Quick start: a website in 15 minutes

Scenario: a fresh Debian or Ubuntu install, your own domain, and the goal of seeing your page over HTTPS. All commands are run as root over SSH.

1. Install nginx

apt update && apt install -y nginx
systemctl enable --now nginx

Open http://your-address in your browser — you should see a welcome page. If it doesn't appear, check the firewall (step 3).

On AlmaLinux, use dnf instead of apt; see AlmaLinux.

2. Point the domain

In your registrar's panel, add an A record with the machine's address from the “Overview” tab:

example.com.      A     203.0.113.10
www.example.com.  A     203.0.113.10

Check that the domain resolves to the correct address:

apt install -y dnsutils
dig +short example.com

Record updates take from a minute to several hours. While dig returns the old address, you won't be able to issue a certificate.

3. Open the ports

apt install -y ufw
ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

First allow OpenSSH, then enable. The reverse order will cut off your access, and you'll have to log in via the text console.

4. Create a site

mkdir -p /var/www/example.com
echo '<h1>Works</h1>' > /var/www/example.com/index.html
chown -R www-data:www-data /var/www/example.com

Configuration in /etc/nginx/sites-available/example.com:

server {
    listen 80;
    server_name example.com www.example.com;
    root /var/www/example.com;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

Enable and apply:

ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
nginx -t
systemctl reload nginx

nginx -t is mandatory: it checks the config before restart. If the output doesn't end with syntax is ok and test is successful, don't restart the service — fix the error first.

5. Issue a certificate

apt install -y certbot python3-certbot-nginx
certbot --nginx -d example.com -d www.example.com

Certbot will ask for an email, add a listen 443 ssl block, and set up an HTTP redirect. Renewal is set up automatically; you can check it like this:

certbot renew --dry-run

What most often goes wrong

Logs for any of these problems:

tail -n 50 /var/log/nginx/error.log
journalctl -u nginx -n 50 --no-pager

Next, you should take care of basic security using the first-hour checklist if you haven't gone through it yet.