# Configure Nginx on TurboStack

Selecting Nginx as the web server for a host takes a single setting; TurboStack
generates the per-application configuration from there.

## Where to configure it

The web server is chosen at the **host** level:

1. Open the host.
2. Go to the **Services** tab.
3. Under **Webserver**, select **nginx**.

![The Webserver panel on a host's Services tab, with the web server dropdown open showing nginx and apache2|1000](../../assets/screenshots/platform/hosts/services_webserver-choice.png)

This applies to every application on the host. The per-application vhost (caching
headers, static-asset expiry, security denies and the PHP-FPM backend) is
generated automatically - there is no raw config to write by hand.

## YAML configuration

### Required

| Key | Meaning |
|---|---|
| `webserver` | The host's web server. Set to `nginx` to select Nginx. |

### Optional

Per-application virtual host tuning (caching, static-asset expiry, security denies
and the PHP-FPM backend) is **generated for you** by TurboStack - there are no
extra Nginx keys you need to set.

```yaml
# Host-level: select Nginx as the web server
webserver: nginx
```

> [!TIP]
> Only one web server runs per host. To switch to Apache, change `webserver` to
> `apache2` - see [Configure Apache](../apache/configure.md).

## Custom Nginx configuration

The generated vhost covers most needs, but you can add your own Nginx configuration per system user
in the `~/nginx` directory (over [SSH](../../platform/hosts/ssh.md)). Files load in **alphabetical
order**, so the numeric prefix sets the priority. Two files are present by default:

- `20rewrites.conf` - your redirects and rewrites.
- `50main.conf` - the main server block. A file with a prefix above `50` loads after it; below `50`,
  before it.

When Varnish is enabled it sits in front of Nginx, and the location decides when your rules run:

- Files in `~/nginx/` load **after** Varnish - app-level rewrites, headers and security rules.
- Files in `~/nginx/outside/main/` load **before** Varnish - edge rules and pre-cache allow-lists.

Custom config applies only to that system user's applications. Besides `.conf`, the `.runmaps` (Magento
routing) and `.http` (for example `backend.http`) file types are also supported.

Apply changes with the [TurboStack CLI](../../api/cli.md):

```bash
tscli nginx reload
```

> [!WARNING]
> Editing `50main.conf` needs Nginx knowledge - a mistake can take the site offline. `tscli nginx
> reload` validates the config and points to the error. If you are unsure, [contact
> support](../../platform/support.md) first.

## Common tasks

- [Force HTTPS](force-https.md)
- [Redirect to/from www](redirect-www.md)
- [Block or allow IP addresses](block-ip-addresses.md)
- [Add custom HTTP headers](custom-http-headers.md)
- [Restrict admin access](restrict-admin-access.md)
- [Change the Nginx docroot](change-docroot.md)

## Related

- [What is Nginx?](what-is.md)
- [Host Services tab](../../platform/hosts/services.md)
- [Applications overview](../../applications/index.md)
- [TurboStack CLI](../../api/cli.md) - reload or restart Nginx with `tscli nginx reload`