Updated: 28 September 2026 · Applies to: Ubuntu 24.04, Debian 12, AlmaLinux 9 and Rocky Linux 9
Nginx can sit in front of an application (for example Node.js on port 3000, or a Docker container) and handle HTTPS for it.
Server block
server {
listen 80;
server_name app.example.com;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade; # WebSockets
proxy_set_header Connection "upgrade";
}
}
Reload with nginx -t && systemctl reload nginx, then add HTTPS:
Add a free SSL certificate
apt install certbot python3-certbot-nginx # Ubuntu / Debian dnf install epel-release && dnf install certbot python3-certbot-nginx # AlmaLinux / Rocky certbot --nginx -d example.com -d www.example.com
Certbot installs a timer that renews the certificate automatically; test it with certbot renew --dry-run.
Note: Make the application listen on 127.0.0.1 only, so it cannot be reached around the proxy. On AlmaLinux 9 / Rocky Linux 9 allow the proxy connection: setsebool -P httpd_can_network_connect 1.
