Put nginx in front of a Node, Python or Docker app, with HTTPS and WebSocket support
Runs in your browser. Nothing you type is sent anywhere. Checked against sources on 22 Oct 2026.Running an app on a port such as 3000 and want it on your domain over HTTPS? Type the domain and the app address, and get the nginx server blocks for it: HTTP sent to HTTPS, www sent to the bare name, proxy_pass with the Host and X-Forwarded headers your app needs to see the real visitor, an upload size limit and, if your app uses them, WebSocket upgrades. Every line is commented.
Set the options you need, or start from the example.
The result is made again every time you change something.
Copy it or download it. Nothing was sent anywhere.
Most nginx configurations are copied from an answer written for another version and another job. This generator writes the whole file for yours, with a comment on every block, and leaves out the mistakes that are easy to copy.
| Preset | What it writes |
|---|---|
| Reverse proxy | proxy_pass to your app with Host, X-Real-IP and X-Forwarded headers, an upload limit, optional WebSocket upgrades |
| Static site | root and index, try_files with a real 404, assets cached for 30 days |
| Single-page app | every route to index.html, index.html never cached, hashed assets cached for a year |
| Redirect domain | every address of the old domain to the new one in one hop, path kept or dropped |
The security headers come from the same rules as the security headers generator on this site: nosniff, a referrer policy, framing limited to your own site and HSTS only over HTTPS. Nothing you type is sent anywhere. Check the file with sudo nginx -t before reloading. Related tools: Security Headers Generator, .htaccess Redirect Generator, htpasswd Generator.
The rest of the article, and all 6 questions about Nginx Config Generator, are on the Nginx Config Generator page.
On Debian and Ubuntu, save it as /etc/nginx/sites-available/example.com.conf and link it into sites-enabled. On other systems, save it in /etc/nginx/conf.d/. Then run sudo nginx -t to check the syntax and sudo systemctl reload nginx to apply it without dropping connections.
Choose Reverse proxy, type your domain and the address the app listens on, such as http://127.0.0.1:3000. The config forwards every request with the Host and X-Forwarded headers, so the app sees the real domain, visitor address and https. Turn on WebSocket if the app uses them.
Nginx looks for a file matching the address, such as /settings, and finds none. The Single-page app preset adds try_files $uri $uri/ /index.html, which serves index.html for every path that is not a real file, so the app's router can show the right page.
Yes, nginx will not start with a missing certificate file. Load only the HTTP server block first, run certbot certonly --webroot -w /var/www/letsencrypt with your domain, then add the HTTPS blocks. The default paths are the ones certbot writes under /etc/letsencrypt/live.
Rates and rules change; check the source before you rely on a figure.
Still stuck? Ask about Nginx Config Generator and anybody who knows can answer. No account needed.
On the related tools: Cron Expression Generator – Generate a cron expression by choosing when the job should run · Sitemap Index Generator – Split a large site into numbered sitemaps with an index file · Google Analytics URL Builder – The five utm parameters GA4 reads, with the naming traps flagged.