Nginx snippets I keep reusing

Three blocks I copy into nearly every nginx setup. The security headers one I have definitely looked up more than ten times, so here it lives now.

Reverse proxy to a local app:

location / {
    proxy_pass http://127.0.0.1:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

Sane gzip defaults (in the http block, once):

gzip on;
gzip_types text/plain text/css application/json
           application/javascript text/xml;
gzip_min_length 1024;

Security headers I'll never memorize:

add_header X-Content-Type-Options nosniff always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Note the always — without it, headers silently disappear on error responses, which is exactly when you stop checking.

← Back to notes