This guide will walk you through the basics of Nginx, explaining its structure and showing you how to set up your very first website.

1. Installation

If you haven’t already, you can install Nginx on any Debian-based system (like Ubuntu) with a single command. It’s also good practice to ensure your firewall allows web traffic.

# Install Nginx
sudo apt update
sudo apt install nginx -y

# Allow Nginx through the firewall
sudo ufw allow 'Nginx Full'

To check that it’s running, you can use systemctl:

sudo systemctl status nginx

If it’s active, you can visit your server’s IP address in a web browser, and you should see the default “Welcome to Nginx!” page.

2. Understanding the Nginx Directory Structure

Nginx’s configuration can seem intimidating, but it’s very logical. All the important files live in /etc/nginx/.

• /etc/nginx/nginx.conf: The main configuration file. You will rarely need to edit this file directly.
• /etc/nginx/sites-available/: This is where you will store the configuration files for each of your websites. Think of it as a library of all possible sites you could host.
• /etc/nginx/sites-enabled/: This directory contains symbolic links (shortcuts) to the files in sites-available. Nginx only reads the configurations in this sites-enabled directory. This setup allows you to easily turn websites on and off without deleting their configuration.

3. Setting Up Your First Site (A Server Block)

Let’s host a website for a domain you own, your-domain.com. First, ensure you have pointed your domain to your server’s IP address using an A record at your domain registrar.

Step 1: Create a Home for Your Website

It’s standard practice to store website files in the /var/www/ directory.

# Create a directory for your domain
sudo mkdir -p /var/www/your-domain.com/html

# Assign ownership to your current user so you can edit files easily
sudo chown -R $USER:$USER /var/www/your-domain.com/html

Step 2: Create a Sample Page

Let’s create a simple index.html file for Nginx to serve.

echo "<h1>Success! The your-domain.com server block is working!</h1>" > /var/www/your-domain.com/html/index.html

Step 3: Create the Nginx Configuration File

Nginx calls the configuration for a single site a “server block”. We will create a new file in sites-available for our domain.

sudo nano /etc/nginx/sites-available/your-domain.com

Paste in the following configuration. Each line is explained by the comments.

# This defines a server
server {
    # Listen on port 80 (standard HTTP) for both IPv4 and IPv6
    listen 80;
    listen [::]:80;

    # The root directory where the website files are stored
    root /var/www/your-domain.com/html;

    # The order of files to look for when a request comes in
    index index.html index.htm;

    # The domain names this server block should respond to
    server_name your-domain.com www.your-domain.com;

    # This block handles how to find files
    location / {
        # Try to serve the requested file, then a directory, or else show a 404 error
        try_files $uri $uri/ =404;
    }
}

Step 4: Enable Your Site

Now, we need to tell Nginx to actually use this configuration. We do this by creating a symbolic link to the file in the sites-enabled directory.

sudo ln -s /etc/nginx/sites-available/your-domain.com /etc/nginx/sites-enabled/

Step 5: Test and Restart Nginx

It’s very important to test your configuration file for syntax errors before restarting Nginx.

sudo nginx -t

If you see syntax is ok and test is successful, you are good to go. Restart Nginx to apply the changes.

sudo systemctl restart nginx

That’s it! If you now visit http://your-domain.com in your browser, you will see your “Success!” message instead of the default Nginx welcome page.

4. What’s Next?

You have successfully configured Nginx to host a basic website. This is the foundation for hosting any web project. From here, you can:

• Host multiple websites on the same server by creating a new directory and a new server block file for each domain.
• Set up a reverse proxy to pass traffic to applications running on different ports (like Node.js or Python apps).
• Secure your sites with SSL/TLS using a free tool like Certbot to enable HTTPS.

These more advanced topics are covered in our “Advanced VPS Guide: Mastering Nginx, Subdomains, and Reverse Proxies”.

This guide is designed for the absolute beginner. We will walk through the first essential steps to secure your server, get it ready for projects, and host your first website securely with Nginx and a free SSL certificate.

1. Your First Login: The Root User

Your hosting provider will give you an IP address (e.g., 123.45.67.89) and a password for the root user. The root user is the super-administrator with unlimited power. It’s powerful, but also risky to use for everyday tasks.

Step 1: Connect to the Server

Open a terminal on your computer and connect to your server using the ssh command.

ssh root@YOUR_SERVER_IP

Step 2: Change the Root Password

If your provider gave you a temporary password, your first action should be to change it to something strong and unique.

passwd

2. Create Your Own User Account

This is the single most important security step. We will create a standard user account and give it administrative privileges using the sudo command.

Step 1: Create the New User

Replace devuser with a username you like.

adduser devuser

Step 2: Grant Administrative Privileges

Add your new user to the sudo group, which allows it to run commands as the administrator.

usermod -aG sudo devuser

Step 3: Log in as Your New User

Log out of the root account (exit) and log back in with your new credentials.

ssh devuser@YOUR_SERVER_IP

From now on, you should always log in with this user.

3. Update System and Install Essential Tools

Now that you are logged in as your new sudo user, the first actions are to update the server and install some essential tools.

Step 1: Update the System

This command downloads the latest list of available software (update) and then installs those updates (upgrade).

sudo apt update && sudo apt upgrade -y

Step 2: Install Basic Tools

Next, install a few common and useful tools.

sudo apt install curl git vim htop unzip nginx -y

We include Nginx here as it is a lightweight, high-performance web server we will configure later.

4. Set Your Timezone

Correct server time is important for logs and many applications. Find your timezone from the list and set it.

# Find your timezone (press 'q' to quit the list)
timedatectl list-timezones

# Set your timezone (replace with your own)
sudo timedatectl set-timezone Asia/Kolkata

5. Basic Firewall Setup

A firewall is a digital security guard. We will use ufw (Uncomplicated Firewall) to block unwanted traffic.

Step 1: Allow Essential Traffic

This is critical: You must allow SSH traffic, otherwise the firewall will lock you out. We will also allow Nginx traffic.

sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'

‘Nginx Full’ allows traffic on both HTTP (port 80) and HTTPS (port 443).

Step 2: Enable the Firewall

Now, turn the firewall on.

sudo ufw enable

6. Host a Website with Nginx

Now we will configure Nginx to serve a website for a domain you own.

Step 0: Point Your Domain to the Server (DNS)

Before Nginx can work, you have to tell the internet that your domain should point to your server’s IP address. You do this at your domain registrar (the company where you bought your domain, like GoDaddy, Namecheap, Google Domains, etc.).

1. Log in to your domain registrar’s website.
2. Find the DNS management page for your domain.
3. You need to create two ‘A’ records:
   • Record 1 (Root Domain):
     • Type: A
     • Host/Name: @ (this symbol represents the root domain itself)
     • Value/Points to: Your server’s IP address (e.g., 123.45.67.89)
     • TTL (Time to Live): Leave as default (often 1 hour).
   • Record 2 (www subdomain):
     • Type: A
     • Host/Name: www
     • Value/Points to: Your server’s IP address (the same one)
     • TTL: Leave as default.

DNS changes can take anywhere from a few minutes to a few hours to update across the internet.

Step 1: Create a Directory for Your Site

We’ll store our website’s files in the /var/www directory.

# Create a directory for your domain
sudo mkdir -p /var/www/your-domain.com/html

# Assign ownership to your user
sudo chown -R $USER:$USER /var/www/your-domain.com/html

Step 2: Create a Sample Page

Let’s create a simple index.html file for testing.

echo "<h1>Hello from my Nginx Site!</h1>" | sudo tee /var/www/your-domain.com/html/index.html

Step 3: Create an Nginx Server Block

Nginx uses “server block” files to know how to handle incoming domains. We’ll create one for our domain.

sudo nano /etc/nginx/sites-available/your-domain.com

Paste the following configuration into the file:

server {
    listen 80;
    listen [::]:80;

    root /var/www/your-domain.com/html;
    index index.html;

    server_name your-domain.com www.your-domain.com;

    location / {
        try_files $uri $uri/ =404;
    }
}

Step 4: Enable the Server Block

We enable the site by creating a symbolic link from this file into the sites-enabled directory.

sudo ln -s /etc/nginx/sites-available/your-domain.com /etc/nginx/sites-enabled/

Now, test your Nginx configuration for errors and restart it.

sudo nginx -t
sudo systemctl restart nginx

Once your DNS has updated, if you visit http://your-domain.com in a browser, you should see your “Hello World” message.

7. Secure Your Site with SSL (HTTPS)

To secure your site, we’ll get a free SSL certificate from Let’s Encrypt using a tool called Certbot.

Step 1: Install Certbot

Certbot has a dedicated Nginx plugin that makes the process simple.

sudo apt install certbot python3-certbot-nginx -y

Step 2: Obtain the SSL Certificate

Run Certbot. It will read your Nginx configuration, see the domain you just set up, and guide you through obtaining the certificate.

sudo certbot --nginx

Certbot will ask for your email, for you to agree to the terms of service, and if you want to redirect all HTTP traffic to HTTPS. It is highly recommended to choose the redirect option.

Step 3: Verify Auto-Renewal

Let’s Encrypt certificates are valid for 90 days. Certbot automatically sets up a task to renew them for you. You can test the renewal process with a dry run.

sudo certbot renew --dry-run

If this runs without errors, you are all set. Your site is now secure and accessible via https://your-domain.com.

To add a subdomain (e.g., blog.your-domain.com), you simply repeat the process: create a new directory in /var/www, create a new server block file in sites-available, enable it, and then run sudo certbot --nginx again.

8. Quick Tips and Best Practices

• Use SSH Keys: Passwords can be cracked. SSH keys are a much more secure way to log in. This is a highly recommended next security step.

• Keep Your System Updated: Get in the habit of running sudo apt update && sudo apt upgrade -y at least once a week.

• Be Careful with Commands: Don’t run scripts or commands from the internet without understanding what they do.

• Use Strong Passwords: The password for your sudo user should be strong and unique.

1. Initial Server Setup

After acquiring a VPS, you’ll get an IP address and root access. Your first steps are to secure the server and create a non-root user for daily operations.

Connect to your server via SSH:

ssh root@YOUR_SERVER_IP

Create a Sudo User

Operating as root is risky. Create a new user and grant administrative privileges.

# Create the new user (replace 'devuser' with your username)
adduser devuser

# Add the user to the 'sudo' group
usermod -aG sudo devuser

Now, set up SSH key authentication for your new user for enhanced security and convenience, then log in as that user.

2. Essential Security and Updates

A public server is a constant target. Secure it immediately.

Configure the Firewall

ufw (Uncomplicated Firewall) makes this easy. We’ll allow SSH, HTTP, and HTTPS traffic.

# Allow OpenSSH (so you don't lock yourself out)
sudo ufw allow OpenSSH

# Allow Nginx to handle web traffic on ports 80 and 443
sudo ufw allow 'Nginx Full'

# Enable the firewall
sudo ufw enable

After enabling, check its status to ensure it’s active and your rules are loaded.

sudo ufw status

Update Your Server

Keep your system’s packages current to patch security vulnerabilities.

sudo apt update && sudo apt upgrade -y

3. Installing and Understanding Nginx

Nginx is the heart of our setup. It’s a high-performance web server that can also act as a reverse proxy, load balancer, and more.

# Install Nginx
sudo apt install nginx -y

While the package should start and enable Nginx automatically, it’s good practice to run the commands explicitly to be sure.

# Start the Nginx service
sudo systemctl start nginx

# Enable Nginx to start automatically on boot
sudo systemctl enable nginx

# Now, check that it's running and enabled
sudo systemctl status nginx

You should see active (running) in the output. Visiting your server’s IP in a browser should also show the Nginx welcome page.

Nginx Configuration Structure

Nginx’s configuration lives in /etc/nginx. The -p flag in the commands below ensures that the command does nothing if the directories already exist.

sudo mkdir -p /etc/nginx/sites-available
sudo mkdir -p /etc/nginx/sites-enabled

The key directories are:

• /etc/nginx/nginx.conf: The main configuration file. You rarely edit this.
• /etc/nginx/sites-available/: Where you store the configuration files for each of your sites (called “server blocks”).
• /etc/nginx/sites-enabled/: Where you create symbolic links to the configurations in sites-available that you want to be active.

This structure lets you easily enable or disable sites without deleting their configuration files.

4. Advanced Hosting: Subdomains and Reverse Proxies

This is where the magic happens. A single server can host a blog, a portfolio website, a web app, and several APIs, all neatly organized using subdomains.

The core concept is the Reverse Proxy. Your Nginx server listens on the standard web ports (80 for HTTP, 443 for HTTPS) and intelligently forwards incoming requests to the correct internal service based on the requested domain or subdomain.

Scenario:

Let’s say we want to set up the following on our server:

1. eknath.dev: A static HTML/CSS website.
2. blog.eknath.dev: A separate project, maybe a Hugo or Jekyll site.
3. api.eknath.dev: A Node.js application running on port 3000.

Step 1: Create Project Directories

Organize your projects in the /var/www directory.

# Create directories for the main site and blog
sudo mkdir -p /var/www/eknath.dev/html
sudo mkdir -p /var/www/blog.eknath.dev/html

# Set correct permissions
sudo chown -R $USER:$USER /var/www/eknath.dev
sudo chown -R $USER:$USER /var/www/blog.eknath.dev

Verify that the directories were created with the correct ownership.

ls -ld /var/www/eknath.dev/
ls -ld /var/www/blog.eknath.dev/

Now, place some placeholder files.

echo "<h1>Welcome to Eknath's Site</h1>" | sudo tee /var/www/eknath.dev/html/index.html
echo "<h1>Welcome to Eknath's Blog</h1>" | sudo tee /var/www/blog.eknath.dev/html/index.html

Step 2: Create Nginx Server Blocks

Now, we create a configuration file for each site in sites-available.

For the main domain (eknath.dev):

sudo nano /etc/nginx/sites-available/eknath.dev

Add the following server block:

server {
    listen 80;
    listen [::]:80;

    server_name eknath.dev www.eknath.dev;

    root /var/www/eknath.dev/html;
    index index.html index.php;

    location / {
        try_files $uri $uri/ =404;
    }
}

For the blog subdomain (blog.eknath.dev):

sudo nano /etc/nginx/sites-available/blog.eknath.dev

Add this configuration:

server {
    listen 80;
    listen [::]:80;

    server_name blog.eknath.dev;

    root /var/www/blog.eknath.dev/html;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

Step 3: Configure the Reverse Proxy for the API

For api.eknath.dev, we’ll proxy requests to our Node.js app, which we assume is running on http://127.0.0.1:3000.

Create the configuration file:

sudo nano /etc/nginx/sites-available/api.eknath.dev

Add the reverse proxy configuration:

server {
    listen 80;
    listen [::]:80;

    server_name api.eknath.dev;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Step 4: Enable the Sites and Test

Now, link these configurations into sites-enabled to activate them.

sudo ln -s /etc/nginx/sites-available/eknath.dev /etc/nginx/sites-enabled/
sudo ln -s /etc/nginx/sites-available/blog.eknath.dev /etc/nginx/sites-enabled/
sudo ln -s /etc/nginx/sites-available/api.eknath.dev /etc/nginx/sites-enabled/

Test the Nginx configuration for syntax errors:

sudo nginx -t

If it’s successful, restart Nginx to apply the changes:

sudo systemctl restart nginx

Check the status to ensure it restarted correctly.

sudo systemctl status nginx

After setting up your DNS records, you’ll be able to access each service through its unique subdomain.

5. Securing Your Sites with SSL (HTTPS)

We’ll use Let’s Encrypt, a free and automated Certificate Authority, and Certbot, a tool that makes managing SSL/TLS certificates effortless.

Step 1: Install Certbot

Certbot has a dedicated Nginx plugin that automates the process.

# Install Certbot and its Nginx plugin
sudo apt install certbot python3-certbot-nginx -y

Step 2: Obtain and Install the SSL Certificates

With your server blocks already configured, running Certbot is incredibly simple.

# Run Certbot to get certificates for all configured domains
sudo certbot --nginx

Certbot will guide you through a few simple steps:

1. Enter your email address.
2. Agree to the Terms of Service.
3. Choose domains from the list Certbot finds.
4. Choose to redirect HTTP to HTTPS. This is highly recommended.

Step 3: Verify the New Configuration

Certbot automatically modifies your Nginx files to enable HTTPS. You can check the new configuration by running sudo nginx -t and then reloading Nginx with sudo systemctl reload nginx.

Step 4: Understanding Automatic Renewal

Let’s Encrypt certificates are valid for 90 days. The Certbot package automatically sets up a task to renew them. You can test the renewal process with a dry run:

sudo certbot renew --dry-run

If this command runs without errors, your auto-renewal is set up correctly.

Conclusion

You have now transformed a basic VPS into a sophisticated, multi-tenant hosting platform. By leveraging Nginx’s server blocks and reverse proxy capabilities, you can host and manage numerous projects, each on its own subdomain, from a single server. Happy hosting!