nginx Reference

Sets the number of worker processes. 'auto' detects CPU cores.

worker_processes auto;

Maximum number of simultaneous connections per worker process.

worker_connections 1024;

Timeout for keep-alive connections with the client.

keepalive_timeout 65;

Maximum allowed size of the client request body. 0 disables the check.

client_max_body_size 10m;

Enables the use of sendfile() for serving static files efficiently.

sendfile on;

Enables TCP_CORK socket option to send headers and the beginning of a file in one packet.

tcp_nopush on;

Enable gzip compression for responses.

gzip on;

MIME types to compress (text/html is always compressed).

gzip_types text/plain text/css application/json application/javascript;

Sets the address and port for IP or the path for UNIX-domain socket.

listen 443 ssl http2;

Sets names of a virtual server. Supports wildcards and regex.

server_name example.com www.example.com;

Sets the root directory for requests.

root /var/www/html;

Defines files that will be used as an index.

index index.html index.php;

Checks the existence of files in the specified order. Last parameter is a fallback.

try_files $uri $uri/ /index.html;

Stops processing and returns the specified code to a client.

return 301 https://$host$request_uri;

Rewrites the URI using regex. Flags: last, break, redirect, permanent.

rewrite ^/old-path/(.*)$ /new-path/$1 permanent;

Defines a URI for custom error pages.

error_page 404 /404.html;
error_page 500 502 /50x.html;

Sets configuration for a URI. Modifiers: = (exact), ~ (regex), ~* (regex case-insensitive), ^~ (prefix, no regex).

location /api/ { proxy_pass http://backend; }

Sets the protocol and address of a proxied server.

proxy_pass http://localhost:3000;

Redefines or appends fields to the request header passed to the proxied server.

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;

Sets the HTTP protocol version for proxying. Use 1.1 for keepalive upstream connections.

proxy_http_version 1.1;

Timeout for reading a response from the proxied server between two successive read operations.

proxy_read_timeout 120s;

Timeout for establishing a connection to the proxied server.

proxy_connect_timeout 10s;

Enables or disables buffering of responses from the proxied server.

proxy_buffering off; # for SSE/streaming

Defines a group of servers for load balancing.

upstream backend {
  server 10.0.0.1:3000;
  server 10.0.0.2:3000;
}

Specifies a file with the certificate in PEM format.

ssl_certificate /etc/ssl/certs/example.crt;

Specifies a file with the secret key in PEM format.

ssl_certificate_key /etc/ssl/private/example.key;

Enables the specified protocols. Disable TLSv1 and TLSv1.1 for security.

ssl_protocols TLSv1.2 TLSv1.3;

Specifies the enabled ciphers. Use modern cipher suites.

ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;

Sets the types and sizes of caches that store session parameters.

ssl_session_cache shared:SSL:10m;

Enables stapling of OCSP responses by the server.

ssl_stapling on;
ssl_stapling_verify on;

Denies access for the specified network or address.

deny 192.168.0.0/16;
deny all;

Allows access for the specified network or address.

allow 10.0.0.0/8;
allow 127.0.0.1;
deny all;

Limits the rate of requests for a zone defined by limit_req_zone.

limit_req zone=api burst=20 nodelay;

Sets parameters for a shared memory zone used for limiting the request rate.

limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;

Adds the specified field to a response header. 'always' adds even for error responses.

add_header X-Frame-Options "SAMEORIGIN" always;
add_header Strict-Transport-Security "max-age=31536000" always;

Enables or disables adding or modifying the Expires and Cache-Control response headers.

expires 30d;  # static assets
expires -1;   # no cache

Sets output header fields. Part of ngx_headers_more module (not built-in).

more_set_headers "Server: myserver";

Sets the path, format, and configuration for request logging.

access_log /var/log/nginx/access.log combined;
access_log off;

Configures logging. Levels: debug, info, notice, warn, error, crit, alert, emerg.

error_log /var/log/nginx/error.log warn;

Specifies a log format. Variables like $remote_addr, $request, $status are available.

log_format main '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent';