HowTo: Debian + Nginx web server from scratch

A Debian + Nginx web server, from a fresh system to HTTPS, with copy-paste commands. Tested on Debian 12/13.

1. Update the system

sudo apt update && sudo apt -y full-upgrade
sudo apt -y install curl gnupg ca-certificates

2. Install Nginx

sudo apt -y install nginx
sudo systemctl enable --now nginx
systemctl status nginx --no-pager

3. Firewall (UFW)

sudo apt -y install ufw
sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'   # 80 + 443
sudo ufw --force enable

4. Document root and permissions

sudo mkdir -p /var/www/example.com/public
sudo chown -R www-data:www-data /var/www/example.com
echo '<h1>OK example.com</h1>' | sudo tee /var/www/example.com/public/index.html

5. Server block (site)

sudo tee /etc/nginx/sites-available/example.com >/dev/null <<'EOF'
server {
    listen 80;
    server_name example.com www.example.com;
    root /var/www/example.com/public;
    index index.html;
    location / { try_files $uri $uri/ =404; }
}
EOF

6. Enable the site and test

sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl reload nginx

7. TLS with Let's Encrypt

sudo apt -y install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com --agree-tos -m admin@example.com --redirect
sudo certbot renew --dry-run

8. Verify

curl -I http://example.com
curl -I https://example.com
sudo nginx -T | grep server_name

Quick hardening (headers + gzip)

Two improvements to add right away: gzip compression (smaller pages) and security headers (clickjacking/sniffing protection + forced HTTPS).

# gzip (in http {} din /etc/nginx/nginx.conf)
gzip on;
gzip_types text/plain text/css application/javascript application/json image/svg+xml;

# headere de securitate (in server {})
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

nginx -t && systemctl reload nginx

Conclusion

You now have a working web server with HTTPS and auto-renewal. We secure and monitor it for you.