Generate Secure and Optimized Nginx Configurations

This skill covers Nginx configuration and web-server architecture - generating production-ready, secure, optimized configs for reverse proxy, load balancing, SSL termination, static file serving, and complex routing. Core principles: security first (security headers, proper SSL, access controls), performance optimization (caching, compression, connection handling), maintainability (clear comments, logical organization), error handling (proper error pages and logging), and scalability (configs that handle growth and multiple environments).

Essential directives are demonstrated via a basic server-block structure:

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    
    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    
    # Logging
    access_log /var/log/nginx/example.com.access.log;
    error_log /var/log/nginx/example.com.error.log;
    
    # Document root
    root /var/www/example.com/html;
    index index.html index.htm index.nginx-debian.html;
    
    location / {
        try_files $uri $uri/ =404;
    }
}

and modern SSL/TLS setup (TLS 1.2/1.3 only, a curated modern cipher list, session-cache and timeout tuning, session tickets disabled, HSTS, plus a separate HTTP-to-HTTPS redirect server block). Reverse-proxy configuration is shown via an upstream block load-balancing across multiple app-server instances (least-connections balancing, keepalive connections) with proxy headers for WebSocket upgrade and real client IP/protocol, connection timeouts, and a separate location block long-term-caching static assets. Load-balancing strategies cover an advanced upstream with IP-hash balancing, weighted servers with failure thresholds and timeouts, a backup server, and upstream failover on error, timeout, or 5xx responses with a retry count and timeout.

Caching configuration covers a proxy-cache-path definition (levels, keys zone, max size, inactive timeout) paired with per-location cache rules (differing cache-validity windows for success versus 404 responses, serving stale content on backend errors, cache locking, a debug header reporting cache status) and a restricted cache-purge endpoint. Security best practices cover rate limiting (request and connection limit zones defined per client IP, applied per-location with burst allowances, a stricter zone for login endpoints), hiding server version info, a full security-header set (X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Content-Security-Policy), and blocking access to sensitive file patterns like .env, .git, and .svn.

Configuration tips: always test with nginx -t before reloading, use includes to split large configs into manageable files, monitor performance with proper logging and metrics, keep Nginx and SSL certificates current, version-control configuration files, use variables for environment-specific settings, and comment complex rules and business logic.

Use it when writing or hardening an Nginx configuration - SSL termination, reverse proxying, load balancing, caching, or rate limiting and security headers. It is not a general web-server or infrastructure guide beyond Nginx itself - it is scoped specifically to Nginx directive syntax and configuration patterns.

Given a use case - reverse proxy, load balancer, static site, or API gateway - it produces a complete Nginx server-block configuration with SSL, caching, rate limiting, and security headers appropriate to that use case.

Covers core Nginx modules and directives (proxy_pass, upstream, SSL directives, proxy-cache directives, rate-limit zone directives), typically paired with Let's Encrypt or OpenSSL-issued certificates and validated with nginx -t.

DevOps and infrastructure engineers writing or hardening Nginx configurations for production.