That's a Basic request, I will answer it in generic as the User did not provide enough Information to be more precise. REMINDER: So, this will answer it in Generally.
Pre-Infromations
User tells that he wants to listen for or to port 5000 for https
Standard http to https Redirect
server {
server_name *.domain.tld domain.tld;
#listen for Port 80
listen 80;
#redirect to https
return 301 https://$host$request_uri;
}
Listen NGINX on port 5000
server {
server_name *.domain.tld domain.tld;
#listen for Port 5000, http
listen 5000;
#add stuff here
}
Standard https Server Directive, using Certbot for Certificate Generation
server {
#listen on 443 for SSL (https) with http 1.0/1.1
#listen 443 ssl;
#Listen on 44 for SSL (https) with http 2
listen 443 ssl http2;
#What we listen for domain
server_name *.domain.tld domain.tld;
location / {
root /var/www/vhosts/domain.tld;
}
ssl_certificate /etc/letsencrypt/live/domain.tld/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/domain.tld/privkey.pem; # managed by Certbot
}
Basic Reverse-Proxy Listen on Port 80 http AND port 443 SSL
server {
#listen on 80 for https with http 1.0/1.1
listen 80;
#listen on 80 for https with http 2 (disabled, certbot does not understand it on port 80)
#listen 80 http2;
#listen on 443 for SSL (https) with http 1.0/1.1
#listen 443 ssl;
#Listen on 44 for SSL (https) with http 2
listen 443 ssl http2;
#What we listen for domain
server_name *.domain.tld domain.tld;
location / {
proxy_pass http://127.0.0.1:5000;
#https even works
#proxy_pass https://127.0.0.1:5000;
proxy_set_header Host $http_host;
}
ssl_certificate /etc/letsencrypt/live/domain.tld/fullchain.pem; # managed by
Certbot
ssl_certificate_key /etc/letsencrypt/live/domain.tld/privkey.pem; # managed by
Certbot
}
Conclusions
If you want to reach your Backend on Port 5000 you have to use proxy_pass
, if you want that NGINX listen on port 5000, in case its not been used listen listen 5000 ssl;
And Also, as others already said, SSL is a Protocol and is not bound to a specific port, its commenly used 443 but it must not listen to it, i also could use 61337 for it.
I'll update the Answer in case the OP is going to update the question