Nginx as a Reverse Proxy: Complete Configuration Guide

Nginx is one of the most widely used web servers and reverse proxies. It handles load balancing, SSL termination, caching, and request routing with exceptional performance.

Installing Nginx

bash

# Ubuntu / Debian
sudo apt update
sudo apt install nginx
sudo systemctl enable nginx
sudo systemctl start nginx

# Verify
nginx -v
curl http://localhost

Basic Reverse Proxy

Forward requests to a backend application:

nginx

server {
    listen 80;
    server_name myapp.example.com;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

SSL with Let's Encrypt

bash

# Install Certbot
sudo apt install certbot python3-certbot-nginx

# Obtain certificate
sudo certbot --nginx -d myapp.example.com

# Auto-renewal is set up by default; verify with:
sudo certbot renew --dry-run

After Certbot, your config will look like:

nginx

server {
    listen 443 ssl http2;
    server_name myapp.example.com;

    ssl_certificate /etc/letsencrypt/live/myapp.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/myapp.example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

server {
    listen 80;
    server_name myapp.example.com;
    return 301 https://$server_name$request_uri;
}

Load Balancing

Distribute traffic across multiple backend servers:

nginx

upstream backend {
    least_conn;
    server 10.0.1.10:3000;
    server 10.0.1.11:3000;
    server 10.0.1.12:3000;
}

server {
    listen 443 ssl http2;
    server_name myapp.example.com;

    location / {
        proxy_pass http://backend;
    }
}

Load balancing methods:

round-robin (default) — requests rotate through servers
least_conn — send to the server with fewest active connections
ip_hash — sticky sessions based on client IP
hash — custom hash key

Caching

Cache backend responses to reduce load:

nginx

proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=app_cache:10m max_size=1g inactive=60m;

server {
    location / {
        proxy_pass http://backend;
        proxy_cache app_cache;
        proxy_cache_valid 200 10m;
        proxy_cache_valid 404 1m;
        add_header X-Cache-Status $upstream_cache_status;
    }

    location /api/ {
        proxy_pass http://backend;
        proxy_cache off;
    }
}

Rate Limiting

Protect against abuse:

nginx

limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;

server {
    location /api/ {
        limit_req zone=api_limit burst=20 nodelay;
        proxy_pass http://backend;
    }
}

Security Headers

nginx

add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Useful Commands

bash

nginx -t                    # Test configuration
sudo nginx -s reload        # Reload without downtime
sudo tail -f /var/log/nginx/error.log
sudo tail -f /var/log/nginx/access.log

Nginx is the gateway to your application. A well-configured reverse proxy improves performance, security, and reliability.

Nginx as a Reverse Proxy: Complete Configuration Guide

Nginx as a Reverse Proxy: Complete Configuration Guide

Installing Nginx

Basic Reverse Proxy

SSL with Let's Encrypt

Load Balancing

Caching

Rate Limiting

Security Headers

Useful Commands

Tagged with

Enjoyed this article?

Get new posts by email

Related Posts

Monitoring Your Infrastructure with Prometheus and Grafana

Linux Commands Every DevOps Engineer Must Know

Infrastructure as Code with Terraform: From Zero to Production

Discussion