Skip to content
Nginx Web Server - Performance Tuned product logo
  • AWS· soonComing soon on Amazon Web Services
  • Azure· nextMicrosoft Azure is next on the roadmap
  • GCP· nextGoogle Cloud is next on the roadmap
Coming soon

Nginx Web Server - Performance Tuned

nginx 1.30.4 from the official nginx.org stable repository, tuned for production and verified in effect - worker limits, BBR, gzip, open-file cache, TLS 1.2/1.3 with OCSP stapling, HTTP/2 on for every site - with free Let's Encrypt HTTPS one command away. No PHP, no database, no control panel: a web server and nothing else.

Version
v1.30.4
Operating system
Ubuntu 24.04 LTS
Architecture
x86_64
Support
Community

What's installed

Every package and version on the image. Nothing else is installed.

  • nginx 1.30.4 (nginx.org stable)
  • certbot 2.9.0 with nginx plugin
  • apache2-utils (htpasswd, ab)

Licensing — Open source (BSD-2-Clause), no licence key required

Deploy anywhere

Nginx Web Server - Performance Tuned on AWS.

Microsoft Azure and Google Cloud are next on the roadmap. One clean-room build, one first-boot credential model, one patch cadence — identical on every cloud you run. Every identifier below is the real one; copy it and launch.

  1. AWS

    Amazon Web Services

    AMI · v1.30.4

    Coming soon

    AWS AMI ID

    ami-08eb5818d7beaa629
    Released
    September 15, 2026
    Root volume
    gp3 · 20 GiB

    Instance types

    • t3a.small
    • t3a.medium
    • t3.medium
    • c7a.large

    Regions

    • us-east-1
    AWS launch steps

Getting started

From launch to signed in, step by step.

  1. Launch in us-east-1 with TCP 22, 80 and 443 open; wait about two minutes.

  2. Open http://<instance-public-ip>/ for the welcome page. /healthz returns 200 ok; /nginx_status is protected with username admin and your EC2 Instance ID (for example i-0123456789abcdef0).

  3. SSH as ubuntu with your key pair. Add a site with sudo bash /home/ubuntu/iscripts/add_site.sh (static files or reverse proxy).

  4. Point your domain's A record at the instance, then sudo bash /home/ubuntu/iscripts/setup_ssl.sh - it verifies DNS and the ACME challenge before contacting Let's Encrypt, offers a staging rehearsal, and renewal is automatic.

  5. Include the ready-made snippets from your own sites: /etc/nginx/snippets/security-headers.conf, static-cache.conf, proxy-params.conf. Check with sudo nginx -t, apply with sudo systemctl reload nginx.

Security posture

What this image does and does not ship with, one fact per line.

  • Clean-room build on Canonical's official Ubuntu 24.04 LTS image: every component comes from its own official repository or release, nothing is copied from any third-party image, and the finished image was scanned for third-party vendor strings before capture.

  • No usable credential ships in the image; passwords are set on your instance at first boot from EC2 instance metadata (IMDSv2) and the scripts that set them delete themselves afterwards.

  • SSH is key-only, root login over SSH is refused, and build-time SSH keys, shell history and logs were removed before imaging.

  • The nginx.org repository is pinned at apt priority 900 so a routine upgrade can never swap in Ubuntu's older 1.24 package.

  • The version number is hidden, dotfiles such as .git and .env are refused with 403, and security headers are set on every response including error pages; rate-limit zones are defined and ready to apply.

  • The /nginx_status password is set from the Instance ID at first boot, replacing a 40-character random value generated during cleanup and discarded, so an instance that has not yet provisioned has no guessable credential.

  • TLS is 1.2/1.3 only with session tickets off to preserve forward secrecy.

  • Nothing else listens: no PHP, no database, no admin panel.