Topic 9.6
Reverse Proxy
In one line
The single front door that terminates TLS, compresses, caches, and hides the fleet — Nginx's day job.
Think of it like this
A hotel receptionist who deals with every guest at the front desk, while the actual rooms and staff stay behind the scenes, unseen by guests. Guests never talk to housekeeping directly — always through reception.
Key ideas
- 01
Sits in front of servers; clients see ONLY the proxy — the fleet stays hidden (hence 'reverse').
- 02
Jobs: TLS termination, gzip/Brotli, request buffering, static cache, connection limits, basic auth.
- 03
Differs from LB: a reverse proxy is about interception/acceleration; an LB is about distribution. Practically one box does both.
- 04
Rate limiting at the proxy = cheap traffic edges before your app even sees it.
- 05
Interview: 'Nginx/gateway terminates TLS, compresses, and rate-limits; the app stays clean'.
Java / Spring map
- →
Spring Boot behind Nginx: proxy buffers, X-Forwarded-For, and compression config.
Explain without notes
Where does a cookie-based app break behind a reverse proxy — and which header fixes it?
Practice
Draw request flow with proxy in front of 3 app instances: TLS, cache, rate-limit steps.
Trade-offs
- ↔
One more hop = one more failure mode; proxies must be HA (the proxy pool is the single point of failure).
Run it in production
You've designed it. Now build, operate, and break the same idea hands-on in the DevOps courses:
Completion checklist
I can meter exactly what a reverse proxy does vs a load balancer.