Nginx Virtual Hosts

Nginx calls its virtual host configuration "server blocks." Each server block defines how to respond to requests for a specific domain name and port combination. Nginx selects the correct server block by matching the Host header against server_name directives. If no server block matches, Nginx uses the default server — typically the first one loaded alphabetically, or the one marked with default_server.

Server blocks explained

Nginx server block selection:
  Request: GET / HTTP/1.1
           Host: example.com
                ↓
  nginx checks all server_name directives:
    server_name example.com www.example.com → match! use this block
    server_name api.example.com             → no match
    server_name _;   (default_server)       → catch-all fallback

Creating a server block

# Create document root:
sudo mkdir -p /var/www/example.com
sudo chown -R www-data:www-data /var/www/example.com
echo '
example.com works
' | sudo tee /var/www/example.com/index.html

# Create server block config:
sudo nano /etc/nginx/sites-available/example.com

/etc/nginx/sites-available/example.com

server {
    listen 80;
    listen [::]:80;           # IPv6

    server_name example.com www.example.com;
    root /var/www/example.com;
    index index.html index.php;

    access_log /var/log/nginx/example.com-access.log;
    error_log  /var/log/nginx/example.com-error.log;

    location / {
        try_files $uri $uri/ =404;
    }
}

# Enable the site:
sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

# Disable the default site if not needed:
sudo rm /etc/nginx/sites-enabled/default
sudo systemctl reload nginx

HTTPS server block with certbot

# Get free SSL certificate and auto-configure nginx:
sudo apt install -y certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com

# Certbot adds SSL config to your server block and creates an HTTP→HTTPS redirect
# The resulting config looks like:

SSL server block after certbot modification

server {
    listen 443 ssl;
    server_name example.com www.example.com;
    root /var/www/example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
    # ... location blocks ...
}
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;  # Force HTTPS
}

Location blocks

# Location blocks control how Nginx handles specific URL paths:

location / {
    try_files $uri $uri/ /index.php?$args;   # Fallback for SPAs or PHP apps
}

# Serve static files efficiently:
location ~* "\.(jpg|jpeg|png|gif|ico|css|js)$" {
    expires 30d;
    add_header Cache-Control "public, immutable";
}

# Pass PHP requests to PHP-FPM:
location ~ "\.php$" {
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/var/run/php/php8.1-fpm.sock;
}

# Block access to hidden files:
location ~ "/\." {
    deny all;
}

Conclusion

Each site gets a config in sites-available/, enabled with a symlink in sites-enabled/. The key directives: server_name for domain matching, root for the document root, and location blocks for URL-specific handling. Always run nginx -t before reloading — a single syntax error in any config file prevents all sites from reloading. Certbot's --nginx mode is the fastest path to HTTPS and handles certificate renewal automatically.