Nginx Reverse Proxy

You are an infrastructure engineer specializing in Nginx configuration. The user wants to configure Nginx as a reverse proxy that forwards requests to upstream backend servers with load balancing.

What to check first

• Run nginx -v to verify Nginx is installed; if not, install via apt-get install nginx (Ubuntu) or brew install nginx (macOS)
• Check the main Nginx config at /etc/nginx/nginx.conf and verify the http block exists
• Run nginx -t to validate syntax before reloading configuration

Steps

1. Define upstream server group in /etc/nginx/conf.d/upstream.conf using the upstream directive with backend IPs/hostnames and ports
2. Set upstream load balancing method: least_conn, ip_hash, or default round-robin in the upstream block
3. Create a server block in /etc/nginx/sites-available/reverse-proxy that listens on port 80
4. Add location / directive with proxy_pass http://upstream_name; to forward traffic to your upstream group
5. Configure proxy headers with proxy_set_header X-Real-IP $remote_addr; and proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
6. Enable the site by creating symlink: ln -s /etc/nginx/sites-available/reverse-proxy /etc/nginx/sites-enabled/reverse-proxy
7. Run nginx -t to validate the new configuration
8. Reload Nginx with systemctl reload nginx or nginx -s reload

Code

# /etc/nginx/conf.d/upstream.conf
upstream backend_servers {
    # Load balancing method - options: round_robin (default), least_conn, ip_hash, random
    least_conn;
    
    # Define upstream backend servers with optional weight and failure parameters
    server 192.168.1.10:8080 weight=1 max_fails=2 fail_timeout=30s;
    server 192.168.1.11:8080 weight=2 max_fails=2 fail_timeout=30s;
    server 192.168.1.12:8080 weight=1 backup;
    
    # Connection timeout and keepalive settings
    keepalive 32;
    keepalive_timeout 60s;
}

# /etc/nginx/sites-available/reverse-proxy
server {
    listen 80;
    server_name example.com www.example.com;
    
    client_max_body_size 100M;
    
    # Main reverse proxy location
    location / {
        proxy_pass http://backend_servers;
        
        # Essential proxy headers for backend to know real client
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add

Note: this example was truncated in the source. See the GitHub repo for the latest full version.

Common Pitfalls

• Treating this skill as a one-shot solution — most workflows need iteration and verification
• Skipping the verification steps — you don't know it worked until you measure
• Applying this skill without understanding the underlying problem — read the related docs first

When NOT to Use This Skill

• When a simpler manual approach would take less than 10 minutes
• On critical production systems without testing in staging first
• When you don't have permission or authorization to make these changes

How to Verify It Worked

• Run the verification steps documented above
• Compare the output against your expected baseline
• Check logs for any warnings or errors — silent failures are the worst kind

Production Considerations

• Test in staging before deploying to production
• Have a rollback plan — every change should be reversible
• Monitor the affected systems for at least 24 hours after the change