Installing Nginx
On Ubuntu/Debian, install Nginx:
sudo apt update && sudo apt install nginx
After installation, Nginx will start automatically and listen on port 80. Check the status:
sudo systemctl status nginx
Open your server's IP in a browser — you should see the default Nginx page. If you're using the UFW firewall, allow HTTP and HTTPS:
sudo ufw allow 'Nginx Full'
At this point, Nginx is running as a regular web server, serving static files from
/var/www/html/.Server Block Configuration
Create a configuration file for your domain:
sudo nano /etc/nginx/sites-available/yourdomain.com
Basic config structure:
server {
listen 80;
server_name yourdomain.com www.yourdomain.com;
location / {
proxy_pass http://127.0.0.1:3000;
}
}Activate the configuration and verify:
sudo ln -s /etc/nginx/sites-available/yourdomain.com /etc/nginx/sites-enabled/ sudo nginx -t sudo systemctl reload nginx
Configuring proxy_pass
The
proxy_pass directive tells Nginx where to forward requests. Full example of a location block with proper headers:location / {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Connection "";
}Without these headers, your application won't know the client's real IP or protocol (HTTP/HTTPS). The
X-Forwarded-Proto header is especially important if your app generates URLs — without it, links will be http instead of https.SSL via Let's Encrypt and Certbot
Install Certbot:
sudo apt install certbot python3-certbot-nginx
Run the certificate acquisition:
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com
Certbot will automatically modify the Nginx configuration, adding an HTTPS block (port 443) and an HTTP redirect. Make sure your domain already points to your server's IP — Certbot verifies domain ownership via an HTTP request. Let's Encrypt certificates are valid for 90 days, but Certbot sets up automatic renewal through a systemd timer or cron during installation.
Automatic Certificate Renewal
Verify that the renewal timer is active:
sudo systemctl status certbot.timer
For a manual check, use:
sudo certbot renew --dry-run
If everything works, certificates will be renewed automatically 30 days before expiration. In case of issues, it's helpful to add a post-hook to reload Nginx after renewal: in the
/etc/letsencrypt/renewal/yourdomain.com.conf file, add renew_hook = systemctl reload nginx. Keep an eye on the email you provided during Certbot registration — Let's Encrypt sends notifications if a certificate is about to expire and hasn't been renewed.