MirrorNest
← All guides

Nginx reverse proxy with Let's Encrypt on Ubuntu

Put Nginx in front of a service running on a local port, and issue it a free, auto-renewing TLS certificate via Certbot -- the standard way to expose a self-hosted app over HTTPS.

Target: Ubuntu 22.04 LTS / 24.04 LTSWeb ServerTLSReverse ProxyOfficial homepage ↗Official docs ↗
This guide is synthesized from Nginx reverse proxy with Let's Encrypt on Ubuntu's own official documentation, linked above — always cross-check exact package/version names there before running these commands on a production server, since distro and project versions move over time.

  1. 1Install Nginx

    sudo apt update
    sudo apt install nginx

  2. 2Create a server block for your domain

    Point it at whatever local port your app is already running on -- replace example.com and 3000 with your real domain and port.

    sudo tee /etc/nginx/sites-available/example.com <<'EOF' server { listen 80; server_name example.com; location / { proxy_pass http://127.0.0.1:3000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } EOF
    sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
    sudo nginx -t && sudo systemctl reload nginx

    Your domain's DNS A record must already point at this server's IP before the next step -- Let's Encrypt verifies ownership over HTTP.

  3. 3Install Certbot and issue the certificate

    Certbot edits the same Nginx config to add the certificate and redirect HTTP to HTTPS automatically.

    sudo apt install certbot python3-certbot-nginx
    sudo certbot --nginx -d example.com

  4. 4Confirm auto-renewal is set up

    sudo certbot renew --dry-run

    Certbot installs its own systemd timer on Ubuntu -- no cron job needed. Certificates renew automatically well before their 90-day expiry.