consolelog.tools

Nginx Config Generator

Assemble a complete, correctly-indented nginx server block visually — HTTP/HTTPS listeners with an optional 301 redirect, a modern SSL block with HSTS and HTTP/2, gzip/brotli, security headers, upstream load-balancing pools, and location blocks built from real presets (static cache, SPA fallback, reverse proxy with WebSocket upgrade, PHP-FPM, deny dotfiles). The nginx.conf renders live and an audit panel flags the mistakes people actually ship — 443 without SSL, HTTPS without HSTS, a proxy pointing at an undefined upstream, or a missing root.

About this ToolHow it works, benefits & use cases

Build a complete, production-shaped nginx server block from form controls and watch the nginx.conf render live, fully indented and ready for nginx -t. Set the server_name, document root, and index, then choose your listeners: HTTP on 80, HTTPS on 443, and an optional 301 redirect server that forces every request to HTTPS. The TLS panel emits a modern SSL block with ssl_certificate paths, ssl_protocols of TLSv1.2/TLSv1.3, a strong cipher suite, optional HTTP/2, and an HSTS header. Toggle gzip and brotli compression and a security-headers set (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and a Content-Security-Policy you can edit). Assemble the request handling from a catalog of real location presets: static file serving with long-lived cache headers, an SPA try_files fallback to index.html, a reverse proxy with the standard forwarding plus WebSocket upgrade headers, PHP-FPM via FastCGI, a deny-dotfiles guard, and a free-form custom block you can reorder. Define an upstream pool to load-balance across several backends, and a live audit panel flags the misconfigurations people actually ship.

How to Use

  1. 1Start from a preset (Static site, SPA, Reverse proxy, PHP, or Load balancer) or build from scratch.
  2. 2Set server_name, root, and index, then tick which listeners you want: HTTP, HTTPS, and the HTTP-to-HTTPS redirect.
  3. 3Enable the SSL block to emit certificate paths, modern protocols/ciphers, HTTP/2, and HSTS.
  4. 4Toggle gzip/brotli compression and the security-headers set, and edit the Content-Security-Policy if needed.
  5. 5Add location blocks from the preset menu, edit each path/target, reorder them, and define an upstream pool for load balancing.
  6. 6Review the live audit panel, then copy, download, or share the generated nginx.conf.

Key Benefits

  • Emits a clean, correctly-indented nginx.conf you can drop straight into sites-available
  • Separate HTTP-to-HTTPS redirect server plus a main block with HTTP/HTTPS listeners
  • Modern SSL block: TLSv1.2/1.3, strong ciphers, session cache, optional HTTP/2 and HSTS
  • Location presets for static caching, SPA fallback, reverse proxy with WebSocket upgrade, and PHP-FPM
  • Upstream load-balancing pools referenced from reverse-proxy locations
  • Security headers (X-Frame-Options, nosniff, Referrer-Policy, CSP) in one toggle
  • Live audit that flags 443 without SSL, HTTPS without HSTS, undefined upstreams, and a missing root
  • Live preview with copy, download, and shareable URL state

Common Use Cases

  • Terminating TLS and reverse-proxying to a Node, Python, or Go backend with WebSocket support
  • Serving a single-page app with try_files fallback and aggressively cached static assets
  • Standing up a PHP-FPM site with FastCGI, static handling, and dotfile protection
  • Load-balancing across several backend servers with an upstream pool
  • Adding an HTTPS redirect and a hardened TLS block to an existing virtual host
  • Learning how proxy_pass headers, try_files, FastCGI, and upstream blocks fit together

2 location blocks · /etc/nginx/sites-available/

server {
  listen 80;
  listen [::]:80;
  server_name example.com;

  root /var/www/html;
  index index.html;

  gzip on;
  gzip_vary on;
  gzip_comp_level 6;
  gzip_types text/plain text/css application/json application/javascript text/xml application/xml image/svg+xml;

  add_header X-Frame-Options "SAMEORIGIN" always;
  add_header X-Content-Type-Options "nosniff" always;
  add_header Referrer-Policy "strict-origin-when-cross-origin" always;
  add_header Content-Security-Policy "default-src 'self';" always;

  location ~* \.(?:css|js|jpg|jpeg|png|gif|ico|svg|woff2?)$ {
    expires 1y;
    add_header Cache-Control "public, immutable";
    access_log off;
  }

  location ~ /\. {
    deny all;
  }
}
Config looks valid

Start from a preset

Server

Leave blank for proxy-only servers

e.g. 10M, 50M, 1G

Adds a separate port-80 redirect server

TLS / SSL

Emits ssl_certificate, modern ssl_protocols & ciphers

Performance & security

Requires the ngx_brotli module

X-Frame-Options, nosniff, Referrer-Policy, CSP

Upstream (load balancer)

Reference it from a reverse-proxy location as http://<name>

Location blocks

Static files + cache— Serve assets with long-lived cache headers
Deny dotfiles— Block access to .git, .env and other hidden files

A server-block builder, not a snippet dump

This models a real nginx server: HTTP and HTTPS listeners, an optional 301 redirect server, a modern TLS block, and a stack of location blocks assembled from presets — static-file caching, SPA try_files fallback, a reverse proxy with the standard forwarding plus WebSocket upgrade headers, PHP-FPM, and a deny-dotfiles guard. The nginx.conf renders live, fully indented and ready for nginx -t.

What the audit catches

  • Listening on 443 with the SSL block disabled (no certificate would be emitted).
  • HTTPS enabled but HSTS off — leaves you open to protocol downgrade.
  • A proxy_pass pointing at an upstream name that has no upstream block.
  • An empty root while you are serving files, and a server with no listen directive.

Deploy it

Save to /etc/nginx/sites-available/yoursite, symlink into sites-enabled, run nginx -t to validate, then systemctl reload nginx.

Was this tool helpful?

Share Your Experience

Help others discover this tool!

Share on Twitter

Related tools