Nginx and HAProxy

Configure reverse proxies, upstream blocks, and rate limiting.

8 min readNetworking for EngineersBuild

Nginx as Reverse Proxy

Nginx is the most widely used reverse proxy. It handles TLS termination, request routing, static file serving, and load balancing. Its event-driven architecture handles thousands of concurrent connections efficiently.

Basic Nginx reverse proxy


server {
    listen 443 ssl http2;
    server_name api.example.com;

    ssl_certificate /etc/nginx/cert.pem;
    ssl_certificate_key /etc/nginx/key.pem;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

The proxy_set_header directives pass the original client information to the backend. Without them, the backend sees Nginx as the client. X-Real-IP and X-Forwarded-For let the backend know the real client IP.

Nginx Upstream Configuration

Nginx upstream block


upstream api_backend {
    # Load balancing algorithm
    least_conn;  # or round-robin (default), ip_hash

    # Backend servers
    server 10.0.1.1:8080 weight=3;
    server 10.0.1.2:8080 weight=2;
    server 10.0.1.3:8080 weight=1;

    # Backup server (only used when all primary servers are down)
    server 10.0.1.4:8080 backup;

    # Keepalive connections to backends
    keepalive 32;
}

server {
    listen 80;
    server_name api.example.com;

    location / {
        proxy_pass http://api_backend;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
    }
}

The keepalive directive tells Nginx to maintain a pool of connections to the backend. This avoids the overhead of creating new TCP connections for every request. The Connection header must be cleared for keepalive to work with HTTP/1.1.

HAProxy Backend Configuration

HAProxy configuration


global
    maxconn 50000
    log /dev/log local0

defaults
    mode http
    timeout connect 5s
    timeout client 30s
    timeout server 30s

frontend http_front
    bind *:80
    bind *:443 ssl crt /etc/haproxy/cert.pem
    redirect scheme https code 301 if !{ ssl_fc }

    # Route by path
    acl is_api path_beg /api
    use_backend api_back if is_api
    default_backend web_back

backend api_back
    balance leastconn
    option httpchk GET /health
    http-check expect status 200

    server api1 10.0.1.1:8080 check inter 5s fall 3 rise 2
    server api2 10.0.1.2:8080 check inter 5s fall 3 rise 2

backend web_back
    balance roundrobin
    server web1 10.0.2.1:3000 check
    server web2 10.0.2.2:3000 check

HAProxy is a dedicated load balancer with more advanced features than Nginx. It provides detailed statistics, ACL-based routing, session persistence, and connection management. HAProxy is preferred for pure load balancing workloads.

Rate Limiting

Nginx rate limiting


# Define rate limit zone
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;

server {
    listen 443 ssl;

    location /api/ {
        # Apply rate limit with burst
        limit_req zone=api_limit burst=20 nodelay;

        # Custom error for rate limited requests
        limit_req_status 429;

        proxy_pass http://api_backend;
    }

    location /api/auth/ {
        # Stricter limit for auth endpoints
        limit_req zone=api_limit burst=5 nodelay;
        proxy_pass http://api_backend;
    }
}

rate=10r/s allows 10 requests per second per IP. burst=20 allows a burst of 20 requests above the rate. nodelay processes burst requests immediately instead of queuing them. 429 Too Many Requests is the standard rate limit response.

Nginx vs HAProxy

Feature	Nginx	HAProxy
Primary use	Reverse proxy + web server	Load balancer
Configuration	Declarative (nginx.conf)	Declarative (haproxy.cfg)
Health checks	Basic (commercial Plus)	Advanced (TCP/HTTP/custom)
Stats/monitoring	Stub status (basic)	Built-in stats page
Session persistence	ip_hash, sticky cookie	Cookie, source IP, HDR
ACLs	map, if blocks	Advanced ACL system
Max connections	Depends on worker	Tunable (global maxconn)

Use both together

Nginx excels at TLS termination, static files, and content-based routing. HAProxy excels at pure load balancing with advanced health checks and statistics. A common pattern: Nginx as the L7 entry point, HAProxy as the L4/L7 load balancer behind it.

Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.

Stage 3 · Build

Load Balancing & Traffic Management