Tools Home

Nginx Config GeneratorOnline

Visual Nginx Server Block & Reverse Proxy Configurator

Generate secure, battle-tested Nginx configurations with SSL/TLS hardening, WebSocket upgrade proxies, gzip compression, and rate limiting. Built completely client-side in your browser.

Quick Architecture Presets (Load Sample)
Output Target Format:

Domain & Routing Profile

Configure your domain names, listening ports, and application runtime type.

example.com.conf(121 lines • 3.9 KB)
Nginx Config Output
UTF-8 • Client-Side Generated
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
# ====================================================================# Nginx Configuration for: example.com www.example.com# Generated by ToolsAA Visual Nginx Configurator (100% Client-Side)# Date: 2026-10-12# ====================================================================# [NOTE] Recommended helper inside http {} block for robust WebSocket upgrades:# map $http_upgrade $connection_upgrade {# default upgrade;# '' close;# }server { listen 80; listen [::]:80; server_name example.com www.example.com; # ACME Let's Encrypt challenge webroot verification location ^~ /.well-known/acme-challenge/ { default_type "text/plain"; root /var/www/letsencrypt; } # Force 301 Permanent Redirect to HTTPS location / { return 301 https://$host$request_uri; }}server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name example.com www.example.com; server_tokens off; # SSL / TLS Certificates ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; ssl_prefer_server_ciphers off; ssl_session_cache shared:SSL:10m; ssl_session_timeout 1d; ssl_session_tickets off; # OCSP Stapling ssl_stapling on; ssl_stapling_verify on; resolver 1.1.1.1 8.8.8.8 valid=300s; # Security Headers add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Content-Type-Options "nosniff" always; add_header X-XSS-Protection "1; mode=block" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always; # Client Max Body Size & Timeouts client_max_body_size 16M; keepalive_timeout 65; # Gzip Compression gzip on; gzip_vary on; gzip_proxied any; gzip_comp_level 6; gzip_min_length 256; gzip_types text/plain text/css text/javascript application/javascript application/json application/xml image/svg+xml font/woff2; # Open File Cache open_file_cache max=10000 inactive=30s; open_file_cache_valid 60s; open_file_cache_min_uses 2; open_file_cache_errors on; # Logging access_log /var/log/nginx/example.com.access.log combined buffer=512k flush=1m; error_log /var/log/nginx/example.com.error.log warn; # Reverse Proxy Pass location / { proxy_pass http://127.0.0.1:3000; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Host $host; # WebSocket Upgrade proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; # Timeouts & Buffering proxy_connect_timeout 60s; proxy_send_timeout 60s; proxy_read_timeout 60s; proxy_buffering off; } # Static Assets Browser Caching location ~* \.(css|js|jpg|jpeg|gif|png|ico|webp|svg|woff|woff2|ttf|eot)$ { expires 1y; add_header Cache-Control "public, no-transform, immutable"; access_log off; log_not_found off; } # Deny Hidden Files (.git, .env, .htaccess) location ~ /\. { deny all; access_log off; log_not_found off; } # Deny Sensitive Backup & Source Code Files location ~* (\.(bak|config|sql|fla|psd|ini|log|sh|inc|swp|dist|env)|composer\.lock)$ { deny all; access_log off; log_not_found off; }}
Nginx CLI Test & Reload Cheat Sheet
sudo nginx -tVerify Syntax
sudo systemctl reload nginxZero-Downtime Reload
sudo certbot --nginx -d example.comGet Free SSL Cert
sudo ln -s /etc/nginx/sites-available/x /etc/nginx/sites-enabled/Enable Site

100% Client-Side Privacy

Every server name, upstream IP, and directory path is calculated purely inside your browser. No telemetry or server configuration files ever touch external backend APIs.

Production Hardened Best Practices

Equipped with Mozilla Modern SSL profiles, HSTS headers, OCSP stapling, HTTP/2 multiplexing, and robust dotfile denial rules to pass enterprise security audits.

Universal Architecture Ready

Supports Next.js Full-Stack, React/Vue SPAs, FastAPI/Python, PHP-FPM, upstream load balancing with round-robin or least_conn, and high-frequency WebSocket streams.

Frequently Asked Questions & Nginx Tuning Guide

Key insights into Nginx reverse proxy architecture, WebSocket handshakes, and SSL optimization.

Where should I place this generated Nginx configuration file?

On Ubuntu/Debian, copy the file to /etc/nginx/sites-available/your-domain.conf, then create a symbolic link to /etc/nginx/sites-enabled/. On CentOS, RHEL, or Alpine, place it directly in /etc/nginx/conf.d/your-domain.conf.

Why are WebSocket headers (Upgrade & Connection) crucial for Next.js and modern apps?

By default, Nginx converts incoming HTTP/1.1 requests to HTTP/1.0 when communicating with upstream proxy servers, which closes persistent connections and strips the Hop-by-Hop Upgrade header. Enabling WebSocket support preserves the connection for Next.js Fast Refresh and real-time socket events.

What is the purpose of try_files $uri $uri/ /index.html in SPAs?

In Single Page Applications (React, Vue, Vite), client-side routing handles URLs like /dashboard or /settings. Without try_files fallback to /index.html, refreshing a subpage would cause Nginx to look for a physical folder on disk and return a 404 Not Found error.

How do I achieve an A+ SSL Labs rating with this configuration?

This configurator automatically includes TLSv1.2 and TLSv1.3 protocols, modern cipher suites, OCSP stapling with high-speed DNS resolvers, and HSTS (Strict-Transport-Security) with a 1-year max-age. Run sudo nginx -t && sudo systemctl reload nginx after saving your certificates.