`sudo systemctl start nginx`	Start Nginx service
`sudo systemctl stop nginx`	Stop Nginx service
`sudo systemctl restart nginx`	Restart Nginx service
`sudo systemctl reload nginx`	Reload config without restart
`sudo systemctl status nginx`	Check Nginx status
`sudo systemctl enable nginx`	Enable auto-start on boot
`sudo systemctl disable nginx`	Disable auto-start

Direct Commands

`nginx`	Start Nginx
`nginx -s stop`	Fast shutdown
`nginx -s quit`	Graceful shutdown
`nginx -s reload`	Reload configuration
`nginx -s reopen`	Reopen log files
`nginx -t`	Test configuration
`nginx -T`	Test and dump configuration
`nginx -v`	Show version
`nginx -V`	Show version and configure options

📁 Configuration Files

File Locations

`/etc/nginx/nginx.conf`	Main configuration file
`/etc/nginx/conf.d/`	Additional config directory
`/etc/nginx/sites-available/`	Available site configs (Debian)
`/etc/nginx/sites-enabled/`	Enabled site configs (Debian)
`/var/log/nginx/access.log`	Access log file
`/var/log/nginx/error.log`	Error log file
`/var/www/html/`	Default web root

Site Management

`sudo ln -s /etc/nginx/sites-available/site /etc/nginx/sites-enabled/`	Enable a site
`sudo rm /etc/nginx/sites-enabled/site`	Disable a site
`sudo nginx -t && sudo systemctl reload nginx`	Test and apply changes

📝 Basic Configuration

Main Context

`user nginx;`	Worker process user
`worker_processes auto;`	Number of worker processes
`error_log /var/log/nginx/error.log;`	Error log path
`pid /run/nginx.pid;`	PID file path

Events & HTTP Context

`worker_connections 1024;`	Max connections per worker
`use epoll;`	Use epoll (Linux)
`multi_accept on;`	Accept multiple connections at once
`include /etc/nginx/mime.types;`	Include MIME types
`sendfile on;`	Enable sendfile
`keepalive_timeout 65;`	Keep-alive timeout
`gzip on;`	Enable gzip compression

🖥️ Server Block

Basic Server

`listen 80;`	Listen on port 80
`listen 80 default_server;`	Default server for port 80
`listen [::]:80;`	Listen on IPv6 port 80
`server_name example.com www.example.com;`	Server name(s)
`server_name _;`	Catch-all server name
`root /var/www/html;`	Document root
`index index.html index.htm;`	Default index files

SSL/TLS Configuration

`listen 443 ssl;`	Listen on HTTPS port
`listen 443 ssl http2;`	Enable HTTP/2
`ssl_certificate /path/to/cert.pem;`	SSL certificate path
`ssl_certificate_key /path/to/key.pem;`	SSL key path
`ssl_protocols TLSv1.2 TLSv1.3;`	Allowed SSL protocols
`ssl_prefer_server_ciphers on;`	Prefer server ciphers
`ssl_session_cache shared:SSL:10m;`	SSL session cache

📍 Location Block

Location Matching

`location / { }`	Prefix match (least specific)
`location /images/ { }`	Prefix match for /images/
`location = / { }`	Exact match
`location ~ \.php$ { }`	Case-sensitive regex
`location ~* \.(jpg\|png)$ { }`	Case-insensitive regex
`location ^~ /static/ { }`	Prefix match (stops regex search)

Location Directives

`root /var/www/site;`	Set document root
`alias /var/www/files/;`	Replace location path
`try_files $uri $uri/ /index.html;`	Try files in order
`try_files $uri $uri/ =404;`	Return 404 if not found
`autoindex on;`	Enable directory listing

🔄 Reverse Proxy

Proxy Configuration

`proxy_pass http://localhost:3000;`	Proxy to backend server
`proxy_set_header Host $host;`	Pass original host header
`proxy_set_header X-Real-IP $remote_addr;`	Pass client IP
`proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;`	Pass forwarded-for header
`proxy_set_header X-Forwarded-Proto $scheme;`	Pass protocol (http/https)

Proxy Timeouts

`proxy_connect_timeout 60s;`	Connection timeout
`proxy_send_timeout 60s;`	Send timeout
`proxy_read_timeout 60s;`	Read timeout
`proxy_buffering on;`	Enable response buffering
`proxy_buffer_size 4k;`	Buffer size for first response

⚖️ Load Balancing

Upstream Configuration

`upstream backend { server 127.0.0.1:3001; server 127.0.0.1:3002; }`	Define upstream group
`proxy_pass http://backend;`	Use upstream group
`server 127.0.0.1:3001 weight=3;`	Server with weight
`server 127.0.0.1:3001 backup;`	Backup server
`server 127.0.0.1:3001 down;`	Mark server as down

Load Balancing Methods

`(default)`	Round-robin (default)
`least_conn;`	Least connections
`ip_hash;`	IP hash (sticky sessions)
`hash $request_uri;`	Hash based on URI
`hash $request_uri consistent;`	Consistent hash

💾 Caching

Static File Caching

`expires 30d;`	Cache for 30 days
`expires max;`	Cache indefinitely
`expires -1;`	No cache
`add_header Cache-Control "public, max-age=86400";`	Custom cache header
`etag on;`	Enable ETag

Proxy Cache

`proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m;`	Define cache zone
`proxy_cache my_cache;`	Enable caching in location
`proxy_cache_valid 200 1d;`	Cache 200 responses for 1 day
`proxy_cache_valid any 1m;`	Cache any response for 1 minute
`proxy_cache_bypass $http_cache_control;`	Bypass cache condition

🔒 Security

Security Headers

`add_header X-Frame-Options "SAMEORIGIN";`	Prevent clickjacking
`add_header X-Content-Type-Options "nosniff";`	Prevent MIME sniffing
`add_header X-XSS-Protection "1; mode=block";`	XSS protection
`add_header Strict-Transport-Security "max-age=31536000";`	HSTS header
`add_header Content-Security-Policy "default-src 'self'";`	CSP header

Access Control

`allow 192.168.1.0/24;`	Allow IP range
`deny all;`	Deny all
`auth_basic "Restricted";`	Basic authentication
`auth_basic_user_file /etc/nginx/.htpasswd;`	Password file
`limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;`	Rate limiting zone
`limit_req zone=one burst=5;`	Apply rate limiting

📊 Logging

Log Configuration

`access_log /var/log/nginx/access.log;`	Access log path
`access_log off;`	Disable access log
`error_log /var/log/nginx/error.log warn;`	Error log with level
`log_format main '$remote_addr - $request';`	Custom log format
`access_log /var/log/nginx/access.log main;`	Use custom format

Log Variables

`$remote_addr`	Client IP address
`$request`	Full request line
`$status`	Response status code
`$body_bytes_sent`	Response body size
`$http_user_agent`	User agent
`$request_time`	Request processing time

↪️ Redirects & Rewrites

Redirects

`return 301 https://$host$request_uri;`	Permanent redirect to HTTPS
`return 302 /new-location;`	Temporary redirect
`return 404;`	Return 404 status
`return 200 "OK";`	Return 200 with body

Rewrites

`rewrite ^/old$ /new permanent;`	Permanent rewrite (301)
`rewrite ^/old$ /new redirect;`	Temporary rewrite (302)
`rewrite ^/old$ /new last;`	Rewrite and restart matching
`rewrite ^/old$ /new break;`	Rewrite and stop
`rewrite ^/user/(.*)$ /profile?id=$1 last;`	Rewrite with capture group

🔧 Variables

Built-in Variables

`$host`	Request host header
`$uri`	Request URI (normalized)
`$request_uri`	Original request URI
`$args`	Query string
`$scheme`	Request scheme (http/https)
`$remote_addr`	Client IP
`$server_name`	Matched server name

Conditionals (if)

`if ($request_method = POST) { }`	Check request method
`if ($http_user_agent ~* "bot") { }`	Regex match user agent
`if ($arg_debug) { }`	Check query parameter exists
`if (-f $request_filename) { }`	Check file exists
`set $var "value";`	Set variable

💡 Tips & Examples

Useful Commands

`htpasswd -c /etc/nginx/.htpasswd user`	Create password file
`tail -f /var/log/nginx/access.log`	Follow access log
`tail -f /var/log/nginx/error.log`	Follow error log
`sudo certbot --nginx`	Let's Encrypt SSL with Certbot

Best Practices

Always test config with nginx -t before reload
Use include to organize configs into multiple files
Enable gzip compression for text-based content
Set appropriate cache headers for static assets
Use HTTPS with modern TLS protocols (1.2, 1.3)