Deploy a secure Nginx site on Lightsail

1. Verify Nginx locally

Start inside the instance—not AWS CloudShell. Your prompt should include the instance’s private hostname. Check the service and then ask Nginx for its local homepage.

sudo systemctl status nginx --no-pager
curl --head http://127.0.0.1

A healthy server reports active (running) and responds with HTTP/1.1 200 OK.

Useful distinction: If localhost works but the public IP times out, Nginx is fine. Check the Lightsail firewall next.

2. Allow web traffic

In the instance’s Networking tab, allow inbound TCP traffic on port 80 for HTTP and port 443 for HTTPS. Keep SSH on port 22. Don’t expose database ports publicly.

3. Deploy the site files

Lightsail’s current Nginx blueprint serves static files from /usr/share/nginx/html. Take a quick backup of the default page, then copy in your site.

sudo cp -a /usr/share/nginx/html /usr/share/nginx/html.backup
sudo cp -a ./your-site/. /usr/share/nginx/html/
sudo nginx -t
sudo systemctl reload nginx

Always run nginx -t before a reload. A configuration test takes seconds and prevents avoidable downtime.

4. Point the domain at Lightsail

Create an A record for the root domain that points to the instance’s static IPv4 address. Use a CNAME for www that points back to the root domain. DNS changes can take time to propagate.

5. Issue the certificate

Once both domain names resolve to the instance and ports 80 and 443 are open, use Certbot’s Nginx integration to request and configure a Let’s Encrypt certificate.

sudo dnf install -y certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com
sudo certbot renew --dry-run

Before running Certbot: replace the example domains, confirm DNS is correct, and make sure the site loads over ordinary HTTP.

You now have a small, fast publishing foundation. Create a snapshot after the setup is stable, and keep your source files somewhere version-controlled.