Serve a static site
Write a server block that listens on port 80 and serves /var/www/site with index.html as the default file. Validate with nginx -t, then reload safely.
Backend & Runtime / Knowledge library
NGINX (nginx)
event-driven reverse proxy and web server
Why learn NGINX (nginx)?
NGINX serves static files quickly and handles high concurrency with low memory use. It is widely used as a reverse proxy to route requests to app servers, terminate TLS, load balance traffic, cache responses, and enforce limits.
Where it came from
Created by Igor Sysoev to solve C10k-style concurrency limits. First public release was in 2004. NGINX, Inc. was founded in 2011 to support commercial adoption. F5 acquired NGINX in 2019.
- Created by Igor Sysoev to solve C10k-style concurrency limits.
- First public release was in 2004.
- NGINX, Inc. was founded in 2011 to support commercial adoption.
- F5 acquired NGINX in 2019.
Build your understanding
Work through these exercises in order. Try the task before opening a reference.
- Write a server block that listens on port 80 and serves /var/www/site with index.html as the default file. Validate with nginx -t, then reload safely.
- Route /api/ traffic to a local Node service on port 3000. Preserve Host and client IP headers. Confirm behavior with curl and access logs.
- Create an upstream with two app servers, proxy / to it, enable rate limiting for bursts, and add security headers for common browser protections.
- Model blue/green upstream pools and switch traffic with minimal downtime using a single config change plus reload.
- Configure short-lived proxy cache for GET responses and bypass cache on Authorization headers. Measure hit ratio from logs.
More ways to practice
Proxy an API service
Route /api/ traffic to a local Node service on port 3000. Preserve Host and client IP headers. Confirm behavior with curl and access logs.
Add load balancing and basic hardening
Create an upstream with two app servers, proxy / to it, enable rate limiting for bursts, and add security headers for common browser protections.
Blue-green cutover drill
Model blue/green upstream pools and switch traffic with minimal downtime using a single config change plus reload.
Cache strategy tuning
Configure short-lived proxy cache for GET responses and bypass cache on Authorization headers. Measure hit ratio from logs.
Documentation and sources
- Official NGINX documentation (nginx.org)
- Beginner’s guide (nginx.org)
- NGINX reverse proxy admin guide (docs.nginx.com)
- HTTP load balancing guide (docs.nginx.com)
Catalog research notes
- Mainline 1.25 added early HTTP/3 (QUIC) support.
- Stable and mainline branches continue regular security and bug-fix releases.
- Recent updates improved TLS behavior, HTTP handling, and module compatibility.
Connect the ideas
Alternatives
Explore next
Real World Example
Unified API Gateway for Distributed Microservices
A growing logistics firm managing a fleet of microservices that handle real-time tracking, inventory updates, and customer notifications.
The business problem
The firm faces inconsistent request handling and security overhead because each microservice independently manages its own SSL termination, authentication, and rate limiting, leading to fragmented security policies and increased maintenance complexity.
How this topic solves it
By deploying NGINX as a centralized reverse proxy, the firm can offload SSL termination, authentication, and request routing to a single entry point. This event-driven architecture ensures that all incoming traffic is validated and routed consistently before reaching internal services, simplifying the security posture and reducing redundant logic in application code.
- Define an upstream block in the NGINX configuration to group the backend microservice instances.
- Configure the server block to listen on port 443 and define SSL certificates for centralized encryption.
- Implement the proxy_pass directive within location blocks to forward traffic to the defined upstream group.
- Apply authentication modules such as ngx_http_auth_request_module to verify user credentials at the gateway level.
- Reload the NGINX configuration to apply the new routing and security rules.
This diagram illustrates how external requests are processed by NGINX before being distributed to internal microservices.
Initiates HTTP/HTTPS requests
Handles SSL, Auth, and Routing
Internal microservice
Internal microservice
- External Client → HTTPS Request → NGINX Proxy
- NGINX Proxy → Proxied Request → Tracking Service
- NGINX Proxy → Proxied Request → Inventory Service
Implementation example
This configuration demonstrates defining an upstream group for load balancing and using proxy_pass to route traffic, which addresses the problem of inconsistent request handling.
upstream backend_services { server 10.0.0.1; server 10.0.0.2; } # Define backend pool
server { listen 443 ssl; # Centralized SSL termination
location / { proxy_pass http://backend_services; # Forwarding traffic } }Expected business outcome
A streamlined infrastructure where security and traffic management are decoupled from application logic, resulting in easier policy updates and uniform request handling across the entire service ecosystem.
Limitations and checks
The primary limitation is that the centralized proxy can become a single point of failure or a bottleneck if not scaled horizontally; administrators should monitor the error logs and use the ngx_http_stub_status_module to track active connections and identify potential saturation.