;

    # Reverse Proxy to Application Server
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
        proxy_read_timeout 60s;
        proxy_connect_timeout 60s;
    }

    # Cache Static Assets (CSS, JS, Images, Fonts)
    location ~* \.(?:css|js|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc|woff|woff2)$ {
        expires 30d;
        access_log off;
        add_header Cache-Control "public, immutable";
        proxy_pass http://127.0.0.1:3000;
    }

    # Deny access to hidden dotfiles (.git, .env)
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }
}

Deployment & Validation Instructions:

1. Save config to /etc/nginx/sites-available/example.com and enable symlink:

sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/

2. Test Nginx syntax and reload daemon:

sudo nginx -t && sudo systemctl reload nginx

3. Issue free Let's Encrypt SSL certificate via Certbot:

sudo certbot --nginx -d example.com -d www.example.com

Architecting High-Performance Nginx Reverse Proxies

01.Why Place Nginx in Front of Node.js, Go, or Python?

While Node.js and Python runservers can listen on raw HTTP ports, running them directly on port 80/443 in production is discouraged:

  • SSL/TLS Offloading: Nginx handles CPU-heavy cryptographic handshakes and session caches in highly optimized C code, freeing application runtimes for business logic.
  • Slowloris & Slow Client Protection: Nginx buffers slow incoming client requests in memory before forwarding them to upstream app instances in one burst.
  • Static Asset Serving: Nginx leverages kernel sendfile(2) to stream static images and JavaScript directly from disk to network sockets without touching userland application memory.

02.Preserving Client IPs: The X-Forwarded Headers

Because your application server sits behind Nginx, every incoming connection appears to originate from 127.0.0.1 unless you pass real client IP headers:

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

X-Forwarded-Proto $scheme informs frameworks like Next.js or Rails that the connection was originally encrypted over HTTPS, preventing infinite redirect loops.

03.Enabling WebSocket Connections (HTTP 101 Switching Protocols)

By default, Nginx treats upstream connections as HTTP/1.0 and strips hop-by-hop headers.

For WebSockets (used in chat apps, live notifications, Next.js HMR) to negotiate successfully, you must explicitly configure protocol upgrades:

proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";

04.Hardening Security with HSTS and CSP

Adding security headers protects users against downgrade attacks and cross-site scripting (XSS):

  • Strict-Transport-Security (HSTS): Instructs browsers to never contact your domain over unencrypted HTTP for the next 2 years (max-age=63072000).
  • X-Frame-Options: Prevents clickjacking by blocking malicious sites from embedding your app inside invisible <iframe> tags.
  • client_max_body_size: Prevents buffer overflow and denial of service by rejecting payloads larger than your configured limit (e.g. 50MB) with an HTTP 413 error.