Nginx Config Generator

{
  "ssl": true,
  "gzip": true,
  "domain": "api.example.com",
  "rate_limit": 100,
  "www_redirect": true,
  "upstream_port": 3000
}

{
  "_meta": {
    "payment": {
      "method": "x402",
      "price_usd": 0.054000000000000006,
      "settlement_id": "0xedd0cd6a27032c21a7a403a02c82ba49654c7b2a22179e04e3ff3bf9b7dc6eeb"
    },
    "capability": "nginx-config-generate",
    "latency_ms": 8696,
    "provenance": {
      "source": "claude-haiku",
      "fetched_at": "2026-06-13T04:26:04.011Z"
    }
  },
  "notes": [
    "Replace /etc/letsencrypt/live/api.example.com/ paths with actual Let's Encrypt certificate locations",
    "Ensure /var/www/certbot directory exists for ACME challenges",
    "Rate limit burst of 200 allows short traffic spikes above 100 req/sec",
    "WebSocket support enabled via Upgrade and Connection headers",
    "All proxy headers forwarded for proper upstream logging and client detection",
    "SSL configuration uses TLSv1.2 and TLSv1.3 only for security",
    "Gzip compression excludes binary types to avoid overhead",
    "Consider adjusting proxy_read_timeout based on application requirements",
    "Log files should be rotated using logrotate or similar tool",
    "Certbot renewal hooks should reload nginx after certificate updates"
  ],
  "config": "# Rate limiting zone\nlimit_req_zone $binary_remote_addr zone=api_limit:10m rate=100r/s;\n\n# Redirect www to non-www\nserver {\n    listen 80;\n    listen [::]:80;\n    server_name www.api.example.com;\n    return 301 http://api.example.com$request_uri;\n}\n\nserver {\n    listen 443 ssl http2;\n    listen [::]:443 ssl http2;\n    server_name www.api.example.com;\n    \n    ssl_certificate /etc/letsencrypt/live/api.example.com/fullchain.pem;\n    ssl_certificate_key /etc/letsencrypt/live/api.example.com/privkey.pem;\n    \n    return 301 https://api.example.com$request_uri;\n}\n\n# HTTP to HTTPS redirect\nserver {\n    listen 80;\n    listen [::]:80;\n    server_name api.example.com;\n    return 301 https://api.example.com$request_uri;\n}\n\n# Main HTTPS server\nserver {\n    listen 443 ssl http2;\n    listen [::]:443 ssl http2;\n    server_name api.example.com;\n    \n    # SSL Configuration\n    ssl_certificate /etc/letsencrypt/live/api.example.com/fullchain.pem;\n    ssl_certificate_key /etc/letsencrypt/live/api.example.com/privkey.pem;\n    ssl_protocols TLSv1.2 TLSv1.3;\n    ssl_ciphers HIGH:!aNULL:!MD5;\n    ssl_prefer_server_ciphers on;\n    ssl_session_cache shared:SSL:10m;\n    ssl_session_timeout 10m;\n    ssl_stapling on;\n    ssl_stapling_verify on;\n    ssl_trusted_certificate /etc/letsencrypt/live/api.example.com/chain.pem;\n    \n    # Rate limiting\n    limit_req zone=api_limit burst=200 nodelay;\n    limit_req_status 429;\n    \n    # Gzip compression\n    gzip on;\n    gzip_vary on;\n    gzip_min_length 1000;\n    gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml+rss application/javascript application/json;\n    gzip_disable \"msie6\";\n    gzip_comp_level 6;\n    \n    # Security headers\n    add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;\n    add_header X-Frame-Options \"SAMEORIGIN\" always;\n    add_header X-Content-Type-Options \"nosniff\" always;\n    add_header Referrer-Policy \"strict-origin-when-cross-origin\" always;\n    add_header X-XSS-Protection \"1; mode=block\" always;\n    add_header Permissions-Policy \"geolocation=(), microphone=(), camera=()\" always;\n    \n    # Logging\n    access_log /var/log/nginx/api.example.com_access.log;\n    error_log /var/log/nginx/api.example.com_error.log;\n    \n    # Client body size\n    client_max_body_size 10M;\n    \n    location / {\n        # Proxy settings\n        proxy_pass http://localhost:3000;\n        proxy_http_version 1.1;\n        \n        # WebSocket support\n        proxy_set_header Upgrade $http_upgrade;\n        proxy_set_header Connection \"upgrade\";\n        \n        # Standard proxy headers\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n        proxy_set_header X-Forwarded-Host $server_name;\n        proxy_set_header X-Forwarded-Port $server_port;\n        \n        # Proxy timeouts\n        proxy_connect_timeout 60s;\n        proxy_send_timeout 60s;\n        proxy_read_timeout 60s;\n        \n        # Buffering\n        proxy_buffering on;\n        proxy_buffer_size 4k;\n        proxy_buffers 8 4k;\n    }\n    \n    # Let's Encrypt ACME challenge\n    location /.well-known/acme-challenge/ {\n        root /var/www/certbot;\n    }\n}",
  "domain": "api.example.com",
  "upstream_port": 3000,
  "features_enabled": [
    "SSL/TLS with Let's Encrypt",
    "HTTP to HTTPS redirect",
    "WWW to non-WWW redirect",
    "Rate limiting (100 req/sec with 200 burst)",
    "Gzip compression",
    "WebSocket support",
    "HTTP/2",
    "Proxy pass to upstream port 3000",
    "Security headers",
    "SSL stapling",
    "ACME challenge support"
  ],
  "security_headers_included": [
    "Strict-Transport-Security (HSTS)",
    "X-Frame-Options",
    "X-Content-Type-Options",
    "Referrer-Policy",
    "X-XSS-Protection",
    "Permissions-Policy"
  ]
}