Nginx Cheatsheet 02 — Reverse Proxy

server {
    listen 80;
    server_name api.example.com;
    
    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

upstream app {
    server 10.0.0.1:8000;
    server 10.0.0.2:8000;
    server 10.0.0.3:8000 backup;
    keepalive 32;
}

server {
    location / {
        proxy_pass http://app;
        proxy_http_version 1.1;
        proxy_set_header Connection "";        # required for keepalive
    }
}

upstream app {
    # default: round-robin
    
    least_conn;                       # least connections
    
    ip_hash;                          # sticky by IP
    
    hash $request_uri consistent;     # consistent hashing
    
    server 10.0.0.1 weight=3;
    server 10.0.0.2 weight=1;
    server 10.0.0.3 max_fails=3 fail_timeout=30s;
}

# /api/users → /users on backend
location /api/ {
    proxy_pass http://app/;            # trailing / strips /api/
}

# /api/users → /api/users on backend
location /api/ {
    proxy_pass http://app;             # no trailing /
}

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Request-ID $request_id;

location /ws/ {
    proxy_pass http://app;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_read_timeout 86400;
    proxy_send_timeout 86400;
}

map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

proxy_buffering on;                    # default
proxy_buffer_size 16k;
proxy_buffers 8 16k;
proxy_busy_buffers_size 32k;

# Disable for SSE / streaming:
location /stream {
    proxy_buffering off;
    proxy_cache off;
    proxy_set_header Connection '';
    proxy_http_version 1.1;
    chunked_transfer_encoding off;
    proxy_pass http://app;
}

proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;

client_body_timeout 60s;
client_header_timeout 60s;
send_timeout 60s;

keepalive_timeout 65;

client_max_body_size 10m;

proxy_redirect http://backend/ https://example.com/;

proxy_next_upstream error timeout http_502 http_503 http_504;
proxy_next_upstream_tries 3;
proxy_next_upstream_timeout 30s;

map $http_x_canary $upstream {
    default app-stable;
    "1"     app-canary;
}

upstream app-stable { server 10.0.0.1; }
upstream app-canary { server 10.0.0.2; }

server {
    location / {
        proxy_pass http://$upstream;
    }
}

upstream app {
    server 10.0.0.1:8000;
    keepalive 64;
    keepalive_requests 1000;
    keepalive_timeout 60s;
}

server {
    location / {
        proxy_pass http://app;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
    }
}

upstream app {
    server backend.example.com:443;
}

location / {
    proxy_pass https://app;
    proxy_ssl_server_name on;
    proxy_ssl_verify off;          # or on with proper certs
    proxy_ssl_session_reuse on;
}

server {
    listen 50051 http2;
    
    location / {
        grpc_pass grpc://backend:50052;
        grpc_set_header X-Real-IP $remote_addr;
    }
}