How to Install and Configure Nginx on an Ubuntu VPS

Nginx is the most widely used web server on Linux VPS for a reason: small footprint (around 5-10 MB of RAM at idle), an event-driven model that handles thousands of concurrent connections with just a few workers, and a declarative configuration that scales well from a single static site to a reverse proxy for microservices. But running apt install nginx alone leaves most of the real work undone — default server blocks, no HTTPS, an unconfigured firewall.

This tutorial covers the full sequence to put an Ubuntu VPS serving a site (static or application) with Nginx in production: installation, a per-domain server block, UFW firewall, HTTPS certificate via Let’s Encrypt and minimal performance tuning. Persona: developer about to deploy an application or static site who wants a clean, auditable setup — not a copy-paste that hides decisions.

Estimated time: 25-35 minutes, counting DNS propagation if you have not pointed the domain yet.

Prerequisites

Confirm the domain resolves correctly before moving on. From another machine, run dig +short yourdomain.com — the answer should be exactly your VPS IP. If you just pointed the record, wait for propagation to complete before trying to issue a certificate, because every Let’s Encrypt failure counts toward the weekly rate limit.

Installing Nginx

The first step is to install the package and verify that the service comes up correctly. Ubuntu ships Nginx packaged and integrated with systemd, so the cycle is straightforward.

sudo apt update

sudo apt install -y nginx

sudo systemctl status nginx

Configuring the UFW firewall

Before exposing ports, configure the firewall. UFW (Uncomplicated Firewall) ships with Ubuntu and uses named profiles to simplify common rules.

sudo ufw app list

sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable

Server blocks for multiple domains

Server blocks (the equivalent of Apache virtual hosts) let you serve more than one site on the same VPS, each with its own domain and file root. Even if you only have one site for now, setting it up via a server block makes future expansion easier.

sudo mkdir -p /var/www/yourdomain.com/html
sudo chown -R $USER:$USER /var/www/yourdomain.com/html
sudo chmod -R 755 /var/www/yourdomain.com

echo "<h1>It works</h1>" > /var/www/yourdomain.com/html/index.html

server {
    listen 80;
    listen [::]:80;

    root /var/www/yourdomain.com/html;
    index index.html index.htm;

    server_name yourdomain.com www.yourdomain.com;

    location / {
        try_files $uri $uri/ =404;
    }
}

sudo ln -s /etc/nginx/sites-available/yourdomain.com /etc/nginx/sites-enabled/
sudo rm /etc/nginx/sites-enabled/default

sudo nginx -t
sudo systemctl reload nginx

HTTPS with Let’s Encrypt

Without HTTPS today you lose SEO, ranking, every modern browser shows “Not secure”, and forms break. Certbot from the Let’s Encrypt project automates free issuance and renewal.

sudo apt install -y certbot python3-certbot-nginx

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

Verification

Confirm everything is live. Open https://yourdomain.com in the browser — it should load the test page with a green padlock. From the command line, validate the TLS handshake and headers:

curl -I https://yourdomain.com

The expected response starts with HTTP/2 200 (Certbot enables HTTP/2 by default) and includes server: nginx/1.x.x. If it shows HTTP/1.1, your configuration is missing http2 — add it in listen 443 ssl http2; inside the server block.

To inspect the certificate itself:

echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -dates -issuer

You’ll see notBefore and notAfter (90-day validity) and the issuer “Let’s Encrypt”.

Basic tuning for production

The default Nginx config works, but three parameters are worth adjusting before taking real traffic. Edit /etc/nginx/nginx.conf:

• worker_processes auto; — uses one worker per CPU core automatically. Already set to auto in recent versions, just confirm.
• worker_connections 4096; — raises the simultaneous connection limit per worker (the default 768 is conservative). On small VPS with little RAM, keep 1024.
• keepalive_timeout 30; — dropping from 65s to 30s frees workers faster on short HTTP workloads.

After editing, run sudo nginx -t && sudo systemctl reload nginx.

Next steps

With Nginx up and serving HTTPS, common next moves:

• Reverse proxy for Node/Python/Go — replace try_files with proxy_pass http://127.0.0.1:3000; pointing to your application running on an internal port.
• HTTP/3 (QUIC) — requires Nginx 1.25+ compiled with proper TLS support; evaluate whether the latency gain justifies leaving the official Ubuntu package.
• Rate limiting — limit_req_zone protects against abuse on sensitive endpoints (login, public APIs).
• Structured logs (JSON) — makes ingestion into observability tools easier. Configure it via a custom log_format.
• Backup of /etc/nginx/ — versioning your configs in a private Git repository avoids hours of rebuilding after a reinstall.

If you are putting this in production, a Hostini VPS ships with Ubuntu LTS, a dedicated IPv4 and a KVM console in the panel — useful when you lock yourself out editing firewall rules and need to recover access without opening a ticket.