MirrorNest
← すべてのガイド

Nginx reverse proxy with Let's Encrypt on Ubuntu

Put Nginx in front of a service running on a local port, and issue it a free, auto-renewing TLS certificate via Certbot -- the standard way to expose a self-hosted app over HTTPS.

対象: Ubuntu 22.04 LTS / 24.04 LTSWeb ServerTLSReverse Proxy公式ホームページ ↗公式ドキュメント ↗
このガイドは上記リンク先にあるNginx reverse proxy with Let's Encrypt on Ubuntu公式ドキュメントをもとに作成されています。ディストリビューションやプロジェクトのバージョンは時間とともに変わるため、本番サーバーでこれらのコマンドを実行する前に、必ず公式ドキュメントで正確なパッケージ名・バージョン名を確認してください。

  1. 1Install Nginx

    sudo apt update
    sudo apt install nginx

  2. 2Create a server block for your domain

    Point it at whatever local port your app is already running on -- replace example.com and 3000 with your real domain and port.

    sudo tee /etc/nginx/sites-available/example.com <<'EOF' server { listen 80; server_name example.com; location / { proxy_pass http://127.0.0.1:3000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } EOF
    sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
    sudo nginx -t && sudo systemctl reload nginx

    Your domain's DNS A record must already point at this server's IP before the next step -- Let's Encrypt verifies ownership over HTTP.

  3. 3Install Certbot and issue the certificate

    Certbot edits the same Nginx config to add the certificate and redirect HTTP to HTTPS automatically.

    sudo apt install certbot python3-certbot-nginx
    sudo certbot --nginx -d example.com

  4. 4Confirm auto-renewal is set up

    sudo certbot renew --dry-run

    Certbot installs its own systemd timer on Ubuntu -- no cron job needed. Certificates renew automatically well before their 90-day expiry.