Nginx Reverse Proxy with Free HTTPS: One Server, Many Apps

A single VPS can host several apps at once — a blog, an API, a dashboard — each on its own domain with HTTPS. The trick is a reverse proxy: Nginx receives all traffic on ports 80 and 443 and forwards each domain to the right app.

Why a reverse proxy

• Apps listen on localhost only (ports like 3000, 8080), never exposed directly.
• One place handles HTTPS certificates for everything.
• Adding an app is a few lines of config.

Install

apt update && apt install -y nginx certbot python3-certbot-nginx

Point your domains

Create an A record for each domain pointing to your server's IPv4 (and an AAAA record for IPv6 if you like).

One config file per app

/etc/nginx/sites-available/blog:

server {
    server_name blog.example.com;
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Repeat with a different server_name and port for each app. Enable them:

ln -s /etc/nginx/sites-available/blog /etc/nginx/sites-enabled/
nginx -t && systemctl reload nginx

Add HTTPS to all of them

certbot --nginx -d blog.example.com -d api.example.com

Certbot edits the configs, redirects HTTP to HTTPS, and installs a timer that renews certificates automatically.

WebSockets

Apps using WebSockets (chat, live dashboards) need two extra lines inside the location block:

proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";

Keep the apps private

Make sure each app binds to 127.0.0.1, not 0.0.0.0. Otherwise it's reachable directly on its port, bypassing Nginx and HTTPS.

Deploy a server and host all your projects on one box.