diff --git a/templates/etc/nginx/sites-available/lemmy.j2 b/templates/etc/nginx/sites-available/lemmy.j2
new file mode 100644
index 0000000..8f828ff
--- /dev/null
+++ b/templates/etc/nginx/sites-available/lemmy.j2
@@ -0,0 +1,85 @@
+limit_req_zone $binary_remote_addr zone={{ item.name }}_ratelimit:10m rate=1r/s;
+
+{% extends "core.j2" %}
+
+{% block location %}
+# frontend
+location / {
+  # The default ports:
+  # lemmy_ui_port: 1235
+  # lemmy_port: 8536
+
+  set $proxpass {{ item.upstream_proto }}://{{ item.upstream_name }}:{{ lemmy_ui_port }};
+  if ($http_accept = "application/activity+json") {
+    set $proxpass {{ item.upstream_proto }}://{{ item.upstream_name }}:{{ lemmy_port }};
+  }
+  if ($http_accept = "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"") {
+     set $proxpass {{ item.upstream_proto }}://{{ item.upstream_name }}:{{ lemmy_port }};
+  }
+  if ($request_method = POST) {
+    set $proxpass {{ item.upstream_proto }}://{{ item.upstream_name }}:{{ lemmy_port }};
+  }
+  proxy_pass $proxpass;
+  rewrite ^(.+)/+$ $1 permanent;
+
+  # Send actual client IP upstream
+  proxy_set_header X-Real-IP $remote_addr;
+  proxy_set_header Host $host;
+  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  }
+
+# backend
+location ~ ^/(api|feeds|nodeinfo|.well-known) {
+  proxy_pass {{ item.upstream_proto }}://{{ item.upstream_name }}:{{ lemmy_port }};
+  proxy_http_version 1.1;
+  proxy_set_header Upgrade $http_upgrade;
+  proxy_set_header Connection "upgrade";
+
+  # Rate limit
+  limit_req zone={{ item.name }}_ratelimit burst=30 nodelay;
+
+  # Add IP forwarding headers
+  proxy_set_header X-Real-IP $remote_addr;
+  proxy_set_header Host $host;
+  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  }
+{% if lemmy_pictrs_deploy == true %}
+  # pictrs only - for adding browser cache control.
+  location ~ ^/(pictrs) {
+      # allow browser cache, images never update, we can apply long term cache
+      expires 120d;
+      add_header Pragma "public";
+      add_header Cache-Control "public";
+
+      proxy_pass {{ item.upstream_proto }}://{{ item.upstream_name }}:{{ lemmy_port }};
+      proxy_http_version 1.1;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection "upgrade";
+
+      # Rate limit
+      limit_req zone={{ item.name }}_ratelimit burst=30 nodelay;
+
+      # Add IP forwarding headers
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header Host $host;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+
+  # Redirect pictshare images to pictrs
+  location ~ /pictshare/(.*)$ {
+    return 301 /pictrs/image/$1;
+  }
+{% endif %}
+
+{% endblock %}
+
+# Anonymize IP addresses
+# https://www.supertechcrew.com/anonymizing-logs-nginx-apache/
+map $remote_addr $remote_addr_anon {
+  ~(?P<ip>\d+\.\d+\.\d+)\.    $ip.0;
+  ~(?P<ip>[^:]+:[^:]+):       $ip::;
+  127.0.0.1                   $remote_addr;
+  ::1                         $remote_addr;
+  default                     {{ item.upstream_name }};
+}
+