Most modern websites will say "https" at the beginning of its URL. What is that for? Security. It encrypts traffic and makes information like passwords secured. I honestly do not fully understand how it works, but I know how to set it up. First we need two things: NGINX, and certbot. I would've included NGINX in the install script from earlier, but it is useless unless you do HTTPS. The commands to install each are sudo apt install nginx -y for NGINX, and sudo apt install certbot python3-certbot-nginx for the version of certbot we are going to use. Once both installed, run sudo nginx -t to make sure it's ok. I do also want to mention again, HTTPS requires a domain name and like I said earlier, Cloudflare Also after NGINX is installed, go to your LAN IP in the browser with no port number, and you should see this screen. The directory for that is /var/www/html but that does not need to be touched unless you do a website like this site you're reading this on. At the end of this section, I'll show you how to set that up.
Before we create the configuration, make sure you do a couple things. Make sure ports 80 and 443 are forwarded to your server's LAN IP. Then, go to your domain on Cloudflare, go to DNS, go to records, and click "add record". For the type, make sure it says A. When it asks for a name, do one with the @ for root. Input the IPV4 address (the IP in your router/whatsmyip.com). You should also see an option to click proxy. All that does is hide your IP address. It only works with web traffic on 80 and 443, so a port number opened or a minecraft server will not work. For HTTPS and me showing how to setup playit.gg earlier, that's not an issue. Click the switch to grey to say "DNS ONLY" for now, and then you can flip it back on after you get past this part but for now keep it to DNS only. The click save. Create another record but instead of root, put www and the other same steps. Those aren't necessary, but like I said, I'd leave them for future use. Use a subdomain for your software you're setting up NGINX for is my reccomendation. Follow the same steps as before for creating a record, but then for the name, put what it's for (ex: Jellyfin). Now, you're good to go for the next step.
To create a configuration, what is this for? Sometimes configurations are different, and not all the same. A config for one thing might not work with another. I've tested the same config for Jellyfin and code server and it works fine. Nextcloud snap I'll try eventually and make a guide for that too if it requires a different config. But how will you write the config?
I wrote a code for an auto config generator for NGINX. If you would like to try it out, head over to https://auto-config.sizablesplash.com/ to download it and check it out. It's in early stages, so some things will change here and there. As of the time of me updating this, the auto-config is on v1.1.0 and can do all the config from here in a snap. It also has Prerequisites for Jellyfin and Nextcloud LEMP stacks. Each software uses a different config, but I found code server works with the same config I made for the proxy. Just be aware if you're trying something else, it might not work. Run this command to install: cd /tmp && wget https://auto-config.sizablesplash.com/older-releases/auto-config_1.1.0_amd64.deb && sudo apt install ./auto-config_1.1.0_amd64.deb Run auto-config to run the script. It will ask you for a couple prompts: make sure you're in root, install certbot & NGINX, ask for presets, domain name, type of config, everything! Everything on this pages you're reading can be done by the auto config. But I'd reccomend you still do a manual config at some point to know how.
Every config though has to start at /etc/nginx/sites-available. To create the config file, run nano /etc/nginx/sites-available/EXAMPLE. The name where the "EXAMPLE" is does not matter to the config, I'd just recommend you name it what its for (ex: /etc/nginx/sites-available/jellyfin). You should see it say "new file". Paste the config from here:
server {
server_name EXAMPLE.DOMAIN.COM;
location / {
proxy_pass http://127.0.0.1:PORT_NUMBER_HERE;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}
But replace the PORT_NUMBER_HERE with the port number you will be using (ex Jellyfin: proxy_pass http://127.0.0.1:8096;) and the EXAMPLE.DOMAIN.COM with your domain name. Then press ctrl + o + enter to save, and ctrl + x to exit. Then run sudo ln -s /etc/nginx/sites-available/EXAMPLE /etc/nginx/sites-enabled/ to link the file in the two directories. Run sudo nginx -t to make sure it was successful. Finally, run sudo certbot --nginx -d example.domain.com replacing the example, of course. Finally run sudo systemctl reload nginx and you should be able to head to your domain name in the browser and you'll see the software you set it to with a padlock by the URL. If the HTTPS part is red, domain doesn't take you to where you wanted to, whatever happens, go back to your config and make sure it looks like this:
server {
server_name EXAMPLE.DOMAIN.COM;
location / {
proxy_pass http://127.0.0.1:PORT_NUMBER_HERE;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/EXAMPLE.DOMAIN.COM/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/EXAMPLE.DOMAIN.COM/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
if ($host = EXAMPLE.DOMAIN.COM) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80;
server_name EXAMPLE.DOMAIN.COM;
return 404; # managed by Certbot
}
Make sure the bottom server config and lines about the ssl certificates are generated. In some of my testing, I found the bottom server config would not generate. This config shouldn't happen to you, but later down in this page I'll talk about if it does.
Let's say you want to create an HTML site in /var/www/html and want your main domain to be that site. To create the site, run nano /var/www/html/index.html and write the code. The file has to be called index.html for it to be the home page for anything. Anyway... to make it HTTPS, edit the default config by nano /etc/nginx/sites-available/default and scroll passed all the lines with a # in them. I should mention, any line starting with a # is notes. It tells the software to ignore it. Scroll until you get to where it says server_name _; and change it. Make it say server_name YOUR_DOMAIN.COM www.YOURDOMAIN.COM; and save and exit. Run sudo systemctl reload nginx and sudo nginx -t to make sure it's working. Then run sudo certbot --nginx -d YOURDOMAIN.com www.YOURDOMAIN.com and you're good to go.
I also have a seperate directory called /var/www/other-sites-than-main/ for... it's in the name. If you want to create an HTTPS link to that, it's similar to the default config and proxy. Follow the same steps as before with some changes. Still create the config file in /etc/nginx/sites-available/ and name it what it's for. Now in the config file, paste this:
server {
server_name _;
root /path/to/whatever/here/;
index index.html;
location / {
autoindex on;
autoindex_exact_size off;
autoindex_localtime on;
try_files $uri $uri/ =404;
}
}
Just replace the underscore with your domain name. Save & exit and then run the command from earlier sudo ln -s /etc/nginx/sites-available/EXAMPLE /etc/nginx/sites-enabled/ just replace the example part. Run sudo nginx -t to check if it works. If it says successful, run sudo systemctl reload nginx and test again. If it fails, edit the config again to take a look. Sometimes it's an issue with the config, sometimes it's an issue with the directory. Earlier I created a config for a directory where it had some spaces in its name. If that's the case, make sure your root line looks like this: root "/path/to/your/directory/with spaces/"; with the quotation marks. The next part is running the domain name. That's the same command from earlier too sudo certbot --nginx -d example.domain.com but replace the example domain. Should all work. Run nano /etc/nginx/sites-available/EXAMPLE to make sure that bottom config generated that I mentioned earlier that I said might not generate is there along with the lines about the SSL cert. If it's there, run sudo systemctl reload nginx and go to the domain in the browser and everything should work fine. I've never encountered where certbot runs successfully and the SSL lines in the config don't generate. I might create a virtual machine for following this guide and troubleshooting. If the bottom config is not there, all you would need to do is copy the bottom config from my earlier example and add your domain to the lines needed. What causes that not to generate is if you have something with the pound sign. It's for notes, but NGINX will see it and see the config as incomplete. In an earlier version of this guide, I had the example config contain a notes line about a port number and that caused conflict. Now, once you fix that and go back to the domain and you see a security risk, that's an issue with your browser. Open an incognito tab and go to the same domain and that shouldn't happen again. It's a thing with your browser's cache.
Any issues with this guide, shoot me an email "[email protected]"
Date created: August 7th, 2026
Last modified: August 28th, 2026