Nginx SSL and Reverse Proxy Setup on a VPS

Introduction

Nginx is commonly used on VPS servers as a reverse proxy. Instead of exposing an application directly to the internet, Nginx receives public HTTP/HTTPS traffic and forwards requests to an internal application running on another port.

This setup is useful for Node.js apps, Python apps, Docker containers, APIs, admin dashboards and services that should not listen publicly. Nginx can handle SSL, redirects, headers, compression, request limits and routing while the application runs privately behind it.

Quick answer

Nginx SSL and reverse proxy on a VPS

An Nginx reverse proxy sits between visitors and your application.

Visitor request:
https://example.com

Nginx receives:
Public HTTPS request on port 443

Nginx forwards to:
Internal app such as http://127.0.0.1:3000

Application responds:
Nginx sends the response back to the visitor

When to use Nginx reverse proxy

Use Nginx as a reverse proxy when your application runs on an internal port or service.

Common use cases:

• Node.js application on port 3000
• Python app with Gunicorn/Uvicorn
• Docker container exposed locally
• API backend
• admin dashboard
• WebSocket app
• frontend app with backend API
• multiple apps on one VPS
• app that should not be publicly exposed by port
• SSL termination in front of internal services

Before setup

Before configuring Nginx, confirm the basics.

You need:

• VPS with root or sudo access
• domain DNS pointing to VPS IP
• Nginx installed
• application running locally
• internal app port known
• firewall allowing 80 and 443
• firewall not exposing app port publicly unless needed
• SSL method ready, usually Certbot
• access to application logs
• rollback access to server

Basic reverse proxy flow

Public request:
https://example.com

Nginx listens on:
80 and 443

Application listens on:
127.0.0.1:3000

Nginx forwards:
location / {
    proxy_pass http://127.0.0.1:3000;
}

Result:
Visitors use example.com, while the app remains behind Nginx.

Install Nginx

On Ubuntu/Debian, install Nginx from the package manager.

sudo apt update
sudo apt install nginx -y

systemctl status nginx

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw status

Test in browser: http://your-server-ip

Example Nginx reverse proxy config

Create a server block for your domain.

server {
    listen 80;
    server_name example.com www.example.com;

    location / {
        proxy_pass http://127.0.0.1:3000;

        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# Enable site:
sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/

# Test config:
sudo nginx -t

# Reload Nginx:
sudo systemctl reload nginx

Add SSL with Certbot

After the HTTP reverse proxy works and DNS points correctly, issue SSL.

# Install Certbot:
sudo apt install certbot python3-certbot-nginx -y

# Issue certificate:
sudo certbot --nginx -d example.com -d www.example.com

# Test renewal:
sudo certbot renew --dry-run

# Check certificates:
sudo certbot certificates

HTTPS reverse proxy config

A simplified HTTPS reverse proxy config may look like this:

server {
    listen 80;
    server_name example.com www.example.com;

    return 301 https://example.com$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:3000;

        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

Proxy headers explained

Proxy headers help the application understand the original request.

Important headers:

• Host: original domain requested by visitor
• X-Real-IP: visitor IP
• X-Forwarded-For: chain of client/proxy IPs
• X-Forwarded-Proto: original protocol, usually https
• X-Forwarded-Host: original host, if needed

WebSocket support

Apps using WebSockets need upgrade headers.

location / {
    proxy_pass http://127.0.0.1:3000;

    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto https;
}

App binding and firewall

For security, the internal app should usually bind to localhost.

sudo ss -tulpn

Why this matters

A wrong reverse proxy config can cause 502 errors, redirect loops, broken WebSockets, wrong visitor IPs, SSL warnings or insecure public app ports.

How to check Nginx reverse proxy setup

Use SSL Checker, Website Status Checker, HTTP Header Checker and server logs.

1. DNS — Confirm domain points to VPS.
2. Nginx config — Run nginx -t before reload.
3. App status — Confirm app is running on the expected local port.
4. Firewall — Confirm 80 and 443 are open.
5. SSL — Confirm certificate covers the domain.
6. Redirects — Check HTTP to HTTPS and www/non-www behavior.
7. Proxy headers — Confirm app sees correct protocol and host.
8. Logs — Check Nginx error logs and application logs.

Common problems

How to configure Nginx reverse proxy safely

1. Step 1: Confirm DNS points to VPS

   Check A/AAAA records for the domain.

2. Step 2: Start the application locally

   Confirm the app runs on a known port such as 127.0.0.1:3000.

3. Step 3: Install Nginx

   Install and confirm Nginx is running.

4. Step 4: Create server block

   Configure server_name and proxy_pass.

5. Step 5: Pass proxy headers

   Set Host, X-Real-IP, X-Forwarded-For and X-Forwarded-Proto.

6. Step 6: Test Nginx config

   Run nginx -t before reloading.

7. Step 7: Enable SSL

   Use Certbot after HTTP proxy works.

8. Step 8: Configure redirects

   Choose one canonical HTTPS hostname.

9. Step 9: Check logs

   Review Nginx and application logs.

10. Step 10: Secure backend port

    Keep the app local or restrict public access.

Useful Nginx reverse proxy commands

Check Nginx config:
sudo nginx -t

Reload Nginx:
sudo systemctl reload nginx

Restart Nginx:
sudo systemctl restart nginx

Check Nginx status:
systemctl status nginx

Check listening ports:
sudo ss -tulpn

Check Nginx error log:
sudo tail -100 /var/log/nginx/error.log

Check access log:
sudo tail -100 /var/log/nginx/access.log

Check website headers:
curl -I https://example.com

Follow redirects:
curl -IL http://example.com

Test local app:
curl -I http://127.0.0.1:3000

Multiple apps on one VPS

Nginx can proxy different domains or paths to different apps.

Examples:

• app1.example.com → 127.0.0.1:3000
• app2.example.com → 127.0.0.1:4000
• api.example.com → 127.0.0.1:8000
• example.com/api → 127.0.0.1:5000

CDN and proxy notes

If using Cloudflare or another CDN in front of Nginx, check:

• SSL mode
• origin certificate
• real visitor IP handling
• proxy headers
• redirect rules
• cached assets
• WebSocket support
• firewall allowing CDN IPs if restricted
• /.well-known/acme-challenge/ for Certbot validation

Security checklist

Frequently asked questions