2023-03-21 · Infrastructure

Set up an Nginx reverse proxy with automatic SSL renewal

One config, cleanly issued certificates, and no 3 a.m. expiry alarms.

Introduction

A step-by-step guide to proxying several apps behind Nginx, issuing certificates with certbot, and renewing them without editing the config by hand.

The mental model

  • Start from the smallest version that could work, and make it observable.
  • Write down the trade-off you are accepting, not only the feature you are shipping.
  • Revisit the decision when the team grows; most choices in Infrastructure have a shelf life.

A practical starting point

  1. Reproduce the situation on a scratch branch, next to a measurement you trust.
  2. Change one variable at a time, and keep the diff small enough to explain in one sentence.
  3. Keep the result, throw away the scaffolding.
Terminal window
git switch -c experiment/one-thing

Closing thoughts

None of this is doctrine. Treat it as a checklist you are allowed to disagree with — ideally with an experiment of your own that settles the argument.