Reverse Proxy to App Servers

The Pattern

Nginx listens on 80/443 and forwards to your app (Tomcat on 8080, Node on 3000, PHP-FPM on a socket):

server {
    listen 80;
    server_name app.example.com;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Why the Headers Matter

• Host - the app sees the real domain, not 127.0.0.1.
• X-Real-IP / X-Forwarded-For - let logs and applications know the visitor IP.
• X-Forwarded-Proto - apps learn requests were HTTPS (needed for redirects and secure cookies).

Path-Based Routing

location /api/ { proxy_pass http://127.0.0.1:8080; }   # Tomcat backend
location /static/ { root /var/www; }                    # files direct from nginx

WebSockets

location /ws/ {
    proxy_pass http://127.0.0.1:3000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}

Timeouts for Slow Backends

proxy_connect_timeout 5s;
proxy_read_timeout 60s;
proxy_send_timeout 60s;

Key Points

• proxy_pass forwards; the three X-headers preserve reality for the app.
• Route by location so static files never hit the app server.
• WebSockets need the Upgrade/Connection header juggling above.