🌙
☀️ Dark
PART 28

Reverse Proxies & HTTPS

Nginx, TLS, load balancing, caching.

Intermediate 45 min read
Volume 28 — Reverse Proxies & HTTPS

Revision Sheet

  • Reverse Proxy: Intermediary between internet and internal servers. Handles SSL, load balancing, caching.
  • Nginx: Event-driven, async web server. Fixes C10k problem.
  • SSL Termination: Decrypting HTTPS at the proxy layer, passing HTTP to backend.
  • X-Forwarded-For: Header used to pass the real client IP to the backend.
  • Load Balancing: Distributing traffic across multiple backend servers using an upstream block.
  • Let's Encrypt / Certbot: Tools to automate free, rotating TLS certificates.

Connections

Now that you understand how to securely expose and scale an application using a reverse proxy, we need to ensure the application itself doesn't crash under load. In the next chapter, we will explore Containerization with Docker, allowing us to rapidly spin up identical instances of our backend so Nginx always has healthy targets to route traffic to.

PreviousVolume 27 🏠 Curriculum NextVolume 29
🏠 Curriculum NextVolume 2

Mini Project (20-30 min)

▶ View Solution

Goal: Set up Nginx to host a static HTML site on the root path, and proxy API requests to a Node backend.

server {
    listen 80;
    server_name dev.local;

    # 1. Serve static files
    location / {
        root /var/www/html/frontend;
        index index.html;
        try_files $uri $uri/ /index.html; # SPA routing fallback
    }

    # 2. Proxy API requests
    location /api/ {
        proxy_pass http://127.0.0.1:3000/;
        proxy_set_header Host $host;
    }
}

Bigger Project (1-2 hours)

Apply all concepts from this volume to build a comprehensive feature.

▶ View Solution
typescript 
// Example project code here

Interview Questions

Easy: What is the difference between a forward proxy and a reverse proxy?

A forward proxy sits in front of clients (e.g., a corporate VPN or school web filter) and intercepts outbound requests to the internet. A reverse proxy sits in front of servers, intercepting inbound requests from the internet and distributing them to the backend.

Medium: Why do we need `proxy_set_header X-Forwarded-For`?

When a reverse proxy forwards a request to the backend, the backend sees the connection coming from the proxy's IP address. `X-Forwarded-For` is a standard header used to pass along the original client's IP address so the backend can log it, rate-limit it, or use it for geolocation.

Hard: How does Nginx solve the C10k problem compared to older Apache?

Older Apache used a thread-per-connection model. 10,000 connections meant 10,000 threads, which consumes massive amounts of RAM (stack size per thread) and causes heavy CPU context switching. Nginx uses an asynchronous, event-driven architecture. A single worker thread handles thousands of connections concurrently using an event loop (via epoll/kqueue), resulting in extremely low memory footprint and high performance.

Senior: Describe the TLS Handshake process and how SSL termination at the reverse proxy impacts backend architecture.

The TLS handshake involves exchanging Hello messages, the server sending its certificate, key exchange (often via Diffie-Hellman), and establishing a symmetric session key. SSL Termination means Nginx handles this entire CPU-intensive cryptographic process and decrypts the traffic. The traffic is then sent unencrypted (HTTP) over the private internal network to the application servers. This offloads CPU work from the application, simplifies cert management to a single location, and allows the proxy to inspect the plaintext traffic to make routing decisions or inject headers.