Nginx Cheat Sheet

Configure Nginx as a web server and reverse proxy — locations, upstreams, TLS, rate limiting, and testing configs.

Networking6 sections · 39 commands
⌘K

Operations

8
nginx -t

Test the configuration

nginx -t -c /etc/nginx/nginx.conf

Test a specific config file

nginx -s reload

Reload config without dropping connections

nginx -s stop / quit

Stop fast / graceful

nginx -v

Version

nginx -T

Dump the effective full config

tail -f /var/log/nginx/access.log

Watch access logs

nginx -s reopen

Reopen log files (after rotation)

Server Blocks

6
server { listen 80; server_name example.com; }

Minimal vhost

root /var/www/html;

Document root

index index.html;

Default index files

server_name _;

Catch-all server block

listen 443 ssl http2;

HTTPS listener

ln -s ../sites-available/foo.conf sites-enabled/

Enable a site

Locations & Proxying

7
location / { proxy_pass http://backend; }

Reverse proxy all paths

location /api/ { proxy_pass http://api:8080/; }

Pass with a path rewrite

location ~ \.php$ { ... }

Regex location

location /static/ { alias /srv/static/; }

Alias a directory

try_files $uri $uri/ /index.html;

SPA fallback routing

location = /healthz { return 200 'ok'; }

Exact-match health endpoint

deny 1.2.3.4; allow 10.0.0.0/8;

IP allow/deny

Upstreams & Load Balancing

7
upstream backend { server 10.0.0.1:8080; server 10.0.0.2:8080; }

Define a backend pool

least_conn;

Balance by connection count

ip_hash;

Stick sessions by client IP

server 10.0.0.1:8080 max_fails=3 fail_timeout=30s;

Health-based failover

proxy_set_header Host $host;

Forward the Host header

proxy_set_header X-Real-IP $remote_addr;

Pass the real client IP

proxy_set_header X-Forwarded-Proto $scheme;

Tell the backend it's HTTPS

TLS

6
ssl_certificate /etc/ssl/certs/fullchain.pem;

TLS cert file

ssl_certificate_key /etc/ssl/private/key.pem;

TLS private key

ssl_protocols TLSv1.2 TLSv1.3;

Modern protocol set

ssl_ciphers HIGH:!aNULL:!MD5;

Cipher list

add_header Strict-Transport-Security 'max-age=31536000' always;

Enforce HTTPS (HSTS)

ssl_session_cache shared:SSL:10m;

Reuse TLS sessions

Rate Limiting & Caching

5
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;

Define a rate zone

limit_req zone=api burst=20 nodelay;

Apply the zone with a burst

limit_conn_zone $binary_remote_addr zone=perip:10m;

Connection limit zone

proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=static:10m max_size=1g;

Cache pool for upstreams

add_header Cache-Control 'public, max-age=3600';

Set response caching headers