NGHTTPD(1)

📦
version 1.70.0 · 9 versions
, in alpine 3.24, nixpkgs unstable, ubuntu stonking

💖 NGHTTPD(1) — the nghttp2 HTTP/2 server, bestie edition 💖

okay so you found the manual page for nghttpd, aka the HTTP/2 server from the nghttp2 squad. it's the whole manual, and we're gonna read it together like it's a group chat, no skipping, no skimming. every flag, every default, every warning — all of it stays. let's go 💅

✨ NAME ✨

nghttpd — an HTTP/2 server. that's it, that's the name, and she's iconic for it.

🦋 SYNOPSIS 🦋

nghttpd [OPTION]... <PORT> [<PRIVATE_KEY> <CERT>]

🌸 DESCRIPTION 🌸

period. it's an HTTP/2 server, and here's who's who in the cast:

  • <PORT> — the listening port number, babe. that's the number she's gonna be listening on.
  • <PRIVATE_KEY> — the path to the server's private key. this one is required unless you pass --no-tls. no key, no vibes.
  • <CERT> — the path to the server's certificate. also required unless you're out here with --no-tls.

👑 OPTIONS 👑

so many options, and honestly? each one ate.

  • -a, --address=<ADDR> — the address to bind to. if you don't say anything, the default IP address decided by getaddrinfo gets used, and she'll just do her thing.
  • -D, --daemon — run it in the background like the mysterious main character she is. ⚠️ but listen: if -D is used, the current working directory gets changed to /. so if you're gonna use this option, you must also specify the -d option. fr fr, don't skip that.
  • -V, --verify-client — the server sends a client certificate request. if the client didn't send a certificate back, the handshake is terminated, no hesitation. lowkey though: currently this option just requests a client certificate and does not verify it. it's giving "asks for the notes but doesn't check them."
  • -d, --htdocs=<PATH> — specify the document root. if you don't set this, the document root is just the current working directory. casual.
  • -v, --verbose — print debug info, like the reception and transmission of frames and name/value pairs. the receipts, basically. 🍓
  • --no-tls — disable SSL/TLS. no encryption, just vibes (and also this is what makes <PRIVATE_KEY> and <CERT> optional).
  • -c, --header-table-size=<SIZE> — specify the decoder header table size.
  • --encoder-header-table-size=<SIZE> — specify the encoder header table size. so here's the tea: the decoder (that's the client) specifies the maximum dynamic table size it accepts. then the negotiated dynamic table size is the minimum of this option's value and the value the client specified. teamwork, but make it ✨negotiation✨.
  • --color — force colored log output. because plain logs are boring and we don't do boring here. 🌈
  • -p, --push=<PATH>=<PUSH_PATH,...> — push resources <PUSH_PATH>s whenever <PATH> gets requested. you can use this option repeatedly to set up multiple push configurations. <PATH> and <PUSH_PATH>s are relative to the document root — see the --htdocs option. example: -p/=/foo.png -p/doc=/bar.css. proactive queen behavior. 💅
  • -b, --padding=<N> — add at most <N> bytes to a frame payload as padding. specify 0 to disable padding.
  • -m, --max-concurrent-streams=<N> — set the maximum number of concurrent streams in one HTTP/2 session.
    • Default: 100
  • -n, --workers=<N> — set the number of worker threads.
    • Default: 1
  • -e, --error-gzip — make the error response gzipped. even the errors get compressed, she's efficient like that.
  • -w, --window-bits=<N> — sets the stream level initial window size to 2**<N>-1.
  • -W, --connection-window-bits=<N> — sets the connection level initial window size to 2**<N>-1.
  • --dh-param-file=<PATH> — path to a file that contains DH parameters in PEM format. heads up: without this option, DHE cipher suites are not available. so if you want DHE, you gotta bring the file. 🙈
  • --early-response — start sending the response when the request HEADERS is received, rather than waiting for the complete request to arrive. impatient in the best way.
  • --trailer=<HEADER> — add a trailer header to a response. <HEADER> must not include a pseudo header field (a header field name starting with :). the trailer is sent only if the response has a body part. example: --trailer 'foo: bar'.
  • --hexdump — display the incoming traffic in hexadecimal (Canonical hex+ASCII display). if SSL/TLS is used, the decrypted data is what gets used. 👀
  • --echo-upload — send back the uploaded content if the method is POST or PUT. she's just repeating it back to you, respectfully.
  • --mime-types-file=<PATH> — path to a file containing MIME media types and the extensions that represent them.
    • Default: /etc/mime.types
  • --no-content-length — don't send the content-length header field.
  • --groups=<GROUPS> — specify the supported groups.
    • Default: X25519:P-256:P-384:P-521
  • --ktls — enable ktls.
  • --version — display version information and exit.
  • -h, --help — display this help and exit.
quick note before you go: the <SIZE> argument is an integer with an optional unit (like, 10K means 10 * 1024). the units are K, M and G — all powers of 1024. 💜

🔥 SEE ALSO 🔥

the rest of the fam:

💫 Author 💫

Tatsuhiro Tsujikawa — we thank her, we love her, she built this. 🫶

2012, 2015, 2016, Tatsuhiro Tsujikawa

and that's the whole page, bestie — you now know nghttpd better than like 90% of the internet. this was version 1.70.0, dated Jul 29, 2026, straight out of the nghttp2 manual ✨ go run that server, slay, and remember: it's still NGHTTPD(1) at the end of the day. 💖🎀🦋

📦 where this page comes from