Nginx Cheat Sheet: Config, Routing, SSL & Performance

Quick reference tables

Core directives

Server block structure

Location matching (priority order)

Proxy pass (reverse proxy)

SSL / TLS

Redirects

Headers

Static file serving and caching

Rate limiting

Upstream (load balancing)

Common CLI commands

Detailed sections

Production-ready HTTPS server block

This is a complete, secure config for a Node.js/Python app behind Nginx. Replace example.com and the upstream port with your own values.

# Redirect all HTTP to HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

# Main HTTPS server
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name example.com www.example.com;

    # SSL
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_stapling        on;
    ssl_stapling_verify on;

    # Security headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    server_tokens off;

    # Gzip
    gzip on;
    gzip_types text/plain text/css application/json application/javascript application/xml;
    gzip_min_length 1000;

    # Proxy to Node.js app
    location / {
        proxy_pass         http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection "upgrade";
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_read_timeout 60s;
    }

    # Static assets with long cache
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff2)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    # Block dotfiles
    location ~ /\. {
        deny all;
    }
}

Location block matching — the order matters

Nginx picks the most specific matching location. This is one of the most common sources of config bugs.

server {
    # 1. Exact match — highest priority
    location = /health {
        return 200 "OK";
    }

    # 2. Prefix match with regex-stop — second priority
    # Use ^~ when you want a prefix match that beats any regex
    location ^~ /static/ {
        root /var/www;
        expires 1y;
    }

    # 3. Regex matches — evaluated in order, first match wins
    location ~* \.(php|asp|aspx)$ {
        return 403;  # Block server-side scripts in wrong places
    }

    # 4. Catch-all prefix — lowest priority
    location / {
        proxy_pass http://127.0.0.1:3000;
    }
}

Rate limiting — protect your API

Define the zone in the http {} block, apply it in server {} or location {}.

http {
    # Zone: 10MB of state (stores ~160k unique IPs)
    # Rate: max 10 requests per second per IP
    limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
    limit_req_status 429;

    server {
        location /api/ {
            # burst=20: allow up to 20 queued requests above the rate
            # nodelay: serve burst immediately instead of spacing them out
            limit_req zone=api burst=20 nodelay;
            proxy_pass http://127.0.0.1:3000;
        }
    }
}

WebSocket reverse proxy

WebSockets require two specific headers. Without them, the connection upgrade fails.

location /ws/ {
    proxy_pass         http://127.0.0.1:3000;
    proxy_http_version 1.1;
    proxy_set_header   Upgrade $http_upgrade;
    proxy_set_header   Connection "upgrade";
    proxy_set_header   Host $host;
    proxy_read_timeout 3600s;  # Keep WS connections open longer
}

Certbot / Let’s Encrypt integration

Get a free certificate and auto-configure Nginx in one command. Requires the certbot and python3-certbot-nginx packages.

# Install certbot (Debian/Ubuntu)
sudo apt install certbot python3-certbot-nginx

# Get and install certificate
sudo certbot --nginx -d example.com -d www.example.com

# Test auto-renewal
sudo certbot renew --dry-run

Certbot edits your config in place, adding the SSL directives. After it runs, always check nginx -t before assuming the config is valid.

Related: Linux Bash Cheat Sheet | SSH & GPG Cheat Sheet | How to Set Up a Reverse Proxy with Nginx

System_Continuity

Next_Recommended_Node

jq Cheat Sheet: Filter, Transform, and Query JSON from the Terminal

Complete jq reference — basic filters, pipes, array/object operations, conditionals, string interpolation, select, map, reduce, and real DevOps workflows.

Cobie

5m read

Cheatsheet 5m

Docker Compose Cheat Sheet: Services, Volumes, Networks & Production Patterns

Log_Access

Cheatsheet 5m

SQL Cheat Sheet: Queries, Joins, Aggregates & More

Log_Access

Browse the full manifest