Production Nginx Architecture: Reverse Proxying, SSL Termination & Edge Caching

Nginx powers more than 30% of the world's highest-traffic web properties. While modern application frameworks (Node.js Fastify, Python FastAPI, Go Fiber) provide built-in HTTP servers, exposing them directly to the public internet introduces severe latency, slow loris vulnerabilities, and operational fragility. Deploying Nginx as an edge reverse proxy provides connection multiplexing, SSL offloading, rate limiting, and intelligent caching.

1. The Reverse Proxy Core: Upstream & Header Propagation

A reverse proxy sits between public clients and your internal application cluster. In order for your backend to identify client IP addresses and enforce HTTPS redirects, Nginx must propagate standard proxy headers:

upstream backend_cluster {
    # Least-connection load balancing across internal nodes
    least_conn;
    server 127.0.0.1:3000 max_fails=3 fail_timeout=10s;
    server 127.0.0.1:3001 max_fails=3 fail_timeout=10s;
    keepalive 32;
}

server {
    listen 80;
    server_name api.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name api.example.com;

    # SSL Certificates
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    location / {
        proxy_pass http://backend_cluster;
        proxy_http_version 1.1;

        # WebSocket support
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Forward real client identifiers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Timeouts to prevent slow loris starvation
        proxy_connect_timeout 5s;
        proxy_send_timeout 15s;
        proxy_read_timeout 15s;
    }
}

2. SSL/TLS Hardening & Modern Cryptography

Deprecating TLS 1.0 and 1.1 is strictly required by modern browser security standards and PCI-DSS audits. Enforce TLS 1.2 and TLS 1.3 with authenticated encryption suites:

• Strict Transport Security (HSTS): Enforce Strict-Transport-Security: max-age=63072000; includeSubDomains; preload to instruct browsers to never downgrade to HTTP.
• OCSP Stapling: Speeds up TLS handshakes by bundling pre-validated revocation status from the certificate authority.
• Session Caching: ssl_session_cache shared:SSL:10m; drastically reduces CPU load by reusing verified handshakes across multiple TCP sessions.

3. Rate Limiting & DDoS Mitigation Zones

Protect your application from brute-force attacks and scraper floods using Nginx's built-in leaky bucket algorithm:

# Define memory zone tracking client IPs (10MB holds ~160,000 IPs)
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;

server {
    # Apply rate limit with burst capacity
    location /api/ {
        limit_req zone=api_limit burst=20 nodelay;
        limit_req_status 429;
        proxy_pass http://backend_cluster;
    }
}

4. Static Asset Caching & Brotli Compression

Static files (compiled JavaScript bundles, CSS stylesheets, SVGs, and web fonts) should bypass backend runtimes completely and be served directly with immutable HTTP headers:

location ~* .(?:css|js|woff2?|svg|png|jpg|webp|avif)$ {
    root /var/www/prowebtools/dist;
    expires 1y;
    add_header Cache-Control "public, max-age=31536000, immutable";
    access_log off;
}

5. Essential Sysadmin & DevOps References

• Nginx Configuration Cheat Sheet - Instant copy-paste snippets for reverse proxies, SSL, and rate limits.
• Linux Sysadmin Commands Matrix - UFW firewall configuration, systemctl, and socket inspection.
• HTTP Status Codes & Server Fixes - Troubleshooting 502 Bad Gateway and 504 Gateway Timeout errors.
• cURL to Python Converter - Test upstream API endpoints using requests and httpx.