IntermediateWeb & Load Balancing

Production NGINX Config: Reverse Proxy, WebSockets & Rate Limiting

This recipe details how to securely expose backend microservices through NGINX, ensuring high performance, WebSocket upgrade handling, and DDoS mitigation via rate limiting.

NGINXLinuxDocker

Prerequisites

Ubuntu 22.04 VM
Valid TLS Certificates
Root access

Configuration Files

nginx.conf/etc/nginx/nginx.conf

limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s;\nserver {\n  listen 443 ssl http2;\n  server_name api.example.com;\n  location / {\n    limit_req zone=mylimit burst=20 nodelay;\n    proxy_pass http://backend;\n    proxy_http_version 1.1;\n    proxy_set_header Upgrade $http_upgrade;\n    proxy_set_header Connection "upgrade";\n  }\n}

Explanation:Defines the rate limit zone and configures the reverse proxy to upgrade HTTP connections to WebSockets.

Verification Steps

Validates NGINX configuration syntax before reloading.

$nginx -t

Expected Outputsyntax is ok\ntest is successful

Production Gotchas

WebSocket connections can silently drop if proxy_read_timeout is lower than the application ping interval.

Frequently Asked Questions

What does nodelay do?

It allows bursts of traffic to be served immediately up to the burst limit, instead of artificially delaying them.