Cheatsheet: Nginx

Nginx doesn't just use the first match in file order -- it applies a strict precedence: (1) exact match with = (location = /login), (2) longest matching prefix among ^~ blocks (which then skip regex matching entirely), (3) the first matching regex in the order they're written (~ case-sensitive, ~* case-insensitive), and only if nothing above matched, (4) the longest matching plain prefix location. This is why a plain location /api/ can still lose to a regex location ~ .php$ even if the prefix block appears first in the file -- regex blocks are checked before falling back to prefix matching.

location /api/ { proxy_pass http://backend/; } (trailing slash on proxy_pass, with a path) strips the /api/ prefix before forwarding -- a request to /api/users becomes /users upstream. location /api/ { proxy_pass http://backend; } (no trailing slash, no path after the host) forwards the full original URI unchanged -- /api/users stays /api/users upstream. This is a very common source of 404s when migrating a backend behind Nginx; check whether the upstream app expects the prefix stripped or preserved.

nginx -t validates the config syntax without applying it -- always run this before reloading in production. nginx -s reload sends SIGHUP to the master process, which spawns new worker processes with the updated config and gracefully lets old workers finish their in-flight requests before exiting -- no dropped connections, no downtime, unlike a restart. Only use nginx -s stop (or systemctl restart nginx) when you actually need to replace the master binary itself (e.g. after an nginx upgrade).

round-robin (the default, no directive needed) cycles through upstream servers evenly -- fine when requests are roughly equal cost and servers are equally sized. least_conn sends each new request to whichever upstream currently has the fewest active connections -- better when request duration varies a lot (long-running requests won't pile connections onto one server). ip_hash routes each client IP consistently to the same upstream server -- use it when you need session affinity (sticky sessions) without a shared session store, at the cost of uneven load if client IPs aren't evenly distributed.

gzip on; alone only compresses text/html by default -- you almost always also need gzip_types to list the other MIME types you want compressed (application/json, text/css, application/javascript, etc.), since Nginx doesn't guess based on content. Two other common gotchas: gzip_min_length skips compressing responses below its threshold (default 20 bytes, but raise it -- compressing tiny responses wastes CPU for no benefit), and gzip_proxied controls whether proxied responses get compressed at all (it's off by default for some cases, so set gzip_proxied any; if Nginx is a reverse proxy in front of another app).