Nginx Commands & Config Snippets - CodeSwordsman

Common operations plus ready-to-paste snippets for static sites, reverse proxy, HTTPS, caching, rate limiting and SPAs.

Nginx 1.18+Updated 2026-10-2921 commands

Common Commands

Validate config syntax after every change

sudo nginx -t

Reload config gracefully without dropping connections

sudo nginx -s reload

Gracefully shut down after finishing current requests

sudo nginx -s quit

Show compile options and loaded modules

nginx -V

Check the Nginx service status

systemctl status nginx

Follow the error log in real time

tail -f /var/log/nginx/error.log

Static Site

Minimal static site configuration

server {
    listen 80;
    server_name example.com www.example.com;
    root /var/www/example;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

Ensure the Nginx user can read the site directory

sudo chown -R www-data:www-data /var/www/example

Reverse Proxy

Proxy to a local service and forward real IP and scheme

location / {
    proxy_pass http://127.0.0.1:8080;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

WebSocket proxy; Upgrade and Connection headers are required

location /ws/ {
    proxy_pass http://127.0.0.1:8080;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_read_timeout 60s;
}

Set upstream timeouts to avoid hanging requests

proxy_connect_timeout 5s;
proxy_read_timeout 60s;
proxy_send_timeout 60s;

HTTPS & Redirect

Enable HTTPS with TLS 1.2 / 1.3 only

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate     /etc/nginx/ssl/example.com.pem;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_session_cache   shared:SSL:10m;
}

Redirect all HTTP traffic to HTTPS with 301

server {
    listen 80;
    server_name example.com;
    return 301 https://$host$request_uri;
}

Caching & Compression

Enable gzip for text-based asset types

gzip on;
gzip_comp_level 5;
gzip_min_length 1024;
gzip_types text/css application/javascript application/json image/svg+xml;

Long-cache hashed static assets for 30 days

location ~* \.(js|css|png|jpg|jpeg|gif|svg|woff2)$ {
    expires 30d;
    add_header Cache-Control "public, immutable";
    access_log off;
}

Disable caching for entry HTML so new releases take effect

add_header Cache-Control "no-cache, no-store, must-revalidate";

Rate Limiting & Security Headers

Rate limit per client IP with a burst of 20

# http 块中定义
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;

# server 或 location 中使用
limit_req zone=api burst=20 nodelay;

Common security headers against clickjacking and MIME sniffing

add_header X-Frame-Options SAMEORIGIN always;
add_header X-Content-Type-Options nosniff always;
add_header Referrer-Policy strict-origin-when-cross-origin always;

Block access to dotfiles such as .git and .env

location ~ /\.(?!well-known).* { deny all; }

SPA (History Mode)

Avoid 404 when refreshing client-side routes

location / {
    try_files $uri $uri/ /index.html;
}

Serve static files locally and proxy /api to the backend

location /api/ {
    proxy_pass http://127.0.0.1:8080/;
    proxy_set_header Host $host;
}