coding · Any · free
Write an nginx config that fronts [SERVICE] and does the boring things right. Upstream: [HOST:PORT OR LIST] Public hostname(s): [DOMAINS] TLS: [LET'S ENCRYPT / EXTERNAL / TERMINATED UPSTREAM] Behind: [CLOUDFLARE / AWS ALB / DIRECT] Deliver a single server block plus one http scope block covering: HTTP → HTTPS redirect done at a separate server block (not if in the main one) TLS: modern cipher suite, TLS 1.2+ only, OCSP stapling, HSTS with a sane max age proxy pass with the trailing slash rule chosen deliberately (explain which and why) proxy set header for Host, X Real IP, X Forwarded For (with the real ip module set when behind a CDN) Timeouts: connect / send / read, all explicit — no relying on defaults Buffering off for streaming endpoints; on for the rest gzip + brotli for text types only, threshold set Rate limit zone shared for the /api path Access log format including request id from upstream location = /healthz returning 200 without hitting upstream Version target: nginx 1.24+.
#nginx #devops #reverse-proxy