Back to All Cheatsheet Libraries
cheatsheets
Service commands, common config directives with a reverse-proxy example, and a safe new-site setup workflow.
Total Commands: 0
| Category | Command | Description |
|---|---|---|
| Validation | nginx -t | Tests the config for syntax errors without applying it — always run before reloading. |
| Service | systemctl reload nginx | Applies config changes with zero downtime — workers finish current requests, new workers pick up the new config. |
| Service | systemctl restart nginx | Fully stops and starts the service — brief downtime, only needed for changes reload can't apply (like worker process count). |
| Status | systemctl status nginx | Shows whether the service is running and its most recent log lines. |
| Logs | tail -f /var/log/nginx/access.log | Follows the access log in real time — every request that reached Nginx. |
| Logs | tail -f /var/log/nginx/error.log | Follows the error log — the first place to look when a site returns a 502/500. |
| Sites | ln -s /etc/nginx/sites-available/site /etc/nginx/sites-enabled/ | Enables a site config on Debian/Ubuntu-style Nginx installs — symlink pattern, not needed on distros that read conf.d/ directly. |
| TLS | certbot --nginx -d example.com | Obtains a Let's Encrypt certificate and auto-configures the matching server block. |
Common Directives
| Directive | Purpose |
|---|---|
listen 443 ssl; | Binds the server block to a port, optionally with TLS termination. |
server_name example.com; | The hostname(s) this server block responds to — how Nginx picks between multiple sites on one IP. |
root /var/www/site; | Filesystem path Nginx serves static files from for this block. |
proxy_pass http://localhost:3000; | Forwards requests to a backend app — the core of Nginx's reverse-proxy role. |
try_files $uri $uri/ /index.html; | Falls back to index.html for unmatched paths — the standard pattern for a client-side-routed SPA. |
gzip on; | Enables response compression to reduce transfer size. |
limit_req_zone $binary_remote_addr zone=one:10m rate=10r/s; | Defines a rate-limiting zone keyed by client IP — paired with limit_req in a location block. |
Reverse Proxy Block
location / {
proxy_pass http://localhost:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
1
Create the config in sites-available first
Write and validate the server block there before touching sites-enabled — keeps a broken config from ever being live.
2
Always nginx -t before reloading
A syntax error caught by -t is a non-event; the same error hit by a reload can take down every site on the server, not just the one being edited.
3
Symlink into sites-enabled, then reload
The symlink activates the site; a plain reload (not restart) picks it up with no downtime for existing sites.
4
Get TLS running before announcing the site
Certbot's Nginx plugin edits the server block directly to add the certificate and redirect — run it once DNS is pointed at the server.
Quick Tips
Most specific location block wins
Nginx doesn't evaluate location blocks top-to-bottom like a simple list — exact matches and longer prefix matches take priority over a shorter general one.
A 502 usually means the backend, not Nginx, is down
Bad Gateway means Nginx reached its proxy_pass target and got nothing usable back — check the app process before assuming an Nginx config problem.
nginx -T dumps the fully merged config
Includes every included file resolved into one output — the fastest way to confirm what's actually active versus what's just sitting in a file.