Nginx: proxy_pass, TLS, Upstreams and Rate Limiting Reference Guide

# Install
apt install nginx                      # Debian / Ubuntu
brew install nginx                     # macOS dev
docker run -d -p 80:80 nginx:stable    # one-shot

# Config layout (Debian)
/etc/nginx/nginx.conf                  # main; includes sites-enabled/*
/etc/nginx/sites-available/            # write configs here
/etc/nginx/sites-enabled/              # symlinks to sites-available
/etc/nginx/conf.d/                     # alternative drop-in dir
/var/log/nginx/{access,error}.log      # default logs

# Daily-loop
nginx -t                               # validate config; ALWAYS run before reload
systemctl reload nginx                 # apply config without dropping connections
systemctl restart nginx                # full restart (drops in-flight)
nginx -s reload / -s stop              # if not using systemd
nginx -V                               # version + compile flags + modules

# Tail logs
tail -F /var/log/nginx/{access,error}.log

# /etc/nginx/sites-available/app.conf
server {
    listen      80 default_server;
    listen      [::]:80 default_server;
    server_name api.example.com www.example.com;

    # Redirect HTTP -> HTTPS
    return 301 https://$host$request_uri;
}

server {
    listen              443 ssl http2;
    listen              [::]:443 ssl http2;
    server_name         api.example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options    "nosniff"  always;
    add_header X-Frame-Options           "DENY"     always;

    root /var/www/api;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }

    location /healthz { return 200 "ok\n"; access_log off; }
}

upstream app_backend {
    least_conn;                         # alt: ip_hash, hash $remote_addr consistent
    keepalive 32;
    server 10.0.0.10:8000 max_fails=3 fail_timeout=10s;
    server 10.0.0.11:8000 max_fails=3 fail_timeout=10s;
    server 10.0.0.12:8000 backup;
}

server {
    listen 443 ssl http2;
    server_name api.example.com;

    # ... TLS config ...

    location /api/ {
        proxy_pass            http://app_backend;
        proxy_http_version    1.1;
        proxy_set_header      Host              $host;
        proxy_set_header      X-Real-IP         $remote_addr;
        proxy_set_header      X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header      X-Forwarded-Proto $scheme;
        proxy_set_header      Connection        "";   # required for keepalive

        proxy_connect_timeout 5s;
        proxy_send_timeout    30s;
        proxy_read_timeout    30s;

        proxy_buffering       on;
        client_max_body_size  8m;
    }

    # WebSocket upgrade
    location /ws/ {
        proxy_pass         http://app_backend;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade    $http_upgrade;
        proxy_set_header   Connection "upgrade";
        proxy_read_timeout 1h;
    }
}

# /etc/nginx/conf.d/api.conf — full prod config in one file.
# Rate-limit, gzip, security headers, TLS, proxy with health-checked upstream.

limit_req_zone $binary_remote_addr zone=api_rl:10m rate=20r/s;

upstream api {
    keepalive 32;
    server 10.0.0.10:8000 max_fails=3 fail_timeout=10s;
    server 10.0.0.11:8000 max_fails=3 fail_timeout=10s;
}

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen      80;
    server_name api.example.com;
    return 301  https://$host$request_uri;
}

server {
    listen              443 ssl http2;
    server_name         api.example.com;
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    gzip            on;
    gzip_types      text/plain text/css application/json application/javascript;
    gzip_min_length 1024;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    location /healthz { return 200 "ok\n"; access_log off; }

    location / {
        limit_req zone=api_rl burst=40 nodelay;

        proxy_pass            http://api;
        proxy_http_version    1.1;
        proxy_set_header      Host              $host;
        proxy_set_header      X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header      X-Forwarded-Proto $scheme;
        proxy_set_header      Connection        $connection_upgrade;
        proxy_set_header      Upgrade           $http_upgrade;
        proxy_read_timeout    30s;
        client_max_body_size  8m;
    }
}