Reverse Proxy Setup

Nginx for raw performance and widespread familiarity. Caddy for automatic HTTPS and simple configuration. Traefik for Kubernetes-native auto-discovery and Let's Encrypt integration. Envoy for advanced traffic management and observability. We pick based on your infrastructure: Traefik or Envoy for Kubernetes, Nginx or Caddy for VM-based deployments. Each has different operational characteristics — we match the tool to your team's expertise.

TLS 1.3 with modern cipher suites, OCSP stapling, and HSTS headers. Automatic certificate provisioning and renewal via Let's Encrypt or your internal CA. Security headers (X-Frame-Options, Content-Security-Policy, X-Content-Type-Options) get configured per application. Request size limits, timeout values, and buffer sizes are tuned to prevent slowloris and request smuggling attacks.

Path-based routing sends /api to backend services, /static to object storage, and / to the frontend. Host-based routing handles multiple domains on a single proxy. Upstream health checks remove failed backends. Load balancing algorithms (round-robin, least-connections, IP-hash) are selected per upstream based on workload characteristics. Weighted routing enables canary deployments.

Proxy-level caching reduces backend load for cacheable responses. Cache keys are configured to avoid over-segmentation. Stale-while-revalidate serves cached content during backend issues. Gzip/Brotli compression reduces response sizes. Connection pooling to backends reduces TCP handshake overhead. The proxy configuration is documented, version-controlled, and tested — not a black box that nobody dares to change.