How to Install Nginx: Web Server and Reverse Proxy

Installing Nginx on Ubuntu and Debian

After connecting to your server over SSH:

sudo apt update
sudo apt install nginx

Nginx starts automatically once the installation finishes. Check its status:

systemctl status nginx

Allow web traffic through the firewall. The Nginx Full profile opens ports 80 (HTTP) and 443 (HTTPS) together:

sudo ufw allow 'Nginx Full'

If you open http://server-ip in your browser and see the "Welcome to nginx!" page, the installation is done. We cover ports and firewall settings in detail in What is a port?

On AlmaLinux and Rocky Linux, you install it with sudo dnf install nginx and sudo systemctl enable --now nginx; for the firewall, run sudo firewall-cmd --permanent --add-service=http --add-service=https followed by sudo firewall-cmd --reload.

Nginx configuration files

On Ubuntu and Debian, sites are defined in the sites-available folder and enabled by adding a shortcut to the sites-enabled folder. AlmaLinux doesn't have these folders; site files go directly under /etc/nginx/conf.d/ with a .conf extension.

Make these two commands a habit after every change:

sudo nginx -t
sudo systemctl reload nginx

nginx -t tests the configuration and shows any errors with their line numbers. reload loads the new configuration without dropping open connections.

Publishing your first site: server blocks

Make sure your domain's A record points to your server's IP address; we explain this in What is DNS? Then create a folder for the site:

sudo mkdir -p /var/www/yourdomain.com
echo "Hello Nginx" | sudo tee /var/www/yourdomain.com/index.html

Create the file /etc/nginx/sites-available/yourdomain.com:

server {
    listen 80;
    listen [::]:80;
    server_name yourdomain.com www.yourdomain.com;

    root /var/www/yourdomain.com;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

Enable the site and reload Nginx:

sudo ln -s /etc/nginx/sites-available/yourdomain.com /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

server_name tells Nginx which site an incoming request belongs to. To host several sites on the same server, just create a separate file for each domain.

Reverse proxy: publishing a Node.js application

A Node.js, Python or other application usually runs on a port such as 3000. Instead of exposing that port to the internet, have the application listen only on 127.0.0.1 and put Nginx in front of it:

server {
    listen 80;
    listen [::]:80;
    server_name app.yourdomain.com;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

• proxy_pass: The address of the application the request is forwarded to.
• X-Real-IP and X-Forwarded-For: Let the application see the visitor's real IP address. Without these headers, the application sees every request as coming from 127.0.0.1.
• Upgrade and Connection: Required for WebSocket connections to work. Don't skip these lines if you use real-time libraries such as Socket.IO.

To keep your application running, you can use pm2 or systemd; we cover both in our guide to hosting a Discord bot 24/7. If your application runs in Docker, publish the port as 127.0.0.1:3000:3000; we explain why in our Docker installation guide.

Free SSL with Let's Encrypt

Certbot obtains a Let's Encrypt certificate, updates your Nginx configuration and sets up automatic renewal:

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

Certbot reaches your server on port 80 to verify the domain. So before running the command, make sure your DNS records point to the server and port 80 is open. The redirect from HTTP to HTTPS is also configured during setup.

To test that automatic renewal works:

sudo certbot renew --dry-run

We explain how SSL works and the types of certificates in What is an SSL certificate?

Useful settings

A few common settings you can add inside a server block:

client_max_body_size 50M;

gzip on;
gzip_types text/css application/javascript application/json image/svg+xml;

location ~* \.(css|js|png|jpg|jpeg|webp|svg|woff2)$ {
    expires 30d;
    add_header Cache-Control "public";
}

• client_max_body_size: The largest file size that can be uploaded. The default is 1 MB; larger uploads return a 413 error.
• gzip: Compresses text-based files so pages load faster.
• expires: Lets browsers cache static files.

To hide the server version in response headers, enable the server_tokens off; line in the http block of /etc/nginx/nginx.conf.

Common Nginx errors

• 502 Bad Gateway: Nginx can't reach the application behind it. Check that the application is running and that the port in the proxy_pass line is correct.
• 504 Gateway Timeout: The application is responding too slowly. You can raise proxy_read_timeout for long-running operations, but the real fix is to solve the application's slowness.
• 413 Request Entity Too Large: The uploaded file is larger than client_max_body_size.
• 403 Forbidden: Nginx can't access the files, or there is no index file in the folder. Check the file permissions and the root path.
• The default page opens instead of your domain: The server_name line doesn't match the domain, or the site isn't linked in the sites-enabled folder.

In every case, the first place to look is the error log:

sudo tail -f /var/log/nginx/error.log

Nodesty servers for Nginx

To install and manage Nginx yourself, you need a server with root access. Nodesty AMD Ryzen 9 9950X VPS plans respond quickly to your web applications with high single-core speeds, while AMD EPYC 7763 VPS plans offer plenty of RAM for many sites and databases. Both come with NVMe storage, L3–L7 nShield DDoS protection and free daily backups kept for 7 days. If you just want to publish a website without managing a server, our web hosting plans with LiteSpeed are the more practical choice.