Configure Nginx and HTTPS

Create a small document root so we can prove the hostname works before adding the application:

sudo install -d -m 755 /var/www/notes
echo '<h1>Notes server</h1>' | sudo tee /var/www/notes/index.html
sudoedit /etc/nginx/sites-available/notes

Add this server block, replacing the hostname:

server {
  listen 80;
  listen [::]:80;

  server_name notes.example.com;
  root /var/www/notes;
  index index.html;

  location / {
    try_files $uri $uri/ =404;
  }
}

Enable it, validate the complete configuration, and reload gracefully:

sudo ln -s /etc/nginx/sites-available/notes /etc/nginx/sites-enabled/notes
sudo nginx -t
sudo systemctl reload nginx
curl -I http://notes.example.com

nginx -t must succeed before the reload. The HTTP request should reach this server block. If you see the default Nginx page, check server_name, enabled-site links, and the hostname sent by the request.

Add HTTPS only after HTTP works

Install Certbot using the current official Nginx instructions linked in this lesson. Then request and install the certificate:

sudo certbot --nginx -d notes.example.com

Certificate issuance requires the hostname to resolve publicly to this server and the validation path to be reachable. A DNS mismatch, closed port 80, or proxy pointing elsewhere will make the request fail. Fix that layer instead of retrying repeatedly.

Verify the result from outside the Droplet:

curl -I https://notes.example.com
sudo certbot renew --dry-run
systemctl list-timers | grep -i certbot

The HTTPS request should present a trusted certificate for the hostname. The dry run proves the renewal path, not just today’s certificate.

If an Nginx change fails, do not reload it. Repair the file or remove the new enabled-site link, run nginx -t again, and reload only a valid configuration. Keep a copy of the last working server block before later edits.

Your action is to save the successful configuration test, HTTPS response, certificate hostname and expiry, and renewal dry-run result in your operations notes.