nginx Reverse Proxy Guide

What a reverse proxy does

• One public entry point. nginx listens on ports 80 and 443 and forwards each domain or path to the right app, so the apps themselves never face the internet.
• HTTPS in one place. nginx handles the certificates; the apps behind it can speak plain HTTP on localhost.
• Several apps on one server. app.example.com, api.example.com and example.com/blog can each go to a different service.
• Extras: compression, caching, upload limits and access rules, without touching the app.

Step 1: Install nginx

sudo apt update
sudo apt install nginx

Open http://your-server-ip and you should see the nginx welcome page. If you use ufw, allow web traffic with sudo ufw allow 'Nginx Full'.

Make sure your app is running and reachable on the server itself, for example with curl http://127.0.0.1:3000. If that fails, nginx will fail too.

Step 2: Create the proxy server block

On Ubuntu, each site gets a file in /etc/nginx/sites-available/, enabled with a link in sites-enabled. Create /etc/nginx/sites-available/app.example.com:

server {
    listen 80;
    server_name app.example.com;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Enable it, test the configuration and reload:

sudo ln -s /etc/nginx/sites-available/app.example.com /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

Point the domain's A record at your server, and http://app.example.com now shows your app. Always run nginx -t before reloading: it catches typos before they take the site down.

The headers, and the trailing slash

• Host passes the domain the visitor asked for. Without it, nginx sends the address from proxy_pass, and apps that build links from the host break.
• X-Real-IP and X-Forwarded-For pass the visitor's IP address. Without them, every request looks like it came from 127.0.0.1.
• X-Forwarded-Proto tells the app whether the visitor used HTTPS, so it does not redirect in a loop.

Ubuntu's nginx package ships these lines in /etc/nginx/proxy_params, so include proxy_params; is a shortcut.

The trailing slash matters. For an app under a path:

location /app/ {
    proxy_pass http://127.0.0.1:3000/;
}

With the slash after the port, /app/login reaches the app as /login. Without it, the app receives the full /app/login.

WebSockets

Chat apps, live dashboards and many admin panels use WebSockets, which need two extra headers. Add this map once, inside the http block, for example in a new file /etc/nginx/conf.d/websocket.conf:

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

Then in the location:

proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_read_timeout 1h;

nginx closes a proxied connection that sends nothing for 60 seconds; the longer proxy_read_timeout keeps quiet WebSockets open. proxy_http_version 1.1 is the default only from nginx 1.29.7, and Ubuntu 24.04 ships 1.24, so keep the line.

Step 3: Free HTTPS with Certbot

sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/local/bin/certbot
sudo certbot --nginx -d app.example.com

Certbot gets a free Let's Encrypt certificate, adds the HTTPS settings to your server block and can redirect HTTP to HTTPS. It renews the certificate automatically; check with sudo certbot renew --dry-run. More on certificates in how to get a free SSL certificate.

Fixing 502, 504 and 413 errors

After every change: sudo nginx -t, then sudo systemctl reload nginx.

Run it on a HytHost VPS

A reverse proxy needs a server where you control ports 80 and 443. HytHost VPS plans run on KVM with full root access, SSD storage and DDoS protection; pick Ubuntu 24.04 and follow the steps above. Running your apps in containers? Set up Docker first with how to install Docker on Ubuntu, and bind the containers' ports to 127.0.0.1 so only nginx can reach them.