Nginx on Linux: Virtual Hosts, Reverse Proxy, and SSL with Let's Encrypt

Nginx (pronounced "engine-x") is the most widely used web server and reverse proxy in the world, present in more than 34% of sites with an active web server. It outperforms Apache in performance with simultaneous connections by consuming much less memory per request.

Installation

# Ubuntu/Debian
sudo apt update && sudo apt install nginx -y

# CentOS/RHEL/Rocky
sudo dnf install nginx -y

# Iniciar e habilitar
sudo systemctl enable --now nginx

# Verificar status
sudo systemctl status nginx

# Testar no browser: http://SEU_IP → página padrão do Nginx

Directory Structure

/etc/nginx/
├── nginx.conf              # configuração principal
├── sites-available/        # blocos de servidor disponíveis
├── sites-enabled/          # links simbólicos para os ativos
├── conf.d/                 # configurações extras (alternativa ao sites-*)
└── snippets/               # trechos reutilizáveis (SSL, fastcgi, etc.)

/var/log/nginx/
├── access.log              # todas as requisições
└── error.log               # erros e avisos

Virtual Host (Server Block)

A virtual host allows serving multiple domains on the same server:

# /etc/nginx/sites-available/meusite.com.br
server {
    listen 80;
    listen [::]:80;
    server_name meusite.com.br www.meusite.com.br;

    root /var/www/meusite.com.br;
    index index.html index.php;

    location / {
        try_files $uri $uri/ =404;
    }

    access_log /var/log/nginx/meusite.access.log;
    error_log  /var/log/nginx/meusite.error.log;
}

# Ativar o site
sudo ln -s /etc/nginx/sites-available/meusite.com.br            /etc/nginx/sites-enabled/

# Verificar sintaxe antes de recarregar
sudo nginx -t

# Recarregar sem derrubar conexões ativas
sudo systemctl reload nginx

Reverse Proxy for Node.js / Python / Any App

The most common use of Nginx in modern environments is as a reverse proxy: it receives the request on port 80/443 and forwards it to the application running on another port:

server {
    listen 80;
    server_name api.meusite.com.br;

    location / {
        proxy_pass         http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade    $http_upgrade;
        proxy_set_header   Connection 'upgrade';
        proxy_set_header   Host       $host;
        proxy_set_header   X-Real-IP  $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_cache_bypass $http_upgrade;
    }
}

This block works with Node.js, FastAPI (Python), Laravel (PHP via FPM), Rails, etc. Just change the port in proxy_pass.

Free HTTPS with Let's Encrypt

# Instalar Certbot
sudo apt install certbot python3-certbot-nginx -y

# Obter certificado e configurar Nginx automaticamente
sudo certbot --nginx -d meusite.com.br -d www.meusite.com.br

# Certbot adiciona automaticamente:
#   listen 443 ssl;
#   ssl_certificate / ssl_certificate_key
#   redirect de HTTP → HTTPS

# Renovação automática (já configurada via cron/systemd timer)
sudo certbot renew --dry-run

Performance Settings

# Em nginx.conf, dentro do bloco http {}

# Compressão gzip
gzip on;
gzip_types text/plain text/css application/json application/javascript
           text/xml application/xml image/svg+xml;
gzip_min_length 1024;

# Cache de arquivos estáticos
server {
    location ~* \.(jpg|jpeg|png|webp|avif|gif|ico|css|js|woff2)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }
}

Essential Commands

sudo nginx -t              # testa configuração (sempre antes de recarregar)
sudo systemctl reload nginx # recarrega sem derrubar conexões
sudo systemctl restart nginx # reinicia completamente
sudo nginx -s quit         # encerra graciosamente

# Ver erros em tempo real
sudo tail -f /var/log/nginx/error.log

# Ver requisições em tempo real
sudo tail -f /var/log/nginx/access.log

Nginx vs Apache

Nginx uses an event-driven (asynchronous) architecture, which means a single thread can handle thousands of simultaneous connections. Apache uses one thread or process per connection — great for compatibility with modules like mod_php, but heavier at scale. For modern servers with reverse proxy or high static load, Nginx is the standard choice.

Nginx and the LPI Certification

The LPIC-2 exam (topic 208) covers installation and configuration of web servers, including Nginx. Mastering virtual hosts, reverse proxy, and SSL already covers most of what's tested — and you also gain a highly sought-after skill for sysadmin and DevOps job openings.