I am a Software Engineer from India. I am currently building Daestro. I work in Rust, Javascript and Python. Zola 2025-09-04T00:00:00+00:00 https://vshukla.com/tags/systemd/atom.xml 2025-09-04T00:00:00+00:00 2025-09-04T00:00:00+00:00 Vivek Shukla https://vshukla.com/snippets/systemd-service-nginx-deployment/

A cheatsheet to deploy Systemd service behind Nginx reverse proxy. This approach is very common and used a lot.

<h2 id="systemd-service"><a class="zola-anchor" href="#systemd-service" aria-label="Anchor link for: systemd-service">🔗</a>Systemd Service</h2> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> tee /etc/systemd/system/YOUR_SERVICE_NAME.service</span><span class="z-keyword z-operator"> &lt;&lt;</span><span> &#39;EOF&#39;</span></span> <span class="giallo-l"><span class="z-string">[Unit]</span></span> <span class="giallo-l"><span class="z-string">Description=YOUR_SERVICE_NAME</span></span> <span class="giallo-l"><span class="z-string">After=network.target</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string">[Service]</span></span> <span class="giallo-l"><span class="z-string">ExecStart=/executable/location</span></span> <span class="giallo-l"><span class="z-string">WorkingDirectory=/dir/where/program/can/read-write/data</span></span> <span class="giallo-l"><span class="z-string">Restart=on-failure</span></span> <span class="giallo-l"><span class="z-string">RestartSec=5s</span></span> <span class="giallo-l"><span class="z-string">StartLimitIntervalSec=300</span></span> <span class="giallo-l"><span class="z-string">StartLimitBurst=5</span></span> <span class="giallo-l"><span class="z-string">User=ubuntu</span></span> <span class="giallo-l"><span class="z-string">Group=ubuntu</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string">[Install]</span></span> <span class="giallo-l"><span class="z-string">WantedBy=multi-user.target</span></span> <span class="giallo-l"><span>EOF</span></span></code></pre> <p>Start command:</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl daemon-reload</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl enable YOUR_SERVICE_NAME</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl start YOUR_SERVICE_NAME</span></span></code></pre> <p>Other commands:</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-comment"># see logs</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> journalctl</span><span class="z-constant z-other"> -u</span><span class="z-string"> YOUR_SERVICE_NAME</span><span class="z-constant z-other"> -f</span></span> <span class="giallo-l"><span class="z-comment"># restart</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl restart YOUR_SERVICE_NAME</span></span> <span class="giallo-l"><span class="z-comment"># when service file is updated</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl daemon-reload</span></span></code></pre><h2 id="nginx-reverse-proxy"><a class="zola-anchor" href="#nginx-reverse-proxy" aria-label="Anchor link for: nginx-reverse-proxy">🔗</a>Nginx Reverse Proxy</h2> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> tee /etc/nginx/sites-available/YOUR_DOMAIN</span><span class="z-keyword z-operator"> &lt;&lt;</span><span> &#39;EOF&#39;</span></span> <span class="giallo-l"><span class="z-string">map $http_upgrade $connection_upgrade {</span></span> <span class="giallo-l"><span class="z-string"> default upgrade;</span></span> <span class="giallo-l"><span class="z-string"> &#39;&#39; close;</span></span> <span class="giallo-l"><span class="z-string">}</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string">upstream server_list {</span></span> <span class="giallo-l"><span class="z-string"> server localhost:8000;</span></span> <span class="giallo-l"><span class="z-string"> keepalive 32;</span></span> <span class="giallo-l"><span class="z-string">}</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string">server {</span></span> <span class="giallo-l"><span class="z-string"> listen 80; # IPv4</span></span> <span class="giallo-l"><span class="z-string"> listen [::]:80; # IPv6</span></span> <span class="giallo-l"><span class="z-string"> server_name YOUR_DOMAIN;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Hide server information headers</span></span> <span class="giallo-l"><span class="z-string"> server_tokens off;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Enable gzip compression</span></span> <span class="giallo-l"><span class="z-string"> gzip on;</span></span> <span class="giallo-l"><span class="z-string"> gzip_disable &quot;msie6&quot;;</span></span> <span class="giallo-l"><span class="z-string"> gzip_vary on;</span></span> <span class="giallo-l"><span class="z-string"> gzip_proxied any;</span></span> <span class="giallo-l"><span class="z-string"> gzip_comp_level 6;</span></span> <span class="giallo-l"><span class="z-string"> gzip_buffers 16 8k;</span></span> <span class="giallo-l"><span class="z-string"> gzip_min_length 1024;</span></span> <span class="giallo-l"><span class="z-string"> gzip_types</span></span> <span class="giallo-l"><span class="z-string"> application/atom+xml</span></span> <span class="giallo-l"><span class="z-string"> application/geo+json</span></span> <span class="giallo-l"><span class="z-string"> application/javascript</span></span> <span class="giallo-l"><span class="z-string"> application/x-javascript</span></span> <span class="giallo-l"><span class="z-string"> application/json</span></span> <span class="giallo-l"><span class="z-string"> application/ld+json</span></span> <span class="giallo-l"><span class="z-string"> application/manifest+json</span></span> <span class="giallo-l"><span class="z-string"> application/rdf+xml</span></span> <span class="giallo-l"><span class="z-string"> application/rss+xml</span></span> <span class="giallo-l"><span class="z-string"> application/xhtml+xml</span></span> <span class="giallo-l"><span class="z-string"> application/xml</span></span> <span class="giallo-l"><span class="z-string"> font/eot</span></span> <span class="giallo-l"><span class="z-string"> font/otf</span></span> <span class="giallo-l"><span class="z-string"> font/ttf</span></span> <span class="giallo-l"><span class="z-string"> image/svg+xml</span></span> <span class="giallo-l"><span class="z-string"> text/css</span></span> <span class="giallo-l"><span class="z-string"> text/javascript</span></span> <span class="giallo-l"><span class="z-string"> text/plain</span></span> <span class="giallo-l"><span class="z-string"> text/xml;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Buffer size optimization</span></span> <span class="giallo-l"><span class="z-string"> client_body_buffer_size 32k;</span></span> <span class="giallo-l"><span class="z-string"> client_header_buffer_size 2k;</span></span> <span class="giallo-l"><span class="z-string"> client_max_body_size 10M;</span></span> <span class="giallo-l"><span class="z-string"> large_client_header_buffers 4 2k;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Timeouts</span></span> <span class="giallo-l"><span class="z-string"> client_body_timeout 20;</span></span> <span class="giallo-l"><span class="z-string"> client_header_timeout 20;</span></span> <span class="giallo-l"><span class="z-string"> keepalive_timeout 65;</span></span> <span class="giallo-l"><span class="z-string"> send_timeout 20;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Proxy settings</span></span> <span class="giallo-l"><span class="z-string"> location / {</span></span> <span class="giallo-l"><span class="z-string"> include proxy_params;</span></span> <span class="giallo-l"><span class="z-string"> proxy_set_header Upgrade $http_upgrade;</span></span> <span class="giallo-l"><span class="z-string"> proxy_set_header Connection $connection_upgrade;</span></span> <span class="giallo-l"><span class="z-string"> proxy_redirect off;</span></span> <span class="giallo-l"><span class="z-string"> proxy_buffering on;</span></span> <span class="giallo-l"><span class="z-string"> proxy_buffer_size 16k;</span></span> <span class="giallo-l"><span class="z-string"> proxy_buffers 8 16k;</span></span> <span class="giallo-l"><span class="z-string"> proxy_pass http://server_list;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Additional proxy timeouts</span></span> <span class="giallo-l"><span class="z-string"> proxy_connect_timeout 60s;</span></span> <span class="giallo-l"><span class="z-string"> proxy_send_timeout 120s;</span></span> <span class="giallo-l"><span class="z-string"> proxy_read_timeout 120s;</span></span> <span class="giallo-l"><span class="z-string"> }</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Security headers</span></span> <span class="giallo-l"><span class="z-string"> add_header X-Content-Type-Options &quot;nosniff&quot; always;</span></span> <span class="giallo-l"><span class="z-string"> add_header Strict-Transport-Security &quot;max-age=31536000; includeSubDomains; preload&quot; always;</span></span> <span class="giallo-l"><span class="z-string">}</span></span> <span class="giallo-l"><span>EOF</span></span></code></pre> <p>Create Symlink</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> ln</span><span class="z-constant z-other"> -s</span><span class="z-string"> /etc/nginx/sites-available/YOUR_DOMAIN /etc/nginx/sites-enabled/</span></span></code></pre> <p>Checks Nginx configuration</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> nginx</span><span class="z-constant z-other"> -t</span></span></code></pre> <p>Restart Nginx</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl restart nginx</span></span></code></pre><h2 id="letsencrypt-ssl"><a class="zola-anchor" href="#letsencrypt-ssl" aria-label="Anchor link for: letsencrypt-ssl">🔗</a>Letsencrypt SSL</h2> <p>Installing <code>certbot</code> to install TLS certificate</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> apt remove certbot</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> snap install core</span><span class="z-punctuation z-terminator">;</span><span class="z-entity z-name"> sudo</span><span class="z-string"> snap refresh core</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> snap install</span><span class="z-constant z-other"> --classic</span><span class="z-string"> certbot</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> ln</span><span class="z-constant z-other"> -s</span><span class="z-string"> /snap/bin/certbot /usr/bin/certbot</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> certbot</span><span class="z-constant z-other"> --nginx -d</span><span class="z-string"> YOUR_DOMAIN</span></span></code></pre>