Reverse Proxy with Nginx
Put Nginx in front of your app to handle TLS, ports 80/443, and static files.
Your app might listen on port 3000, but users expect ports 80 (HTTP) and 443 (HTTPS). A reverse proxy like Nginx sits in front, accepting public traffic and forwarding it to your app.
Why bother
- TLS termination — Nginx handles HTTPS so your app does not have to.
- Buffering & timeouts — protects a single-threaded app from slow clients.
- Static files & gzip — served fast without touching your app.
- Run multiple apps behind one machine by routing on hostname or path.
Example
# /etc/nginx/conf.d/myapp.conf
server {
listen 80;
server_name www.example.com;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
}
}When to use it
- An Nginx reverse proxy terminates HTTPS on port 443 and forwards plain HTTP to a Node.js app on port 3000 so the app does not need TLS logic.
- A team uses Nginx to serve static files from /public directly, bypassing the app server, which reduces load on the Node.js process.
- An ops engineer uses Nginx's upstream block to load-balance across two local app processes on the same EC2 instance.
More examples
Install Nginx on Amazon Linux
Installs Nginx via the package manager and configures it to start automatically on every boot.
sudo yum install -y nginx
sudo systemctl enable nginx
sudo systemctl start nginxNginx proxy_pass config block
Configures Nginx to forward all HTTP requests from port 80 to the application running on localhost:3000.
# /etc/nginx/conf.d/myapp.conf
server {
listen 80;
server_name example.com;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
}
}Obtain Let's Encrypt cert via Certbot
Uses Certbot to issue a free Let's Encrypt certificate and automatically patch the Nginx config for HTTPS.
# Install certbot and obtain a cert for HTTPS
sudo yum install -y certbot python3-certbot-nginx
sudo certbot --nginx -d example.com --non-interactive \
--agree-tos -m [email protected]
Discussion