MirrorNest
← Все руководства

Nginx reverse proxy with Let's Encrypt on Ubuntu

Put Nginx in front of a service running on a local port, and issue it a free, auto-renewing TLS certificate via Certbot -- the standard way to expose a self-hosted app over HTTPS.

Система: Ubuntu 22.04 LTS / 24.04 LTSWeb ServerTLSReverse ProxyОфициальный сайт ↗Официальная документация ↗
Это руководство составлено на основе официальной документации Nginx reverse proxy with Let's Encrypt on Ubuntu, ссылка на которую есть выше — всегда сверяйте точные названия пакетов/версий там перед запуском этих команд на рабочем сервере, так как версии дистрибутива и проекта со временем меняются.

  1. 1Install Nginx

    sudo apt update
    sudo apt install nginx

  2. 2Create a server block for your domain

    Point it at whatever local port your app is already running on -- replace example.com and 3000 with your real domain and port.

    sudo tee /etc/nginx/sites-available/example.com <<'EOF' server { listen 80; server_name example.com; location / { proxy_pass http://127.0.0.1:3000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } EOF
    sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
    sudo nginx -t && sudo systemctl reload nginx

    Your domain's DNS A record must already point at this server's IP before the next step -- Let's Encrypt verifies ownership over HTTP.

  3. 3Install Certbot and issue the certificate

    Certbot edits the same Nginx config to add the certificate and redirect HTTP to HTTPS automatically.

    sudo apt install certbot python3-certbot-nginx
    sudo certbot --nginx -d example.com

  4. 4Confirm auto-renewal is set up

    sudo certbot renew --dry-run

    Certbot installs its own systemd timer on Ubuntu -- no cron job needed. Certificates renew automatically well before their 90-day expiry.