Nginx Config Generator

Enter your domain, pick the kind of site and tick the features you need to get a ready-to-use nginx server configuration. It covers reverse proxies (Node.js, Python, Java apps), static sites, single-page apps (React, Vue) and PHP, with HTTP-to-HTTPS and www redirects, WebSocket, gzip and static file caching.

Runs in your browser — nothing you enter is uploaded

Domain

Site type

Upstream address

WebSocket support

HTTPSHTTPS (Let's Encrypt certificate paths)HTTP/2HSTS (Strict-Transport-Security)Also answer www. and redirect it

ExtrasGzip compressionSecurity headers

Max upload size (MB)

0 keeps the nginx default of 1 MB.

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    # certbot needs plain HTTP access here when renewing with the webroot method
    location /.well-known/acme-challenge/ {
        root /var/www/letsencrypt;
    }

    location / {
        return 301 https://example.com$request_uri;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;

    return 301 https://example.com$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;

    # Common security headers
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    gzip on;
    gzip_vary on;
    gzip_comp_level 5;
    gzip_min_length 1024;
    gzip_types text/plain text/css application/javascript application/json application/xml image/svg+xml;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Get the certificate first, for example: certbot certonly --webroot -w /var/www/letsencrypt -d example.com -d www.example.com. Then run nginx -t and reload nginx.

How to use

Enter the domain and choose the site type — an upstream address for a reverse proxy, or the web root for the others.
Tick HTTPS, HTTP/2, HSTS, the www redirect, gzip, caching and security headers as needed.
Copy or download the config into /etc/nginx/conf.d/, run nginx -t and reload nginx.

Options explained

Reverse proxy: Forwards to the upstream address and passes Host, X-Real-IP, X-Forwarded-For and X-Forwarded-Proto, so the backend sees the visitor's real IP and scheme.
Single-page app: Unknown paths fall back to index.html, so history-mode routers (React Router, Vue Router) don't 404 on reload.
HTTPS: Certificate paths follow certbot's (Let's Encrypt) defaults and HTTP requests get a 301 redirect to HTTPS. HTTP/2 uses the listen 443 ssl http2 form, which works on every nginx version.
HSTS: Tells browsers to use only HTTPS for the domain and all its subdomains for a year. Make sure every subdomain supports HTTPS first, or they become unreachable.

Example: single-page app with HTTPS and www

With the domain example.com, Single-page app, HTTPS, HTTP/2 and Also answer www. and redirect it ticked (and Gzip compression, Security headers and Long cache for static files switched off to keep it short), the generator writes three server blocks:

Port 80 answers both names, keeps /.well-known/acme-challenge/ reachable for certificate renewal and sends everything else to https://example.com$request_uri with a 301.
Port 443 for www.example.com uses the same certificate and returns a 301 to the bare domain.
Port 443 for example.com serves the site:

    root /var/www/example.com;
    index index.html;

    location / {
        try_files $uri $uri/ /index.html;
    }

Both HTTPS blocks point at /etc/letsencrypt/live/example.com/fullchain.pem and privkey.pem, allow TLS 1.2 and 1.3 and use a 10 MB shared session cache with a one-day session timeout. The try_files line is what makes a reload on a client-side route such as /settings return the app instead of a 404.

Frequently asked questions

Why does nginx -t warn that the http2 parameter is deprecated?

Since nginx 1.25.1 the separate http2 on; directive is preferred, but 1.24 — shipped with Ubuntu 24.04 and others — doesn't understand it. The listen ... http2 form works everywhere; newer versions only print a warning.

Does the certificate need to include www?

Yes, when the www redirect is on. Request both names, for example certbot -d example.com -d www.example.com.

Uploads fail with 413 Request Entity Too Large?

nginx allows a 1 MB request body by default. Set Max upload size to what you need, such as 100.

WebSocket connections fail through the proxy?

The proxy must forward the Upgrade and Connection headers. Ticking WebSocket support adds them and raises the read timeout to an hour.

Privacy

This tool runs entirely in your browser. Your files and text are processed on your device and are never uploaded to our servers.