Guides

Nginx Reverse Proxy Configuration: Put Node.js, Python or Java Apps Behind Nginx

By Ravindra Bagale, AWS & DevOps trainer · LinkedIn · Published: 16 October 2026 · Last updated: 17 October 2026

To put an app behind nginx as a reverse proxy, run the app on a private port (for example 127.0.0.1:3000) and add a server block with proxy_pass http://127.0.0.1:3000; plus the Host and X-Forwarded-* headers. Test with sudo nginx -t and reload. On Amazon Linux, RHEL or Rocky, also run sudo setsebool -P httpd_can_network_connect 1, or SELinux blocks nginx and you see 502 Bad Gateway. Add HTTPS with certbot.

server {
    listen 80;
    server_name app.example.com;
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

A live example first

We run a Node.js (Express) API on an Amazon Linux 2023 EC2 instance, on port 3000. Users should reach it at api.example.com on port 80/443, and port 3000 should stay closed in the security group.

1. Check the app:

curl -s 127.0.0.1:3000/health

{"ok":true}

2. Create /etc/nginx/conf.d/api.conf with the quick-answer block (server_name api.example.com).
3. Test and reload:

sudo nginx -t && sudo systemctl reload nginx
curl -I http://api.example.com/health

HTTP/1.1 502 Bad Gateway

4. Read the error log:

sudo tail -n 3 /var/log/nginx/error.log

connect() to 127.0.0.1:3000 failed (13: Permission denied) while connecting to upstream

Permission denied (13) while the app is running means SELinux. Fix:

sudo setsebool -P httpd_can_network_connect 1
curl -I http://api.example.com/health

HTTP/1.1 200 OK

5. Add HTTPS: sudo certbot --nginx -d api.example.com. Friends, the app never touched the internet directly.

How does a reverse proxy work?

nginx accepts the user's connection, handles TLS, then opens its own connection to the app and copies the request across, adding headers so the app knows the real client IP and scheme. The reply comes back the same way. This lets nginx do HTTPS, compression, caching, rate limits and static files, while the app does business logic.

How do I set it up step by step?

1. Make the app listen on 127.0.0.1:PORT (not 0.0.0.0).
2. Create a file in /etc/nginx/conf.d/ (Amazon Linux/RHEL) or /etc/nginx/sites-available/ + symlink (Ubuntu).
3. Add server_name, location / and proxy_pass.
4. Add the four proxy_set_header lines.
5. Run sudo nginx -t.
6. Run sudo systemctl reload nginx.
7. On SELinux systems, set httpd_can_network_connect.
8. Open only 80/443 in the security group; keep the app port closed.
9. Add HTTPS with certbot.

Per-stack examples

Useful extras

# WebSockets (Socket.IO, live dashboards)
location /ws/ {
    proxy_pass http://127.0.0.1:3000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}

# Bigger uploads and slow reports
client_max_body_size 20m;
proxy_read_timeout 120s;

# Two app servers (load balancing)
upstream api_pool { server 10.0.1.10:3000; server 10.0.2.10:3000; }
# then: proxy_pass http://api_pool;

Trailing slash rule: location /api/ { proxy_pass http://127.0.0.1:3000/; } sends /api/users to the app as /users. Without the final / on proxy_pass, the app gets /api/users.

502, 504 and 413 errors

Real example

In February 2017, Cloudflare disclosed "Cloudbleed": a bug in an HTML parser running inside their edge proxy (built on nginx) leaked bits of memory, including some private data, into responses for months. It reminds us that the proxy sees every request and must be kept updated. Run sudo dnf update nginx (or apt) regularly, and keep only the modules you need.

Mistakes to avoid

1. Leaving the app port open in the security group. Only nginx should be public.
2. Turning SELinux off to fix a 502. Set the boolean instead.
3. Forgetting nginx -t before reload.

Summary table