Skip to content
Back to Cloud Services

Nginx Reverse Proxy & TLS

Use nginx as a reverse proxy in front of Node/Python/Go apps: TLS termination, virtual hosts, WebSocket proxying, and rate limiting.

VPS & Self-HostedIntermediate

Why

Nginx as a reverse proxy lets one server host many apps on different subdomains, terminates TLS once (with HTTP/2 and session tickets), buffers slow clients so your app isn't blocked, and can rate-limit and cache. It is the standard front end for self-hosted multi-app setups.

A $5/month VPS (Hetzner, DigitalOcean) outperforms $50/month PaaS for CPU-bound workloads. Self-hosting gives full kernel control and avoids vendor lock-in, but requires sysadmin skills.

When

Use nginx reverse proxy when you run multiple apps on one VPS, need TLS for a custom domain, or want to proxy WebSocket/gRPC. Use Caddy for zero-config auto-TLS; use nginx when you need fine control or have an existing nginx setup.

How

1. Install nginx and certbot (Let's Encrypt). 2. Create a server block per app in /etc/nginx/sites-available/. 3. Set proxy_pass to the app's upstream (e.g., 127.0.0.1:3000). 4. Add proxy_set_header for Host, X-Real-IP, X-Forwarded-For, X-Forwarded-Proto. 5. Enable the site (symlink to sites-enabled) and nginx -t. 6. certbot --nginx -d example.com for auto TLS. ```bash apt install -y nginx certbot python3-certbot-nginx # create site config (see example), then: ln -s /etc/nginx/sites-available/app /etc/nginx/sites-enabled/app nginx -t && systemctl reload nginx certbot --nginx -d app.example.com ```

Example

Reverse-proxy app.example.com to a Node.js app on :3000 with WebSocket support and rate limiting: ```nginx # /etc/nginx/sites-available/app limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s; server { listen 80; server_name app.example.com; location / { limit_req zone=api burst=20 nodelay; proxy_pass http://127.0.0.1:3000; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } ```

Common Problems

  • ⚠502 Bad Gateway — the upstream app is not running or not listening on the proxy_pass port; check the app and that it binds to 0.0.0.0 not 127.0.0.1 if nginx is in a container.
  • ⚠WebSocket fails after proxy — missing proxy_set_header Upgrade/Connection or proxy_http_version 1.1; add the three lines from the example.
  • ⚠certbot fails to validate — port 80 must be open and the server_name must resolve to this host; check DNS and firewall before running certbot.

Best Practices

  • ✓Always set proxy_set_header X-Forwarded-Proto $scheme so the app knows it is behind HTTPS and generates secure cookies/redirects.
  • ✓Use limit_req_zone for rate limiting at nginx (cheap) rather than in the app (expensive) — nginx rejects before the app does work.
  • ✓Run certbot renew --dry-run monthly and add a systemd timer or cron for auto-renewal; certificates expire in 90 days.

FAQ

What is Nginx Reverse Proxy & TLS and what problem does it solve?

Use nginx as a reverse proxy in front of Node/Python/Go apps: TLS termination, virtual hosts, WebSocket proxying, and rate limiting. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with Nginx Reverse Proxy & TLS in 5 minutes?

Two steps to run it: (1) Install nginx and certbot (Let's Encrypt).; (2) Create a server block per app in /etc/nginx/sites-available/.. Validate on the free tier first, then wire into production.

What is the #1 pitfall with Nginx Reverse Proxy & TLS?

The most frequent issue is: 502 Bad Gateway — the upstream app is not running or not listening on the proxy_pass port; check the app and that it binds to 0.0.0.0 not 127.0.0.1 if nginx is in a container.. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for Nginx Reverse Proxy & TLS?

Best practices for Nginx Reverse Proxy & TLS include: Always set proxy_set_header X-Forwarded-Proto $scheme so the app knows it is behind HTTPS and generates secure cookies/redirects.; Use limit_req_zone for rate limiting at nginx (cheap) rather than in the app (expensive) — nginx rejects before the app does work.; Run certbot renew --dry-run monthly and add a systemd timer or cron for auto-renewal; certificates expire in 90 days.. The first one — "Always set proxy_set_header X-Forwarded-Proto $scheme so the app knows it is behind HTTPS and generates secure cookies/redirects." — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with Nginx Reverse Proxy & TLS?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most Nginx Reverse Proxy & TLS options offer a free tier — validate within free quota before scaling.