Day 4 - Nginx and the Reverse Proxy: The Design of an Event-Driven Web Server

📌 Key Takeaways

• Nginx configuration is nested blocks that narrow from the outside in — http (global) → server (virtual host) → location (URL path). Inner blocks inherit from the outer ones and override only what is needed.
• Apache equivalents: listen = Listen, server_name = ServerName, root = DocumentRoot, index = DirectoryIndex.
• A reverse proxy defines a backend group with upstream and forwards to it with proxy_pass. It hides the backends, spreads the load, and handles TLS and caching in one place.
• The processing model is the essential difference — Apache uses a process/thread per connection, while Nginx is event-driven and asynchronous with a few workers. Nginx has no .htaccess and uses central configuration only.
• nginx -t (syntax check) → nginx -s reload (zero-downtime reapply). Concurrent connections are worker_processes × worker_connections, but bounded by the OS fd limit.

Installing Nginx and Its Directory Structure

# Install
yum install nginx
 
# Daemon control
systemctl start nginx
systemctl enable nginx
 
# Config syntax check (a must before restarting!)
nginx -t
 
# Zero-downtime config reapply (reload without dropping connections)
nginx -s reload
systemctl reload nginx

nginx -s reload is a different kind of thing from an Apache restart. In Nginx, the master process starts new workers with the new configuration, and the old workers finish the requests they are handling and then exit. That is why a zero-downtime reload that does not drop connections is possible even after changing the configuration. This is a big advantage when applying configuration to a live service.

nginx.conf — The Nested Block Structure

• The core of Nginx configuration is the hierarchy of blocks (contexts).

worker_processes auto;            # Number of worker processes (usually the CPU core count)
 
events {
    worker_connections 1024;      # Concurrent connections one worker handles
}
 
http {
    include       mime.types;     # MIME type definitions
    default_type  application/octet-stream;
    sendfile      on;             # Kernel-level file transfer (more efficient)
    keepalive_timeout 65;
 
    access_log /var/log/nginx/access.log;
 
    server {
        listen 80;                # Listening port
        server_name www.example.com;   # Virtual host name
        root /usr/share/nginx/html;    # Document root (Apache's DocumentRoot)
        index index.html;              # Default document
 
        location / {
            try_files $uri $uri/ =404;
        }
 
        location /images/ {       # Matches only requests starting with /images/
            root /data;           # → serves files from /data/images/
        }
    }
}

worker_processes auto starts as many workers as there are CPU cores, and each worker handles worker_connections connections asynchronously. In theory the number of concurrently handled connections is roughly worker_processes × worker_connections. Compared with Apache (prefork) using one process per connection, Nginx handles tens of thousands of connections with a few workers — this is why Nginx is strong at static content and concurrent connections.

⚠️ Trap: If server_name matches none of several server blocks or is empty, Nginx uses the first server block on that port or the block marked default_server as the default. Also, location matching has a priority order — rules apply in the order exact match (=), prefix match, then regex (~), and mixing this up makes the wrong location handle the request.

Reverse Proxy — Nginx's Signature Use

• Reverse proxy: an intermediary that receives client requests, forwards them to application servers (backends) behind it, and returns their responses.
• This is the most widely used purpose of Nginx.

http {
    upstream backend {            # Define the backend server group
        server 127.0.0.1:8080;
        server 127.0.0.1:8081;    # With several machines, load is distributed automatically
    }
 
    server {
        listen 80;
        server_name www.example.com;
 
        location / {
            proxy_pass http://backend;              # Forward the request to the backend
            proxy_set_header Host $host;            # Preserve the original Host header
            proxy_set_header X-Real-IP $remote_addr; # Pass the real client IP
        }
    }
}

[Client] → [Nginx :80] → [App server :8080]
           (reverse proxy)   (does the real work)

A forward proxy is an intermediary that goes out on behalf of the client (for example, a proxy that filters internet access from inside a company). A reverse proxy is the opposite: it receives external requests in front of the servers and distributes them internally. The client does not know the backends exist and sees only Nginx. With this structure you hide the backends (security), spread the load across several machines (scaling), and handle TLS termination, caching, and compression in one place.

Nginx (pronounced "engine-x") was created in 2004 by Igor Sysoev to solve the C10K problem — handling 10,000 concurrent connections on one server. At that time, Apache's process/thread model grabbed resources per connection, and memory exploded at 10,000 connections. Nginx, with its event-driven asynchronous architecture, sustained far more connections on the same hardware, and thanks to this efficiency it spread explosively as a static server, reverse proxy, and load balancer. That is the background to why Nginx sits in front of almost every large site today.

Load Balancing Methods

• When you put several servers in an upstream, Nginx splits requests among them. You can specify the distribution method.

upstream backend {
    # Default: round robin (alternating in order)
    server 10.0.0.1;
    server 10.0.0.2;
 
    # least_conn;          # To the server with the fewest connections
    # ip_hash;             # The same client always goes to the same server (session persistence)
}

Web Logs and Tuning

• Nginx logs are also two kinds, access and error.

# Access log: requests and status codes
tail -f /var/log/nginx/access.log
 
# Error log
tail -f /var/log/nginx/error.log

• The core directives for performance tuning are as follows.

http {
    sendfile on;              # Kernel sends files directly (fewer copies)
    tcp_nopush on;            # Gather packets before sending (more efficient)
    keepalive_timeout 65;     # How long connections are kept for reuse
    gzip on;                  # Compress responses to reduce transfer volume
 
    worker_rlimit_nofile 65535;   # Limit of file descriptors each worker can open
}

⚠️ Trap: If there are many concurrent connections and connections are being refused, you should not simply raise worker_processes; you must raise worker_connections and the OS's file descriptor limit (worker_rlimit_nofile, ulimit -n) together. If you only grow one side, the other becomes the bottleneck. The concurrent connection limit is worker_processes × worker_connections, and it is bounded by the OS fd limit.

Apache vs Nginx — The Essential Comparison

In practice, a setup that uses the two together is common. Nginx sits at the very front handling static files, TLS, and load balancing, and only dynamic requests are proxied to Apache (or an application server) behind it. It is a compromise that takes both Nginx's asynchronous efficiency and Apache's rich module ecosystem. Also, Nginx has no .htaccess, so per-directory distributed configuration is impossible — this is not a flaw but the result of a design philosophy: managing all configuration centrally means it does not dig through directories on every request, so it is faster.

Try It Yourself — Configuring and Verifying Nginx

# 1. Syntax check
nginx -t
 
# 2. Zero-downtime reapply
nginx -s reload
 
# 3. Check the response
curl -I http://localhost/         # Check the status code
curl http://localhost/
 
# 4. Which server block / server version responds
curl -I http://localhost/ | grep -i server
 
# 5. Watch the log
tail -f /var/log/nginx/access.log

• Reverse proxy test: start a backend (e.g. python3 -m http.server 8080), set proxy_pass http://127.0.0.1:8080;, then connect to Nginx on port 80 and check whether the backend response is relayed.

Tomorrow we tie this week's DNS, DHCP, NTP, Apache, and Nginx together into one comprehensive review and check ourselves with practice questions.

📖 Glossary

• C10K problem : The challenge of handling 10,000 concurrent connections on one server. The reason Nginx was born.
• Event loop : A method in which a small number of workers handle many connections asynchronously by taking turns. It does not start a process per connection.
• worker_processes / worker_connections : The number of workers to start (usually the CPU core count) / the number of concurrent connections one worker can handle.
• http / server / location blocks : HTTP-wide settings / one virtual host / handling rules per URL path.
• try_files : A directive that looks for files in the specified order and, if all are missing, takes a set action (=404, etc.).
• default_server : Marks the default server block that receives requests when no server_name matches.
• location matching priority : Exact match (=) → prefix match → regex (~). If you get it mixed up, the wrong block handles the request.
• Reverse proxy vs forward proxy : Receives external requests in front of the server and distributes them internally / goes out to the outside on behalf of the client.
• upstream : A block that defines the group of backend servers to split load across.
• proxy_set_header : A directive that puts information such as the original Host or the real client IP into headers when passing to the backend.
• ip_hash : A session-persistence method that hashes the client IP and always sends it to the same backend.
• sendfile / gzip : An optimization where the kernel sends files directly to reduce copies / an option that compresses responses to reduce bandwidth.
• Zero-downtime reload : A method that starts new workers with the new config while old workers finish their in-flight requests and exit.
• File descriptor limit : The upper bound on the number of files and sockets a process can open. Raised with worker_rlimit_nofile and ulimit -n.