Nginx

Theory

Nginx is an event-driven, asynchronous web server and reverse proxy. Unlike Apache's thread-per-request model, Nginx uses a non-blocking I/O event loop, allowing it to handle tens of thousands of concurrent connections with low memory footprint.

The configuration hierarchy: nginx.conf includes conf.d/*.conf or sites-enabled/ files. Each server block defines a virtual host — server_name, listen port, and root directory. Requests match server blocks by Host header, then location blocks by URI prefix or regex.

As a reverse proxy, Nginx accepts client connections and forwards them to upstream application servers (Gunicorn, Node, FastAPI). The proxy_pass directive routes requests; proxy_set_header forwards the original Host and client IP so apps can log and auth correctly.

SSL termination at Nginx decrypts HTTPS from clients, forwarding plain HTTP to backend services. ssl_certificate/ssl_certificate_key point to cert and key files. Modern configs add ssl_protocols TLSv1.2 TLSv1.3 and ssl_ciphers to enforce secure cipher suites.

Load balancing is configured via upstream blocks: round-robin (default), least_conn (fewest active connections), ip_hash (sticky sessions by client IP), or weighted. Health checks via proxy_next_upstream retry failed backends automatically.

Nginx serves static files efficiently with sendfile on and open_file_cache to avoid repeated disk I/O. Cache-Control headers set via add_header or expires directive. gzip on with gzip_types compresses text-based responses for faster delivery.

Rate limiting uses limit_req_zone to define a shared memory zone with a key (e.g. $binary_remote_addr) and rate, then limit_req in location blocks to enforce burst limits. This protects upstream apps from traffic spikes and brute-force attacks.

nginx -t validates config syntax before reload. nginx -s reload does a zero-downtime config reload (workers drain existing connections, new workers use new config). This is the standard deployment pattern for config changes.

Architecture Diagram

Clients (HTTPS)
         |
  Nginx (worker processes)
         |
    +----+----+
    v         v
 upstream    static/cache
  app pool

Examples

server {
    listen 80;
    server_name api.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name api.example.com;

    ssl_certificate     /etc/nginx/ssl/cert.pem;
    ssl_certificate_key /etc/nginx/ssl/key.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;

    location / {
        proxy_pass         http://app_upstream;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_read_timeout 60s;
    }

    location /static/ {
        root /var/www;
        expires 1y;
        add_header Cache-Control "public, immutable";
    }
}

upstream app_upstream {
    least_conn;
    server 127.0.0.1:8000 weight=3;
    server 127.0.0.1:8001;
    keepalive 32;
}

http {
    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
    limit_req_zone $binary_remote_addr zone=login_limit:1m  rate=1r/s;

    server {
        location /api/ {
            limit_req zone=api_limit burst=20 nodelay;
            proxy_pass http://app_upstream;
        }

        location /auth/login {
            limit_req zone=login_limit burst=5;
            proxy_pass http://app_upstream;
        }
    }
}

# Test config before applying
nginx -t

# Zero-downtime reload
nginx -s reload

# Check which ports nginx listens on
ss -tlnp | grep nginx

# View access logs with request timing
tail -f /var/log/nginx/access.log | awk '{print $7, $NF}'

# Check worker process count
ps aux | grep 'nginx: worker'

# Debug upstream 502s
cat /var/log/nginx/error.log | grep 'connect() failed'

Interview Questions

Best Practices

• Always run nginx -t to validate config before nginx -s reload — one syntax error kills all workers.
• Version-control nginx.conf and every conf.d/ file; review changes via pull request like application code.
• Use named upstream blocks even for single backends — makes adding load balancing later a one-line change.
• Set proxy_set_header X-Real-IP $remote_addr so application logs capture real client IPs, not 127.0.0.1.
• Use ssl_protocols TLSv1.2 TLSv1.3 and explicitly disable older protocols (SSLv3, TLS 1.0, 1.1).
• Add proxy_read_timeout appropriate for your slowest upstream response — default 60s causes 504s for long-running requests.

Common Mistakes

• Running nginx as root in production — use user www-data; and drop privileges after binding privileged ports.
• Forgetting nginx -t before reload — a single typo in nginx.conf drops all traffic immediately.
• Using try_files $uri $uri/ =404 without understanding the request chain — causes recursive location matching bugs with PHP backends.
• Setting worker_connections without increasing the OS open file limit (ulimit -n) — connections silently fail at OS ceiling.
• Logging to a single large access.log with no rotation — fills disk silently over weeks, crashes nginx when disk is full.

Cheat Sheet

Practical Exercises