A minimal nginx config for static sites

Most nginx examples online are copied from configs built for big applications. For a handful of HTML files you need very little. This is roughly what serves this site.

server {
    listen 80;
    server_name example.org;
    location /.well-known/acme-challenge/ { root /var/www/example.org; }
    location / { return 301 https://$host$request_uri; }
}

server {
    listen 443 ssl;
    http2 on;
    server_name example.org;

    ssl_certificate     /etc/letsencrypt/live/example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.org/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;

    root /var/www/example.org;
    index index.html;
    error_page 404 /404.html;

    location / { try_files $uri $uri/ =404; }

    location ~* \.(css|svg|png|jpg|woff2)$ {
        expires 30d;
        add_header Cache-Control "public";
    }
}

Notes

• http2 on; is the newer syntax (nginx 1.25.1+). On older versions it's listen 443 ssl http2;.
• try_files $uri $uri/ =404 stops nginx from falling through to anything unexpected. Missing files are simply a 404.
• The port 80 block only exists for Let's Encrypt and the redirect. Certbot's --webroot mode drops its challenge file in the folder above, so it never needs to touch the config.
• Gzip is on by default in Debian's nginx.conf for text/html. Add gzip_types text/css application/javascript image/svg+xml; if you care about the rest.

Test before reloading, every time:

nginx -t && systemctl reload nginx