High-Performance Web Server & Reverse Proxy

Nginx Production Recipes & Configuration Directory

Copy-pasteable, hardened Nginx server blocks and reverse proxy configurations. Optimized for high throughput, sub-millisecond SSL handshakes, Single-Page Applications, WebSockets, and API rate limiting.

10 Production-Grade RecipesTLS 1.3 & HSTS HardenedZero-Downtime Reloads
Reverse Proxy & APIsapp.example.com.conf

How to Configure Nginx Reverse Proxy for Node.js, FastAPI & Go

Forward incoming public HTTP requests to internal application servers (Node.js, Express, Python FastAPI, Go, Docker) with real client IP headers.

proxy_pass http://127.0.0.1:3000;proxy_set_header Host $host;
Configure & CopyProduction ready
Security & SSLssl-redirect.conf

How to Redirect HTTP to HTTPS & Configure SSL/TLS in Nginx

Force secure HTTPS connections, redirect port 80 traffic with 301 Moved Permanently, and configure Let's Encrypt / modern TLS 1.2 & 1.3 ciphers.

return 301 https://$host$request_uri;listen 443 ssl http2;
Configure & CopyProduction ready
Frontend & SPAsspa.conf

How to Fix React Router, Vue & SPA 404 on Reload with Nginx try_files

Solve the notorious single-page application (SPA) 404 error when refreshing client-side routes like /dashboard or /profile using Nginx try_files.

try_files $uri $uri/ /index.html;expires 1y;
Configure & CopyProduction ready
Security & SSLrate-limit.conf

How to Configure Rate Limiting in Nginx to Prevent API Abuse & DDoS

Protect login endpoints, public REST APIs, and sensitive routes from brute-force attacks and volumetric spam using Nginx limit_req zones.

limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;limit_req_status 429;
Configure & CopyProduction ready
Reverse Proxy & APIscors.conf

How to Configure CORS Headers & Handle OPTIONS Preflight in Nginx

Allow Cross-Origin Resource Sharing (CORS) across single-page apps, mobile apps, and microservices with automated HTTP 204 No Content preflight handling.

add_header Access-Control-Allow-Origin $http_origin always;return 204;
Configure & CopyProduction ready
Reverse Proxy & APIswebsocket.conf

How to Proxy WebSockets in Nginx (Socket.io, WS, WSS)

Enable persistent real-time bidirectional communication for Socket.io, Chat engines, GraphQL subscriptions, and WebSockets over Nginx.

proxy_http_version 1.1;proxy_set_header Upgrade $http_upgrade;
Configure & CopyProduction ready
Performance & Cachingcompression.conf

How to Enable Gzip & Brotli Compression in Nginx for High PageSpeed

Compress HTML, CSS, JavaScript, JSON, and SVG files dynamically on the fly to reduce network payload size by up to 75% and boost Google Lighthouse scores.

gzip on;gzip_comp_level 6;
Configure & CopyProduction ready
Performance & Cachingcache-static.conf

How to Set Cache-Control & Long-Lived Expires for Static Assets in Nginx

Instruct browsers and CDNs to cache hashed CSS, JS, images, and fonts with immutable 1-year lifetimes to eliminate duplicate requests.

expires 1y;immutable;
Configure & CopyProduction ready
Reverse Proxy & APIsupload-size.conf

How to Fix 413 Request Entity Too Large in Nginx (client_max_body_size)

Increase the default 1MB file upload limit in Nginx to allow large uploads (images, videos, PDF documents) without 413 errors.

client_max_body_size 100M;proxy_request_buffering off;
Configure & CopyProduction ready
Security & SSLbasic-auth.conf

How to Password-Protect Admin & Staging Sites with HTTP Basic Auth in Nginx

Restrict access to staging environments, internal docs, or admin tools with prompt-based HTTP authentication using htpasswd credentials.

auth_basic "Restricted Staging Environment";auth_basic_user_file /etc/nginx/.htpasswd;
Configure & CopyProduction ready

Nginx Architecture & High-Performance Best Practices

Event-Driven Worker Model

Unlike thread-per-connection servers like Apache, Nginx relies on an asynchronous, non-blocking event loop using Linux epoll. A single worker process can handle over 10,000 concurrent keep-alive client connections with negligible RAM overhead.

Security at the Perimeter

Placing Nginx in front of internal Node.js or Python processes isolates your application from slow-loris attacks, malformed request bodies, and SSL vulnerabilities. Enforce modern TLS 1.3 ciphers, HSTS headers, and strict rate limits at the edge.

Zero-Downtime Reloads

Never restart Nginx in production with systemctl restart. Always test configuration validity with sudo nginx -t and apply updates with sudo systemctl reload nginx to keep live connections uninterrupted.

Essential Nginx CLI Operations

Test Configurationsudo nginx -t

Checks syntax without reloading

Graceful Reloadsudo systemctl reload nginx

Applies changes with zero downtime

View Error Logssudo tail -f /var/log/nginx/error.log

Streams connection & upstream errors

Enable Site (Debian/Ubuntu)sudo ln -s /etc/nginx/sites-available/site.conf /etc/nginx/sites-enabled/

Symlinks config to active directory

Frequently Asked Questions About Nginx

Everything you need to know about setting up and operating Nginx in high-load production environments.

Frequently Asked Questions

Frequently Asked Questions

Everything you need to know regarding specifications, syntax, and security best practices.

On Ubuntu/Debian, save server blocks in `/etc/nginx/sites-available/yourdomain.conf` and activate them by creating a symbolic link to `/etc/nginx/sites-enabled/` with `sudo ln -s /etc/nginx/sites-available/yourdomain.conf /etc/nginx/sites-enabled/`. On RHEL/CentOS, configurations typically live in `/etc/nginx/conf.d/yourdomain.conf`.