Nginx启动报错：server指令不允许在此位置，请求协助排查

核心错误原因 #

你的配置严重违反Nginx语法规则：server指令只能直接放在http（或stream）块下，绝对不能嵌套在location块内部。报错指向的第34行，正是在第一个server块的location /backend/里嵌套了两个server块，这是触发报错的直接原因。

具体问题梳理 #

• 非法嵌套server块：location /backend/内的两个server块完全属于错误位置，必须移除或调整到正确层级。
• 语法括号不匹配：后面几个处理80端口跳转的server块存在括号闭合错误，导致整个配置结构混乱。
• 重复冗余配置：存在3个完全相同的lynx.buspect-app.com 80端口跳转server块，完全没必要。
• 证书配置混乱：多个不同域名的server块共用admin.buspect-app.com的SSL证书，会导致HTTPS访问证书不匹配。

修正后的配置示例 #

http {
    # 提前定义nestjs上游服务（根据实际端口修改）
    upstream nestjs {
        server 127.0.0.1:你的nestjs服务端口;
    }

    # admin.buspect-app.com 80端口跳转HTTPS
    server {
        listen 80;
        server_name admin.buspect-app.com;
        return 301 https://$host$request_uri;
    }

    # admin.buspect-app.com HTTPS主配置
    server {
        listen 443 ssl;
        server_name admin.buspect-app.com;

        ssl_certificate /etc/letsencrypt/live/admin.buspect-app.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/admin.buspect-app.com/privkey.pem;
        include /etc/letsencrypt/options-ssl-nginx.conf;
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

        location / {
            root /var/www/admin;
            index index.html;
            
            proxy_pass http://127.0.0.1:3000/;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $http_host;
            proxy_set_header X-NginX-Proxy true;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_ssl_server_name on;
        }

        location /backend/ {
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header HOST $http_host;
            proxy_pass http://nestjs/; # 注意末尾斜杠，避免路径拼接异常
        }
    }

    # lynx.buspect-app.com 80端口跳转HTTPS
    server {
        listen 80;
        server_name lynx.buspect-app.com;
        return 301 https://$host$request_uri;
    }

    # lynx.buspect-app.com HTTPS主配置
    server {
        listen 443 ssl;
        server_name lynx.buspect-app.com;

        # 使用lynx域名自身的SSL证书，无证书需先申请
        ssl_certificate /etc/letsencrypt/live/lynx.buspect-app.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/lynx.buspect-app.com/privkey.pem;
        include /etc/letsencrypt/options-ssl-nginx.conf;
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

        location / {
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "Upgrade";
            proxy_http_version 1.1;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $host;
            proxy_pass http://localhost:4000;
        }
    }

    # root.buspect-app.com 80端口跳转HTTPS
    server {
        listen 80;
        server_name root.buspect-app.com;
        return 301 https://$host$request_uri;
    }

    # root.buspect-app.com HTTPS主配置
    server {
        listen 443 ssl;
        server_name root.buspect-app.com;

        # 使用root域名自身的SSL证书，无证书需先申请
        ssl_certificate /etc/letsencrypt/live/root.buspect-app.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/root.buspect-app.com/privkey.pem;
        include /etc/letsencrypt/options-ssl-nginx.conf;
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

        location / {
            root /var/www/super-admin;
            index index.html;
            
            proxy_pass http://127.0.0.1:3001/;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $http_host;
            proxy_set_header X-NginX-Proxy true;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_ssl_server_name on;
        }
    }
}

验证与生效步骤 #

1. 检查配置语法：nginx -t，确保输出显示test is successful。
2. 重新加载Nginx：systemctl reload nginx（或service nginx reload，根据系统环境调整）。

关键注意事项 #

• 每个域名的HTTPS配置必须使用对应域名的SSL证书，否则浏览器会提示证书不匹配。
• upstream nestjs需根据实际NestJS服务的端口补充完整，否则proxy_pass http://nestjs会失效。
• 永远不要在location、if等块内部嵌套server，这是Nginx语法的基本禁忌。

内容的提问来源于stack exchange，提问作者johnrambot