Proxy headers
Custom upstream blocks
No custom upstreams configured. Click "Add upstream" to add one.
Options
server {
listen 80;
server_name example.com;
# Logging
access_log /var/log/nginx/example.com.access.log;
error_log /var/log/nginx/example.com.error.log;
# Gzip
gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_types text/plain text/css application/json application/javascript text/xml application/xml image/svg+xml;
location / {
proxy_pass http://localhost:3000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}What is Nginx Config Generator?
Nginx powers a significant share of the web as a high-performance HTTP server, reverse proxy, and load balancer. Writing correct Nginx configuration by hand requires memorizing directive syntax, understanding block nesting rules, and knowing which headers and options matter for security and performance. This generator produces production-ready server blocks for the five most common deployment patterns — static file serving, reverse proxying, load balancing, URL redirection, and SSL/TLS termination — complete with Mozilla-recommended cipher suites, OCSP stapling, HSTS, and WebSocket support.
How to Use
- Choose a config type from the tabs: Static Site, Reverse Proxy, Load Balancer, Redirect, or SSL/TLS.
- Enter your domain name in the Server name field.
- Fill in the type-specific options — proxy target, upstream servers, redirect URL, certificate paths, and so on.
- Toggle optional features: gzip compression, rate limiting, www-to-non-www redirect, WebSocket support.
- Copy the generated config and save it to /etc/nginx/sites-available/your-domain on your server.
Why Use This Tool?
Tips & Best Practices
- After saving the config, always run nginx -t to validate syntax before reloading the service
- Enable the site with: ln -s /etc/nginx/sites-available/your.conf /etc/nginx/sites-enabled/
- For free SSL certificates, use Certbot with Let's Encrypt: certbot --nginx -d yourdomain.com
- The www redirect option creates a separate server block that forwards www.domain to domain
- Rate limiting requires the limit_req_zone directive in the http{} block of nginx.conf, not inside a server block
- The Mozilla Intermediate profile is the best default for most production sites — it balances security with browser compatibility
Frequently Asked Questions
Where do I put the generated config file on my server?
On Ubuntu and Debian with the default Nginx package, save the file to /etc/nginx/sites-available/your-domain.conf, then create a symbolic link: ln -s /etc/nginx/sites-available/your-domain.conf /etc/nginx/sites-enabled/. On CentOS and RHEL, save directly to /etc/nginx/conf.d/your-domain.conf. Always run nginx -t && systemctl reload nginx after making changes.
What is the difference between a reverse proxy and a load balancer?
A reverse proxy forwards incoming requests to a single backend application server. A load balancer distributes requests across multiple backend servers defined in an upstream block, improving availability and throughput. Both use proxy_pass internally, but the load balancer references a named upstream group instead of a direct URL.
Do I need to install anything extra for SSL?
The generated config assumes you already have certificate files in PEM format. The easiest way to obtain free SSL certificates is Certbot with Let's Encrypt. Running certbot --nginx -d yourdomain.com will provision certificates and can automatically modify your Nginx config to enable HTTPS.
When should I NOT use this generator?
This tool covers the most common Nginx patterns but is not suitable for advanced scenarios such as gRPC proxying, stream (TCP/UDP) modules, Lua scripting, complex rewrite rules with regex captures, or multi-site configurations with shared map blocks. For those cases, start with the generated config and extend it manually using the Nginx documentation.
Is my configuration data kept private?
Yes. The entire generator runs as client-side JavaScript in your browser. Your domain names, proxy targets, upstream addresses, and certificate paths are never sent to any server or external service. You can safely generate configs for internal or proprietary infrastructure without any data leaving your machine.
What are the X-Real-IP, X-Forwarded-For, and X-Forwarded-Proto headers?
These headers pass original client information through the proxy layer. X-Real-IP carries the client IP address. X-Forwarded-For is a de-facto standard listing the client IP and any intermediate proxies. X-Forwarded-Proto tells the backend whether the original request was HTTP or HTTPS, which is needed for generating correct redirect URLs and setting secure cookies.
What is the Mozilla SSL profile and which one should I choose?
Mozilla publishes three SSL configuration profiles: Modern (TLS 1.3 only, strongest security, requires recent browsers), Intermediate (TLS 1.2 and 1.3, recommended for most sites, works with all modern browsers), and Old (TLS 1.0 through 1.3, maximum compatibility for legacy clients). For most production deployments, choose the Intermediate profile.
What is OCSP stapling and should I enable it?
OCSP stapling lets the server attach a cached OCSP response to the TLS handshake so the client does not need to contact the certificate authority separately. This reduces SSL handshake latency by eliminating an extra round-trip. Enable it for production sites — it improves both performance and client privacy. Make sure your DNS resolver is configured (the generator includes Cloudflare and Google resolvers by default).
Real-world Examples
Reverse Proxy for a Node.js API
Generate a reverse proxy config that forwards traffic from the public internet to a Node.js application running on port 3000, with X-Forwarded headers so the app sees the real client IP and protocol.
Type: Reverse Proxy, Domain: api.myapp.com, Proxy Pass: http://localhost:3000, Headers: all enabled, WebSocket: enabled
server { listen 80; server_name api.myapp.com; location / { proxy_pass http://localhost:3000; proxy_set_header X-Real-IP $remote_addr; ... } }SSL/TLS Termination with HSTS
Generate a hardened SSL config with Mozilla Intermediate ciphers, HSTS with a one-year max-age, and automatic HTTP-to-HTTPS redirect for a marketing site.
Type: SSL/TLS, Domain: www.mycompany.com, Mozilla Profile: Intermediate, HSTS: enabled (31536000), HTTP Redirect: enabled
server { listen 80; return 301 https://...; } server { listen 443 ssl http2; ssl_protocols TLSv1.2 TLSv1.3; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; ... }