Hands-on guide series

Nginx in Production: A Hands-On Guide

An eight-part, hands-on guide taking Nginx from a fresh install to a hardened, fast production reverse proxy: the config model, server blocks, reverse proxy, HTTP/2 and HTTP/3, caching, rate limiting, load balancing, and hardening. Every command tested on a live server. TLS certificates get their own dedicated series.

8 parts57 min totalBy Amith Kumar

What you will build

Security is layers, not a switch. Each part closes a different category of attack, from the automated sweep that finds a brand-new server, to the day one gets in anyway. Read them in order, or jump to what you need.

  1. 1Install Nginx and Its Config ModelStart from a bare slice: install nginx, watch it serve the default page, then learn the nginx config model, the tree of contexts every server block lives in.9 min
  2. 2Serving Static Sites and Server BlocksOne Nginx can host many sites. Route each by its Host header with server blocks, place files with root and alias, and control every outcome with try_files.7 min
  3. 3Reverse Proxy to an AppPut Nginx in front of your app as a reverse proxy. proxy_pass forwards each request, and forwarded headers hand your app the real client IP, host and protocol.7 min
  4. 4HTTP/2, HTTP/3 and CompressionHTTP/2 and compression are the highest speed-per-effort win on a web server. Enable both on a live server, with the nginx 1.24 version trap that trips people up.7 min
  5. 5Caching, Static and ProxyNginx caches in two places: the browser and the proxy. Turn on both, prove each with the cache headers, and learn the one rule that keeps proxy caching safe.7 min
  6. 6Rate Limiting and Abuse ControlCap how fast one client hits your server without throttling real users. Nginx rate limiting, the burst and nodelay tuning everyone gets wrong, and where to apply it.6 min
  7. 7Load Balancing App InstancesRun several copies of your app behind one Nginx. Load balancing with an upstream block spreads traffic, gives free failover, and least_conn or ip_hash tune it.7 min
  8. 8Hardening, Headers and LoggingNginx hardening, made concrete: hide the version, add the security headers browsers enforce, log what an incident needs, and turn those logs into blocking.7 min
Start with Part 1