nginx as a Reverse Proxy (what it is actually for)

The board draws one upgrade: an app that only answers on its own ugly port becomes one process that answers on a clean address, with the app’s own door shut to the outside world. This lesson is about why that swap buys you far more than a nicer URL.

Before you start. You need to know that a running program listens on a numbered port (One address, a thousand doors), and that a web address is really just a friendlier name for one. If Getting Traffic In (Services & Ingress) already gave you the phrase “load balancer,” keep it in your pocket - this lesson is the same idea shrunk onto a single box.

The idea in 30 seconds

nginx exists because a thread-per-visitor server buckles under connections long before it buckles under work - that wall is the C10K problem Sysoev was fixing at Rambler.
A reverse proxy is a receptionist in front of your app: it takes every visitor first, and only bothers a specialist (a worker) when there is real work to hand over.
Buffering is the receptionist taking the whole answer fast and reading it out to a slow visitor at their own pace, so the specialist is never the one waiting.
Slowloris is a slow visitor turned into a weapon: without a receptionist, a handful of them can pin every specialist and take the site down.
TLS termination is the one badge check at the front door instead of one per specialist.
A timeout is how long anyone in this chain waits before giving up - and there is more than one of them.

Read the story · Skip to the numbers