MirrorNest
← Todos os guias

Nginx reverse proxy with Let's Encrypt on Ubuntu

Put Nginx in front of a service running on a local port, and issue it a free, auto-renewing TLS certificate via Certbot -- the standard way to expose a self-hosted app over HTTPS.

Destino: Ubuntu 22.04 LTS / 24.04 LTSWeb ServerTLSReverse ProxySite oficial ↗Documentação oficial ↗
Este guia foi elaborado a partir da documentação oficial do Nginx reverse proxy with Let's Encrypt on Ubuntu, ligada acima — verifique sempre lá os nomes exatos dos pacotes/versões antes de executar estes comandos num servidor de produção, uma vez que as versões da distribuição e do projeto mudam com o tempo.

  1. 1Install Nginx

    sudo apt update
    sudo apt install nginx

  2. 2Create a server block for your domain

    Point it at whatever local port your app is already running on -- replace example.com and 3000 with your real domain and port.

    sudo tee /etc/nginx/sites-available/example.com <<'EOF' server { listen 80; server_name example.com; location / { proxy_pass http://127.0.0.1:3000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } EOF
    sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
    sudo nginx -t && sudo systemctl reload nginx

    Your domain's DNS A record must already point at this server's IP before the next step -- Let's Encrypt verifies ownership over HTTP.

  3. 3Install Certbot and issue the certificate

    Certbot edits the same Nginx config to add the certificate and redirect HTTP to HTTPS automatically.

    sudo apt install certbot python3-certbot-nginx
    sudo certbot --nginx -d example.com

  4. 4Confirm auto-renewal is set up

    sudo certbot renew --dry-run

    Certbot installs its own systemd timer on Ubuntu -- no cron job needed. Certificates renew automatically well before their 90-day expiry.