How This nginx Config Generator Works
This nginx config generator works from four presets. Fill in the domain, port, document root, or proxy target depending on your preset, toggle SSL, gzip, caching, and HSTS as needed, and this nginx server block generator assembles a complete, ready-to-drop-in server block, doubling as an nginx reverse proxy config or nginx hsts header setup pass depending on which preset and toggles you pick. Every preset gets the same baseline security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy) and access/error log paths regardless of which one you pick, the preset only changes the location blocks and routing logic specific to that kind of app.
Choosing the Right Preset
Picking the right preset matters more than it might seem, using the wrong one is the most common real mistake people hit with a hand-written nginx config too. A nginx static site config uses try_files $uri $uri/ =404, returning a real 404 for anything that doesn't exist, correct for a plain static site but wrong for a client-side-routed app. A nginx spa config react setup instead uses try_files $uri $uri/ /index.html, falling back to your SPA's entry point for any unmatched path, exactly what makes client-side routing (React Router, Vue Router, and similar) work correctly instead of 404ing on a page refresh. Reverse proxy adds the WebSocket upgrade headers and forwarded-for headers a proxied backend typically expects. PHP adds the fastcgi block pointing at PHP-FPM's socket plus explicit denial of .ht* files.
| Preset | Key location directive | Best for |
|---|---|---|
| Static site | try_files $uri $uri/ =404 | Plain HTML/CSS/JS sites |
| SPA / React | try_files $uri $uri/ /index.html | Client-side-routed apps (React Router, Vue Router) |
| Reverse proxy | proxy_pass + WebSocket upgrade headers | Node.js, API, or app servers behind nginx |
| PHP / Laravel | fastcgi_pass to PHP-FPM socket | PHP applications |
SSL, HSTS, and Why HSTS Needs SSL First
A nginx ssl config generator pass produces two server blocks: one on port 80 that redirects every request straight to https, and a second on port 443 with the actual SSL certificate paths (assuming Let's Encrypt/certbot's standard /etc/letsencrypt/live/ layout) and a reasonable TLS 1.2/1.3 cipher configuration. HSTS is deliberately only available when SSL is also enabled, sending Strict-Transport-Security without HTTPS actually configured would tell browsers to only ever connect to that domain over HTTPS going forward, even though nothing is listening there yet, breaking the site for anyone whose browser already cached that instruction. Enable SSL first, confirm HTTPS actually works, then layer on HSTS.
Common Uses
Standing up a static site or SPA server block from scratch without re-deriving the try_files logic from memory, configuring nginx as a reverse proxy in front of a Node.js or API backend with the right WebSocket and forwarded headers, setting up a nginx php fpm config for a PHP or Laravel app without hand-writing the fastcgi block, and adding a full nginx security headers config plus SSL to an existing site's setup as a checklist are the most common uses of this tool. Toggling gzip and caching on or off to compare the resulting config side by side is a common secondary use when tuning performance settings.
What This Tool Doesn't Do
This tool doesn't validate the generated config against nginx itself, there's no equivalent of running nginx -t, an unusual domain or path value could still produce something nginx rejects, always test-load a generated config before relying on it in production. It doesn't manage or renew SSL certificates, the generated SSL block assumes Let's Encrypt/certbot certificate paths already exist at the standard location, it doesn't run certbot or provision anything. It doesn't cover advanced nginx features like rate limiting, load balancing across multiple upstream servers, or custom error pages, those are beyond the four presets offered here. The PHP preset's fastcgi socket path assumes a specific PHP-FPM version (php8.2-fpm.sock), adjust it if your server runs a different version.