3.3Configuring and Managing nginx

nginx is widely used both as a standalone web server and, thanks to its high concurrency, as a reverse proxy in front of multiple application servers. Its directive names look similar to Apache's but often differ in detail—a favorite source of confusable exam questions at L2.

3.3.1Configuration and control

• Configuration files live under /etc/nginx/ (the main file is typically nginx.conf, with per-site configs under conf.d or sites-available, etc.). After editing, apply changes via the nginx command's syntax-check and reload options.
• Enabling HTTPS combines several ssl-related directives: ssl_certificate (certificate), ssl_certificate_key (private key), ssl_protocols (allowed protocols), and ssl_ciphers (allowed cipher suites). These map conceptually to Apache's equivalents but use different directive names—a key distinction to keep straight.

3.3.2Configuration as a reverse proxy

• proxy_pass specifies the backend URL to forward requests to (e.g., proxy_pass http://127.0.0.1:8080;)—the core directive in the typical pattern where nginx receives requests up front and hands off processing to an application server.
• proxy_http_version specifies the HTTP version used to talk to the backend (the default is HTTP/1.0, so it is often explicitly set to 1.1 for things like WebSocket upgrades).
• proxy_set_header adds or rewrites request headers forwarded to the backend—the standard way to pass the client's original Host or IP address through to the backend.

Trace a typical setup: nginx in front, forwarding to a backend application server. In a server block under /etc/nginx/, write listen 443 ssl;, then specify the certificate file with ssl_certificate and the key file with ssl_certificate_key. Coming from Apache, it is tempting to write SSLCertificateFile-style names, but nginx uses underscore-separated, lowercase directives—a trap in both the exam and practice. Further narrow the allowed protocols with something like ssl_protocols TLSv1.2 TLSv1.3; and exclude weak ciphers with ssl_ciphers. Once TLS is terminated, the basic pattern for handing the request to the backend is proxy_pass http://127.0.0.1:8080; inside a location / block. If the backend connection needs HTTP/1.1 features (such as a WebSocket upgrade), set proxy_http_version 1.1; explicitly, since the default HTTP/1.0 cannot support it. In addition, use proxy_set_header to pass the client's original Host and IP through to the backend (e.g., proxy_set_header Host $host;, proxy_set_header X-Real-IP $remote_addr;). Omitting this makes every request look to the backend application as if it came from nginx itself, breaking IP-based logging and access control that depends on the real client address.

3.3.3Section summary

• Config under /etc/nginx/; TLS via ssl_certificate, ssl_certificate_key, ssl_protocols, ssl_ciphers (spelled differently from Apache)
• Reverse proxy: forward with proxy_pass, tune HTTP version with proxy_http_version, propagate client info with proxy_set_header