configuring-nginx

Define an upstream block pointing to your backend (e.g., 127.0.0.1:3000), then use proxy_pass in a location block with headers like Host, X-Real-IP, and X-Forwarded-For. Set proxy_http_version 1.1 and clear the Connection header to enable keepalive connections.

Add listen 443 ssl http2 to your server block, point ssl_certificate and ssl_certificate_key to your certificate files, and set ssl_protocols TLSv1.3 TLSv1.2. Include HSTS headers and OCSP stapling, then redirect port 80 traffic to HTTPS with a 301 return.

nginx supports round robin (default), least_conn for routing to the least busy server, ip_hash for sticky sessions, and weighted distribution via the weight parameter. Health checks use max_fails and fail_timeout, with backup servers for failover.

A 502 error means the backend server is unreachable or not running. Verify the backend responds with curl, check the proxy_pass address, and on RHEL/CentOS enable SELinux network connections with setsebool -P httpd_can_network_connect 1.

Define a limit_req_zone in the http context with a rate like 5r/s, then apply it in a location block using limit_req with burst and nodelay parameters. Combine with limit_conn_zone to cap concurrent connections per client IP.

Choose nginx for performance-critical workloads, high connection counts, and fine-grained control over proxying and caching. Caddy suits simpler setups needing automatic HTTPS, while Traefik fits dynamic container environments with service discovery.