Nginx config generator

Generate production-ready nginx.conf for reverse proxy, SSL/TLS, load balancing, rate limiting, and static hosting.

Need more than a template?

Want a hand with the infrastructure side?

I set up CI/CD, Kubernetes and cloud platforms that keep releases routine.

DevOps engineering →

How to use the Nginx config generator

The tool writes an nginx.conf for two jobs: a reverse proxy in front of one or more application servers, and a static site. You can add TLS with an HTTP to HTTPS redirect, and a rate limit. Listing more than one upstream server gives you round-robin load balancing, which is Nginx's default.

  1. Choose reverse proxy or static site and enter the server name.
  2. For a proxy, list the upstream servers, one per line. For a static site, set the root directory.
  3. Turn on SSL and rate limiting if you need them, copy the config, and test it with nginx -t before you reload.

Worked examples

HTTPS reverse proxy with two backends and a rate limit

limit_req_zone $binary_remote_addr zone=req_limit:10m rate=10r/s;

upstream app_backend {
    server 10.0.0.11:3000;
    server 10.0.0.12:3000;
}

server {
    listen 80;
    server_name app.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    ssl_certificate /etc/ssl/certs/site.crt;
    ssl_certificate_key /etc/ssl/private/site.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    server_name app.example.com;

    location / {
        proxy_pass http://app_backend;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        limit_req zone=req_limit burst=40 nodelay;
    }
}

This is the generator's output for that setup. The first server block sends port 80 to HTTPS.

Mistakes to avoid

  • Reloading without testing

    Run nginx -t first. A syntax error caught there costs nothing. The same error on a reload can leave you with the old config and no idea why.

  • Expecting WebSocket support

    A WebSocket proxy needs proxy_set_header Upgrade $http_upgrade and a matching Connection header. The generated proxy block does not include them, so add both lines if your app uses WebSockets.

  • Using the placeholder certificate paths

    The default /etc/ssl paths are examples. Point them at your real certificate and key, for instance the files Certbot writes under /etc/letsencrypt/live.

  • Assuming the rate limit covers static sites

    The limit is applied inside the proxy location, so it protects the proxied app. A static site configuration does not include it.

  • Skipping security headers

    The output does not add HSTS or other response headers. Add them once HTTPS works.

Questions people ask

How big is the rate limit zone?
It is 10 MB, which holds state for roughly 160,000 client addresses. The burst is fixed at 40 requests with nodelay, which you can edit in the output.
Does it configure HTTP/2 or caching?
No. The tool covers the proxy, static, TLS and rate limit basics. Add http2 on the listen line and cache rules yourself if you need them.

Related