Nginx Config Generator
Generate server blocks with literal input guards and linked directive references.
Try before you buy.
- Free preview: the first half of the configuration, up to 20 lines; the rest, copying and files open with a pass.
- Locked until you unlock it: download and copy.
- Unlock: Pro pass, ₹179 for 30 days or ₹79 for 1 week, a one-time payment that never renews. Unlock: Pro pass, $5.99 for 30 days or $2.99 for 1 week, a one-time payment that never renews.
Ways to unlock shows how to get the full result.
Printing this result is locked in the free preview.
Linked nginx directive reference
- server
- listen
- server_name
- root
- index
- location
- try_files
- include
- return
- add_header
- map
- limit_req_zone
- limit_req
- limit_req_status
- proxy_pass
- proxy_http_version
- proxy_set_header
- proxy_read_timeout
- proxy_ssl_server_name
- proxy_ssl_name
- proxy_ssl_verify
- proxy_ssl_trusted_certificate
- proxy_ssl_verify_depth
- fastcgi_pass
- fastcgi_param
- gzip
- gzip_vary
- gzip_types
- gzip_proxied
- expires
- ssl_certificate
- ssl_certificate_key
- ssl_protocols
- ssl_ciphers
- ssl_ecdh_curve
- ssl_dhparam
- ssl_prefer_server_ciphers
- ssl_session_cache
- ssl_session_timeout
- ssl_session_tickets
Locked in the free preview. Opens the ways to unlock this result.
Locked in the free preview. Batch runs unlock with a pass.
Locked in the free preview. Query results unlock with a pass.
About the Nginx Config Generator
Build an nginx http-context fragment for a public file site, single-page application, reverse proxy with WebSocket headers, or PHP-FPM application. The fragment includes canonical HTTP-to-HTTPS redirects, optional www redirects, commented directive references, literal input validation and selectable TLS settings. The page generates text and does not connect to, inspect or change your server.
The free preview shows at most half the configuration, up to 20 lines. A Pro pass opens its full source, copy and downloads. TLS data is pinned to Mozilla profile 5.7 rather than a promise about the latest policy. Provision your real files and certificates, review application-specific security and run nginx -t before reloading.
How to use it
- Choose the site type and enter the canonical hostname and installation paths.
- Choose the pinned TLS profile and the actual certificate key type. Provide a full chain and key path; never paste the key itself.
- Enable HSTS only after verifying HTTPS. Enable immutable caching only for content-hashed public assets.
- Generate, review the linked directives and comments, then with a Pro pass download the fragment. Include it inside http and validate it on the actual nginx installation.
Examples
SPA mode with /var/www/example/public
try_files $uri $uri/ /index.html; lets client-side routes fall back to the entry page.
Reverse proxy to https://api.example.org
SNI and upstream certificate verification are enabled, with the entered trusted CA bundle.
Directive references
Every generated directive has its nginx documentation URL in a comment, and the workspace lists those references as links. WebSocket proxying needs explicit Upgrade/Connection forwarding. Header inheritance is handled by repeating security headers in the asset-cache location.
Pinned TLS profiles
The Mozilla profile 5.7 data defines intermediate TLS 1.2 plus 1.3 and modern TLS 1.3 only. Modern requires ECDSA; intermediate includes the specified DH-parameter file. SSL-module requirements depend on the actual installed nginx and TLS library. OCSP settings are withheld because certificate support and resolver configuration require installation-specific verification.
Application-specific decisions
Rate limiting counts the connecting IP until trusted real-IP handling is configured. Upload execution is blocked under /uploads and /files, alternate PHP source extensions are withheld, and hidden paths are denied; use your actual application’s upload paths and secret separation. Authentication, access policy and testing remain application responsibilities.
Limitations
- No nginx binary, certificate issuer, DNS record, socket, filesystem path or installation module is inspected. Generated configuration still needs nginx -t and runtime verification.
- This is a baseline fragment, not a complete security certification. Include WebSocket maps only once and avoid duplicate rate/cache zones in repeated fragments.
- HSTS defaults off; subdomain coverage, compression of sensitive responses, canonical-domain certificates and immutable asset naming require deliberate review.
- MySmartCoPilot is not affiliated with or endorsed by nginx or Mozilla.
Privacy
On this device; its files download once
Everything happens in your browser. What you enter or open here is not uploaded or stored by MySmartCoPilot. Downloads its own optional engines and printable fonts when first needed; your input is never uploaded.
Frequently asked questions
What do I get without a pass?
Without a pass, Nginx Config Generator shows the first half of the configuration, up to 20 lines; the rest, copying and files open with a pass. Until you unlock it, the result can’t be downloaded or copied. A Pro, Premium or Ultimate pass, a one-time payment that never renews, unlocks the full result. The pricing page lists the passes and their prices.
Does Generate apply settings to a server?
No. It creates a text fragment in your browser. Nothing is fetched from or written to your server.
Why is HSTS initially off?
An HTTPS or subdomain mistake can lock visitors out after browsers store HSTS. Enable it after verifying the actual HTTPS deployment.
Can a proxy response be cached automatically?
No. Long caching is limited to explicitly selected content-hashed public local assets; proxied application responses are not given blanket cache headers.