title: Configured nginx as reverse proxy on ports 80 and 443 for webapp running on 8000. How do I disable connections to port 8000?
body: <p>I configured nginx as a reverse proxy on ports 80 and 443 and had Certbot automatically manage the SSL certificate.</p>
  
  <p>The Golang webapp I have is running on port 8000. Anyone can access the web app through the non-https IP address to the web server with port <code>:8000</code>. </p>
  
  <p>Besides just blocking all traffic to <code>:8000</code>, what's the proper way to disable the port so that the web server is just serving traffic to <code>80</code> and <code>443</code>?</p>
  
  <p><strong>OK, I had my Go app just serve <code>127.0.0.1:8000</code> instead of <code>:8000</code> and now when I navigate to the IP address of my server, I get a <code>404</code> not found page. I don't want the IP address of my server served at all. How do I configure that in nginx?</strong></p>
  
  <p><strong>Also, the nginx docs say to "proxy everything" using <code>@proxy</code>: <a href="https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/#proxy-everything" rel="nofollow noreferrer">https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/#proxy-everything</a> (read about it here). Is my config the correct way to do it?</strong></p>
  
  <p>Here is my nginx config for <code>/etc/nginx/nginx.conf</code>:</p>
  
  <pre><code>user nginx;
  worker_processes auto;
  error_log /var/log/nginx/error.log;
  pid /run/nginx.pid;
  
  # Load dynamic modules. See /usr/share/nginx/README.dynamic.
  include /usr/share/nginx/modules/*.conf;
  
  events {
      worker_connections 20000;
  }
  
  http {
  
      log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                        '$status $body_bytes_sent "$http_referer" '
                        '"$http_user_agent" "$http_x_forwarded_for"';
  
      access_log  /var/log/nginx/access.log  main;
  
      sendfile            on;
      tcp_nopush          on;
      tcp_nodelay         on;
      keepalive_timeout   65;
      types_hash_max_size 2048;
  
      include             /etc/nginx/mime.types;
      default_type        application/json;
  
      # Load modular configuration files from the /etc/nginx/conf.d directory.
      # See http://nginx.org/en/docs/ngx_core_module.html#include
      # for more information.
      include /etc/nginx/conf.d/*.conf;
  
      # Include server blocks.
      include /etc/nginx/sites-enabled/*.conf;
  }
  </code></pre>
  
  <p>Here is the nginx config for <code>/etc/nginx/sites-enabled/default_server.conf</code>:</p>
  
  <pre><code>upstream default_server {
      server 127.0.0.1:8001;
      keepalive 12;
  }
  
  server {
      server_tokens off;
      server_name api.example.com;
  
      client_body_buffer_size     32k;
      client_header_buffer_size   8k;
      large_client_header_buffers 8 64k;
      location / {
          proxy_pass http://127.0.0.1:8001;
     }
  
     location @proxy {
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-NginX-Proxy true;
     }
  
      listen [::]:443 ssl ipv6only=on; # managed by Certbot
      listen 443 ssl; # managed by Certbot
      ssl_certificate /etc/letsencrypt/live/api.example.com/fullchain.pem; # managed by Certbot
      ssl_certificate_key /etc/letsencrypt/live/api.example.com/privkey.pem; # managed by Certbot
      include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
      ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
  
  }
  
  
  
  server {
      if ($host = api.example.com) {
          return 301 https://$host$request_uri;
      } # managed by Certbot
  
  
      listen 80 default_server;
      listen [::]:80 default_server;
      server_name api.example.com;
      return 404; # managed by Certbot
  
  
  }
  </code></pre>