🌐 Apache / Nginx / Caddy Config Generator

🎯 Preset

Choose a curated starting point. Form fields below repopulate when you switch presets.

🏷️ Server identification

🔒 TLS / SSL

↪️ Reverse proxy

🐘 PHP-FPM

📁 Static files

🛡️ Security headers

🗜️ Compression

⚠️ Custom error pages

No custom error pages.

📋 Logging

📤 Generated configuration

{{ currentOutput || '# Configure options on the left to generate.' }}

⚠️ Warnings

  • {{ w }}

📂 Explanation

  • {{ e.section }} — {{ e.meaning }}
⚠️

ℹ️ About Apache / Nginx / Caddy Config Generator

What this generator builds

Three parallel server configurations from a single form: an Apache 2.4 <VirtualHost> block, an nginx server { } block, and a Caddy 2 Caddyfile snippet. Toggle TLS, HSTS, reverse-proxy upstream, PHP-FPM dispatch, static file serving, gzip, security headers, custom error pages, and logging paths, and every change rewrites all three outputs in real time.

The intent is to compare equivalent directives side-by-side (ProxyPass vs. proxy_pass vs. reverse_proxy; SSLEngine on vs. listen 443 ssl vs. Caddy's auto-HTTPS), and to produce a deployable starting point that already wraps headers in the right <IfModule> / location / Caddy block syntax.

Sections this generator can emit

  • TLS termination — Apache SSLEngine on + SSLCertificateFile, nginx listen 443 ssl http2 + ssl_certificate, Caddy tls directive (or automatic Let's Encrypt for public hostnames).
  • HTTP → HTTPS redirect — a second VirtualHost / server block on port 80 issues a permanent 301 to the HTTPS equivalent. Pair with HSTS for downgrade resistance.
  • HSTS — Strict-Transport-Security: max-age=... pins the host to HTTPS for the configured duration (RFC 6797).
  • Reverse proxy — Apache ProxyPass / ProxyPassReverse, nginx proxy_pass, Caddy reverse_proxy. Optional WebSocket upgrade preserves the Upgrade and Connection headers.
  • PHP-FPM via FastCGI — Apache uses mod_proxy_fcgi with a SetHandler "proxy:unix:..." directive; nginx uses fastcgi_pass against a Unix socket or TCP endpoint.
  • Static files + indexes — DirectoryIndex (Apache), index (nginx), file_server (Caddy), with optional expires for browser caching.
  • gzip compression — mod_deflate filter (Apache), gzip on; gzip_types ... (nginx), encode gzip (Caddy).
  • Security headers — Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
  • Server header hiding — Apache Header unset Server, nginx server_tokens off, Caddy -Server.
  • Custom error pages — ErrorDocument (Apache), error_page (nginx), handle_errors (Caddy).
  • Access / error logs — CustomLog + ErrorLog (Apache), access_log + error_log (nginx), Caddy log block.

Common pitfalls

  • HSTS without redirect — declaring Strict-Transport-Security on the HTTPS vhost without also 301-redirecting plain HTTP leaves the first request unprotected. Enable "Redirect HTTP to HTTPS" alongside HSTS.
  • TLS 1.0 / 1.1 — formally deprecated by RFC 8996 (March 2021). Keep only TLSv1.2 and TLSv1.3.
  • Reverse proxy and Host header — without ProxyPreserveHost On (Apache) or proxy_set_header Host $host (nginx) the upstream sees the proxy host, which breaks vhost-based apps (Express, FastAPI, Laravel host detection).
  • WebSocket without Upgrade headers — Apache needs mod_proxy_wstunnel + a RewriteRule on HTTP:Upgrade=websocket; nginx needs proxy_set_header Upgrade $http_upgrade + Connection "upgrade". Caddy handles this automatically.
  • PHP-FPM via TCP vs. Unix socket — Unix sockets are faster on a single host but require correct file permissions. TCP is mandatory when PHP-FPM runs on a separate host or container.

Source references

API Usage Example:

POST /api/tools/linux/web-server-config-generator
Content-Type: application/json

{
    "operation": "generate",
    "serverName": "example.com",
    "ssl": {
        "enabled": true,
        "certPath": "/etc/letsencrypt/live/example.com/fullchain.pem",
        "keyPath": "/etc/letsencrypt/live/example.com/privkey.pem",
        "redirectHttp": true,
        "hsts": true,
        "hstsAge": 31536000,
        "tlsVersions": [
            "TLSv1.2",
            "TLSv1.3"
        ]
    },
    "reverseProxy": {
        "enabled": true,
        "upstreamHost": "127.0.0.1",
        "upstreamPort": 3000,
        "preserveHostHeader": true
    },
    "gzip": true
}
Ready