Nginx Cheatsheet

Nginx is a high-performance web server, reverse proxy, load balancer, and HTTP cache.

Installation

# Debian / Ubuntu
sudo apt install nginx
 
# RHEL / CentOS / Fedora
sudo dnf install nginx
 
# Arch Linux
sudo pacman -S nginx

Service Management

sudo systemctl enable --now nginx  # Start Nginx and enable it on boot
sudo systemctl status nginx        # Check if Nginx is running
sudo systemctl restart nginx       # Stop and start Nginx (drops active connections)
sudo systemctl reload nginx        # Reload configuration without dropping connections
sudo systemctl stop nginx          # Stop Nginx

Configuration File Locations

Main Config: /etc/nginx/nginx.conf
Server Blocks (Virtual Hosts):
- Ubuntu/Debian: /etc/nginx/sites-available/ (symlinked to /etc/nginx/sites-enabled/)
- RHEL/CentOS: /etc/nginx/conf.d/
Default Document Root: /var/www/html/ or /usr/share/nginx/html/

Testing Configuration Syntax

Always test your configuration before reloading Nginx.

sudo nginx -t
# Expected output:
# nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
# nginx: configuration file /etc/nginx/nginx.conf test is successful

Basic Server Block (Static Website)

Create a file at /etc/nginx/sites-available/example.com:

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
 
    root /var/www/example.com/html;
    index index.html index.htm;
 
    location / {
        try_files $uri $uri/ =404;
    }
 
    error_page 404 /404.html;
    error_page 500 502 503 504 /50x.html;
}

Enable it (Ubuntu/Debian) by creating a symlink:

sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
sudo nginx -t          # Always test first
sudo systemctl reload nginx

Nginx as a Reverse Proxy

Proxy requests to a backend application server (Node.js, Python, Go, etc.).

server {
    listen 80;
    server_name api.example.com;
 
    location / {
        proxy_pass http://localhost:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
    }
}

SSL / HTTPS Configuration

Using certificates from Let's Encrypt (Certbot) or any CA.

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name example.com;
 
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
 
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
 
    root /var/www/example.com/html;
    index index.html;
}
 
# Redirect HTTP to HTTPS
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

Rate Limiting

Protect against abuse by limiting request rates per client IP.

# Define a rate limit zone in the http {} block of nginx.conf
# "limitreq" is the zone name, $binary_remote_addr tracks by client IP
# rate=10r/s means 10 requests per second allowed
limit_req_zone $binary_remote_addr zone=limitreq:10m rate=10r/s;
 
# Apply the rate limit in a server or location block
server {
    location /api/ {
        # burst=20 allows short bursts up to 20 extra requests
        # nodelay processes burst requests immediately instead of queuing
        limit_req zone=limitreq burst=20 nodelay;
        proxy_pass http://localhost:3000;
    }
}

Access Control

location /admin {
    allow 192.168.1.0/24;   # Allow internal network
    allow 10.0.0.5;          # Allow specific IP
    deny all;                # Deny everyone else
}

Load Balancing

Distribute traffic across multiple backend servers.

upstream backend {
    server 10.0.0.1:8080;    # Backend server 1
    server 10.0.0.2:8080;    # Backend server 2
    server 10.0.0.3:8080;    # Backend server 3 (standby)
}
 
server {
    listen 80;
    server_name app.example.com;
 
    location / {
        proxy_pass http://backend;
    }
}

Logs

# Access log (all incoming requests)
tail -f /var/log/nginx/access.log
 
# Error log (configuration errors, upstream failures, etc.)
tail -f /var/log/nginx/error.log

Cheatsheets