DevOps · interactive

Configuring a reverse proxy

nginx sits in front of your app: it terminates TLS, serves static files itself, and forwards the rest to a pool of app servers. Requests are matched to location blocks, with the longest matching prefix winning.

GET https://shop.example.com/api/orders

upstream api {
server 10.0.1.11:8080;
server 10.0.1.12:8080;
}
server {
listen 443 ssl;
server_name shop.example.com;
location /api/ {
proxy_pass http://api;
proxy_set_header X-Forwarded-For $remote_addr;
}
location /ws {
proxy_pass http://api;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
location / {
root /var/www/shop;
try_files $uri /index.html;
}
}

→ api → 10.0.1.11:8080

Longest matching prefix /api/ wins. Forwarded to the upstream pool; the app sees the client's IP in X-Forwarded-For.

Request

Step 1 of 4 · read left to right

1
One entry point
The proxy owns ports 80/443 and the certificate. App servers stay on a private network.
Redirect 80 to 443 here.
2
location blocks route by path
Prefix matches pick the longest; regex locations are checked in order. Be careful with trailing slashes on proxy_pass.
nginx -t && nginx -s reload
3
Pass the right headers
X-Forwarded-For and -Proto tell the app the real client and scheme; WebSockets need Upgrade and Connection.
Set timeouts and body-size limits too.
4
Serve static files directly
nginx sends files faster than your app, with caching headers and compression.
Caddy and Traefik do this with less config.

In production

Tools and technologies

Reverse proxies front almost every web app.

Not tied to one language — use these names when you search docs or design a system.