Nginx Server Block & Vhost Builder

Nginx sites-available Configuration Generator

Q: How do I test and reload Nginx safely?

Always run 'sudo nginx -t' to check your configuration syntax before restarting. If the test passes with 'syntax is ok', apply changes without dropping active TCP connections using 'sudo systemctl reload nginx'.

Q: Where should this file be saved?

Save the configuration file in '/etc/nginx/sites-available/your-domain.conf' and symlink it to '/etc/nginx/sites-enabled/' using 'sudo ln -s /etc/nginx/sites-available/your-domain.conf /etc/nginx/sites-enabled/'.

Generate production-ready Nginx server blocks without SSL. Type your domain, pick your backend type (PHP-FPM, Reverse Proxy, or Static), and copy shell commands to test and reload Nginx instantly.

PHP-FPMArchitecture

80Target Port

64MMax Body Size

58Lines of Conf

Backend Architecture

Domain NameIncludes www. automatically

Document RootAbsolute path to index files

PHP-FPM Socket Version

Client Max Body Size

Security HeadersBlock .env & Hidden FilesCache Static AssetsGzip Compression

/etc/nginx/sites-available/example.com.conf

Port 80 (HTTP)

server {
    listen 80;
    listen [::]:80;

    server_name example.com www.example.com;

    root /var/www/example.com/public;
    index index.php index.html index.htm;

    client_max_body_size 64M;

    # Logs
    access_log /var/log/nginx/example.com.access.log;
    error_log /var/log/nginx/example.com.error.log warn;

    # Security Headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Gzip Compression
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/xml application/json application/javascript application/rss+xml image/svg+xml;

    # Front Controller Routing
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    # PHP-FPM Handler
    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        fastcgi_buffer_size 16k;
        fastcgi_buffers 4 16k;
    }

    # Static Asset Caching
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|webp|svg|woff|woff2|ttf|eot)$ {
        expires 30d;
        add_header Cache-Control "public, no-transform";
        access_log off;
        log_not_found off;
    }

    # Block Access to Hidden & Sensitive Files (.git, .env)
    location ~ /\.(?!well-known).* {
        deny all;
        access_log off;
        log_not_found off;
    }
}

Activate, Test & Reload Nginx

Run these commands on your VPS to link the config, verify Nginx syntax, and safely reload without dropping active traffic.

# 1. Save config to sites-available
sudo nano /etc/nginx/sites-available/example.com.conf

# 2. Enable site by creating a symbolic link in sites-enabled
sudo ln -s /etc/nginx/sites-available/example.com.conf /etc/nginx/sites-enabled/

# 3. Test Nginx syntax configuration (Crucial Step)
sudo nginx -t

# 4. If syntax is OK, reload Nginx without dropping connections
sudo systemctl reload nginx

Understanding Nginx Server Blocks & Activation Workflow

Debian and Ubuntu server distributions organize Nginx using two sibling directories: /etc/nginx/sites-available/ and /etc/nginx/sites-enabled/. The sites-available folder stores the complete configuration file for every site hosted on the machine, while sites-enabled holds symbolic links pointing to the active configurations. This setup lets administrators test or disable sites quickly without deleting configuration files.

Zero-Downtime Reloads

Never restart Nginx abruptly. Using sudo nginx -t confirms all directives and upstream sockets exist. If valid, systemctl reload nginx instructs worker processes to finish in-flight requests while picking up the new configuration seamlessly.

The Path to Free SSL

Starting with an unencrypted port 80 block is recommended before issuing certificates. Once your domain points to your server's IP and serves HTTP traffic, running sudo certbot --nginx -d example.com automatically upgrades this configuration to HTTPS.

Essential Nginx Administration Commands

Action	Terminal Command	Expected Output / Effect
Enable Site	sudo ln -s /etc/nginx/sites-available/app.conf /etc/nginx/sites-enabled/	Creates symbolic link to activate configuration.
Test Syntax	sudo nginx -t	syntax is ok & test is successful.
Reload Config	sudo systemctl reload nginx	Applies changes instantly with zero connection drops.
Disable Site	sudo rm /etc/nginx/sites-enabled/app.conf	Removes active link; keeps original file in sites-available.

Frequently Asked Questions

Why start with an HTTP-only config without SSL?

Starting with an active port 80 HTTP server block is the standard prerequisite before obtaining free SSL certificates via Certbot / Let's Encrypt. The ACME HTTP-01 challenge needs a working port 80 block to verify domain control.

How do I test and reload Nginx safely?

Always run sudo nginx -t to check your configuration syntax before restarting. If the test passes with 'syntax is ok', apply changes without dropping active TCP connections using sudo systemctl reload nginx.

Where should this file be saved?

Save the configuration file in /etc/nginx/sites-available/your-domain.conf and symlink it to /etc/nginx/sites-enabled/ using sudo ln -s /etc/nginx/sites-available/your-domain.conf /etc/nginx/sites-enabled/.