Install and Configure Nginx on Ubuntu VPS: Static Site, Reverse Proxy and SSL

apt update && apt install nginx -y

systemctl enable nginx
systemctl start nginx

# Check that Nginx is running
systemctl status nginx

# Confirm Port 80 is listening
ss -tlnp | grep :80

# If using UFW, open HTTP and HTTPS
ufw allow 'Nginx Full'
ufw status

/etc/nginx/
├── nginx.conf              # Main config file (global settings)
├── conf.d/                 # Auto-included configs (custom global settings)
├── sites-available/        # All virtual host definitions (stored but not yet active)
│   └── default             # Default virtual host
├── sites-enabled/          # Symlinks to active virtual hosts
│   └── default -> ../sites-available/default
├── modules-available/      # Available modules
├── modules-enabled/        # Loaded modules
└── snippets/               # Reusable config fragments (e.g. SSL params)

# Create the document root
mkdir -p /var/www/mysite.com/html

# Set ownership to www-data (the user Nginx runs as)
chown -R www-data:www-data /var/www/mysite.com

# Set appropriate permissions
chmod -R 755 /var/www/mysite.com

nano /etc/nginx/sites-available/mysite.conf

server {
    listen 80;
    listen [::]:80;

    server_name mysite.com www.mysite.com;

    root /var/www/mysite.com/html;
    index index.html index.htm;

    location / {
        try_files $uri $uri/ =404;
    }

    # Block access to hidden files (e.g. .env, .git)
    location ~ /\. {
        deny all;
    }

    # Log files
    access_log /var/log/nginx/mysite.com.access.log;
    error_log  /var/log/nginx/mysite.com.error.log;
}

# Create a symlink from sites-available to sites-enabled
ln -s /etc/nginx/sites-available/mysite.conf /etc/nginx/sites-enabled/

# Test the config for syntax errors (very important!)
nginx -t

# If the test passes, reload gracefully (no downtime)
systemctl reload nginx

server {
    listen 80;
    server_name mysite.com www.mysite.com;

    root /var/www/mysite.com/html;

    # Files to serve when the request path is a directory
    index index.html index.htm;

    # Primary location: try exact file, then directory, then 404
    location / {
        try_files $uri $uri/ =404;
    }

    # Cache images and static assets for 30 days
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff2|svg)$ {
        expires 30d;
        add_header Cache-Control "public, no-transform";
    }

    # Block hidden files
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }
}

server {
    listen 80;
    server_name myapp.com www.myapp.com;

    location / {
        proxy_pass http://localhost:3000;

        # Forward original headers to the application
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Timeout settings
        proxy_connect_timeout 60s;
        proxy_send_timeout    60s;
        proxy_read_timeout    60s;
    }
}

# Define the upstream group before the server block
upstream myapp_backend {
    # Round-robin by default
    server localhost:3000;
    server localhost:3001;
    server localhost:3002;

    # Reuse connections with keepalive
    keepalive 16;
}

server {
    listen 80;
    server_name myapp.com www.myapp.com;

    location / {
        proxy_pass http://myapp_backend;
        proxy_http_version 1.1;
        proxy_set_header Connection "";  # Required for keepalive upstream
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

server {
    listen 80;
    server_name myphp.com www.myphp.com;

    root /var/www/myphp.com/html;
    index index.php index.html;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    # Pass PHP files to PHP-FPM
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
    }

    location ~ /\.ht {
        deny all;
    }
}

apt install certbot python3-certbot-nginx -y

# Replace example.com with your domain
# Certbot will update nginx config automatically and redirect HTTP to HTTPS
certbot --nginx -d example.com -d www.example.com

# Test renewal without actually renewing
certbot renew --dry-run

# Check the systemd timer status
systemctl status certbot.timer

# Or check the cron entry (depending on your system)
cat /etc/cron.d/certbot

gzip on;
gzip_vary on;
gzip_proxied any;
gzip_comp_level 6;
gzip_buffers 16 8k;
gzip_http_version 1.1;
gzip_min_length 256;
gzip_types
    text/plain
    text/css
    text/xml
    text/javascript
    application/json
    application/javascript
    application/x-javascript
    application/xml
    application/xml+rss
    application/xhtml+xml
    image/svg+xml
    font/woff
    font/woff2;

server {
    # ... other config ...

    # Prevent clickjacking (disallow embedding in iframes from other origins)
    add_header X-Frame-Options "SAMEORIGIN" always;

    # Prevent MIME type sniffing
    add_header X-Content-Type-Options "nosniff" always;

    # Control the referrer sent to third-party sites
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Legacy XSS protection for older browsers
    add_header X-XSS-Protection "1; mode=block" always;

    # Force HTTPS for the duration of max-age (requires SSL to be working first)
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # Hide the Nginx version number from response headers
    server_tokens off;
}

# Test config syntax without touching the running server
nginx -t

# Expected output on success:
# nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
# nginx: configuration file /etc/nginx/nginx.conf test is successful

# Graceful reload (zero downtime — serves in-flight requests until complete)
systemctl reload nginx

# Full restart (brief downtime — use only when necessary)
systemctl restart nginx

# Tail the error log in real time
tail -f /var/log/nginx/error.log

# Tail the access log in real time
tail -f /var/log/nginx/access.log

# Check that the backend service is running
systemctl status php8.2-fpm
# Or for Node.js
ps aux | grep node

# Confirm the backend is listening on the expected port
ss -tlnp | grep 3000

# Review Nginx error logs
tail -100 /var/log/nginx/error.log

# Restart the backend
systemctl restart php8.2-fpm

# Check ownership of files in the document root
ls -la /var/www/mysite.com/

# Fix ownership for www-data
chown -R www-data:www-data /var/www/mysite.com/

# Set correct permissions: directories 755, files 644
find /var/www/mysite.com/ -type d -exec chmod 755 {} \;
find /var/www/mysite.com/ -type f -exec chmod 644 {} \;

# Run to see the exact error and line number
nginx -t

# Common error messages:
# nginx: [emerg] unexpected "}" — missing semicolon on a previous line
# nginx: [emerg] "server" directive is not allowed here — block is in the wrong place
# nginx: [emerg] host not found in upstream — upstream name or port is wrong

# If Nginx stopped entirely, restore the last known-good config
# then fix the error and start again

# Check that the symlink exists in sites-enabled
ls -la /etc/nginx/sites-enabled/

# Verify the server_name matches your domain
grep server_name /etc/nginx/sites-available/mysite.conf

# Remove the default site if it is interfering
rm /etc/nginx/sites-enabled/default
nginx -t && systemctl reload nginx