Nginx Cheat Sheet — DevOps Reference

Nginx CLI Commands

Command	Description
`nginx -t`	Test the configuration files for syntax errors (Run before reload!)
`nginx -s reload`	Reload the configuration without terminating active connections (zero-downtime)
`systemctl restart nginx`	Restart the Nginx service (hard restart)
`tail -f /var/log/nginx/access.log`	Monitor live incoming access logs
`tail -f /var/log/nginx/error.log`	Monitor system and configuration error logs

Production Nginx Configuration

# /etc/nginx/sites-available/default
upstream app_cluster {
    server 127.0.0.1:3000;
    keepalive 32; # Keepalive connections to backend
}

server {
    listen 80;
    server_name yourapp.com www.yourapp.com;
    
    # Redirect all HTTP traffic to HTTPS
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name yourapp.com www.yourapp.com;

    # SSL Certs (Let's Encrypt / Certbot)
    ssl_certificate /etc/letsencrypt/live/yourapp.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourapp.com/privkey.pem;
    
    # Secure SSL parameters
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    # Security Headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    
    # Hide server versions
    server_tokens off;

    # Static Assets Cache
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|woff2|svg)$ {
        root /var/www/yourapp/dist;
        expires 1y;
        add_header Cache-Control "public, no-transform, immutable";
        try_files $uri =404;
    }

    # API Proxy
    location / {
        proxy_pass http://app_cluster;
        proxy_http_version 1.1;
        
        # Keepalive headers
        proxy_set_header Connection "";
        
        # Forward Client IP headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}