What is an Nginx Reverse Proxy and Why is it Necessary?
Nginx (pronounced "Engine-X") is a high-performance, asynchronous event-driven web server and reverse proxy created by Igor Sysoev. In modern web architecture, application runtimes like Node.js (Express, Next.js), Python (FastAPI, Django Gunicorn), Ruby (Puma), and Go HTTP daemons are rarely exposed directly to the public internet on port 80 or 443.
Instead, Nginx sits in front as a Reverse Proxy to handle:
- SSL / TLS Termination: Offloading expensive cryptographic handshakes and managing Let's Encrypt certificates.
- Security & Attack Mitigation: Protecting backend application servers from Slowloris attacks, buffer overflows, and unauthorized direct IP access.
- Gzip Compression & Static Asset Serving: Serving static images, JavaScript, and CSS directly from disk with caching headers without invoking application CPU threads.
Essential Reverse Proxy Headers Explained
When Nginx proxies an incoming HTTP request to an internal application (e.g. localhost:3000), it must pass client connection metadata using proxy headers:
| Nginx Directive | Purpose in Backend Application |
|---|---|
| proxy_set_header Host $host; | Preserves the original domain name requested by the client (essential for multi-tenant apps). |
| proxy_set_header X-Real-IP $remote_addr; | Forwards the client's actual public IP address for rate-limiting and audit logging. |
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | Maintains the complete chain of client and intermediate proxy IP addresses. |
| proxy_set_header X-Forwarded-Proto $scheme; | Informs the backend whether the user connected via http or https. |
How to Issue Free SSL Certificates with Let's Encrypt & Certbot
- Install Certbot:
sudo apt update && sudo apt install certbot python3-certbot-nginx -y - Run Automated SSL Provisioning:
sudo certbot --nginx -d example.com -d www.example.com - Verify Automatic Renewal: Certbot installs a systemd timer that renews certificates automatically before their 90-day expiration. Test renewal with:
sudo certbot renew --dry-run
Frequently Asked Questions (FAQ)
What is the difference between reload and restart in Nginx?
sudo systemctl reload nginx performs a zero-downtime configuration reload: the master process spawns new worker processes with the new configuration while allowing existing workers to complete in-flight requests gracefully. sudo systemctl restart nginx shuts down and restarts the process, dropping active TCP connections.
Why does my upload fail with '413 Request Entity Too Large'?
By default, Nginx limits client request bodies to 1 MB. To allow larger file uploads (e.g. video or PDF uploads), add client_max_body_size 50M; inside the server block.