nginx-config-prolisted

# nginx-config-pro ## Overview Authoritative guidance for writing secure, performant nginx reverse-proxy configurations. Produces server blocks that terminate TLS, speak HTTP/2, proxy to upstream applications, cache responses, throttle abusive clients, and compress payloads — without the footguns that cause 502s, header leaks, or weak ciphers. **Keywords:** nginx, reverse proxy, TLS, SSL, HTTPS, HTTP/2, HTTP/3, certbot, Let's Encrypt, upstream, proxy_pass, gzip, brotli, rate limiting, limit_req, proxy_cache, security headers, HSTS, CSP, OCSP stapling, websocket, load balancing, 502 bad gateway, 504 gateway timeout. This skill targets nginx 1.18+ (most directives work on 1.10+). HTTP/3 notes assume 1.25+. ## When to use - Standing up nginx in front of an app server (Node, Django/gunicorn, Rails/puma, PHP-FPM, a container). - Adding or fixing TLS, redirects, or HSTS. - Diagnosing 502/504, header duplication, or caching misses. - Reviewing an existing `nginx.conf` for security and performance. ## Workflow Follow these steps in order. Each builds on the previous. 1. **Gather inputs.** Determine: domain name(s), upstream address (host:port or socket), app protocol (http/https/grpc/websocket), whether TLS certs exist or need Let's Encrypt, expected traffic profile (for rate limits and cache), and static asset paths. 2. **Choose a topology.** Single upstream vs. load-balanced pool; HTTP/1.1 keepalive to upstream vs. fresh connections; whether caching is safe (idempotent GET