Nginx Setup - j-store

Install Nginx

sudo apt install -y nginx
sudo systemctl enable nginx
sudo systemctl start nginx

Verify the version:

  nginx -v
  # nginx version: nginx/1.24.0 (Ubuntu)

Firewall

sudo ufw allow 'Nginx Full'
sudo ufw allow OpenSSH
sudo ufw --force enable

sudo ufw allow 'Nginx Full'

UFW ships with predefined app profiles. 'Nginx Full' opens both port 80 (HTTP) and port 443 (HTTPS). There are also 'Nginx HTTP' (80 only) and 'Nginx HTTPS' (443 only) if you want to be more restrictive — but since SSL gets added later via Certbot, both ports need to be open, so Full is correct here.

sudo ufw allow OpenSSH

Opens port 22 (SSH). This step is critical — if UFW is enabled without explicitly allowing SSH first, you’ll lock yourself out of the VPS the moment the firewall activates, since UFW defaults to denying all incoming connections.

sudo ufw --force enable

Turns the firewall on. By default ufw enable asks for a y/n confirmation (since it could disrupt active SSH sessions) — --force skips that prompt, which is useful for scripting/automation but means you must be 100% sure SSH is already allowed before running it.

Confirm the rules took effect:

  sudo ufw status
  # Expected: 22, 80, and 443 all ALLOW

Default catch-all redirect (HTTP → HTTPS)

Before setting up per-app server blocks, add a catch-all block that handles any request that doesn’t match a known domain (raw IP hits, typo’d hostnames, unmatched Host headers) and forces it onto HTTPS. /etc/nginx/sites-available/default:

################################################
########## redirect all the server #############
################################################

########## use 308 (introduced in 2015) #######

server {
    listen 80 default_server;
    listen [::]:80 default_server;

    server_name _;

    return 308 https://$host$request_uri;
}

default_server

Marks this block as the fallback for port 80 — any request whose Host header doesn’t match a server_name in your other configs lands here instead of silently hitting the first server block in load order. Assigned inline on the listen line itself; no separate config or setup needed.

server_name _;

The underscore is a catch-all placeholder that matches nothing by name — Nginx relies on default_server (not this line) to route unmatched traffic here.

return 308 vs 301

308 preserves the original HTTP method and body on redirect (unlike the older 301, which some clients silently downgrade to GET) — important if a client sends a POST and you don’t want it dropped.

Only one server block per listen port/address can have default_server. If it’s already set elsewhere, remove it there first or nginx -t will fail.

Example reverse proxy config

/etc/nginx/sites-available/j-optic-backend:

server {
    listen 80;
    listen [::]:80;
    server_name api.j-optic.com;

    location / {
        proxy_pass http://localhost:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
    }
}

listen [::]:80; opens the same block on IPv6. If your VPS provider doesn’t route IPv6 to you yet, this line is harmless — but including it now avoids re-editing every site config later if IPv6 gets enabled. Once Certbot adds SSL, it’ll auto-insert listen 443 ssl; but won’t always add the IPv6 line — add listen [::]:443 ssl; manually alongside it.

Enable the sites

sudo ln -s /etc/nginx/sites-available/default /etc/nginx/sites-enabled/
sudo ln -s /etc/nginx/sites-available/j-optic-backend /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

Repeat the per-app block pattern for each app (j-optic, j-store) with a different server_name and proxy_pass port. Only the catch-all default block needs to exist once.

Useful checks

sudo systemctl status nginx --no-pager
sudo nginx -t

​Install Nginx

​Firewall

​Default catch-all redirect (HTTP → HTTPS)

​Example reverse proxy config

​Enable the sites

​Useful checks

Install Nginx

Firewall

Default catch-all redirect (HTTP → HTTPS)

Example reverse proxy config

Enable the sites

Useful checks