Advanced Reverse Proxy & Load Balancing
Konfigurasi Nginx lanjutan untuk upstream, header, timeout, buffering, WebSocket, rate limit, cache, dan TLS.
Reverse proxy produksi harus menangani koneksi lambat, WebSocket, header keamanan, dan distribusi trafik. Konfigurasi default sering belum cukup.
Konfigurasi dasar yang benar
upstream app_backend {
least_conn;
server 10.10.10.11:3000 max_fails=3 fail_timeout=10s;
server 10.10.10.12:3000 max_fails=3 fail_timeout=10s;
keepalive 32;
}
server {
listen 443 ssl http2;
server_name app.example.com;
ssl_certificate /etc/nginx/ssl/app.crt;
ssl_certificate_key /etc/nginx/ssl/app.key;
location / {
proxy_pass http://app_backend;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Connection "";
}
}Header yang wajib diteruskan
| Header | Fungsi |
|---|---|
Host | Nama domain asli |
X-Real-IP | IP client |
X-Forwarded-For | Rantai proxy |
X-Forwarded-Proto | Skema asli (http/https) |
X-Forwarded-Host | Host asli |
Tanpa header ini, aplikasi bisa salah membuat URL, log IP proxy, atau mengalami redirect loop.
Timeout
proxy_connect_timeout 5s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
send_timeout 60s;Timeout terlalu pendek memutus request valid; terlalu panjang menahan resource saat backend hang.
Buffering
proxy_buffering on;
proxy_buffer_size 16k;
proxy_buffers 8 16k;
proxy_busy_buffers_size 32k;Buffering membantu client lambat. Untuk streaming/Server-Sent Events, matikan buffering:
proxy_buffering off;
proxy_cache off;WebSocket
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
location /ws/ {
proxy_pass http://app_backend;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_read_timeout 3600s;
}Rate limit
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
location /api/ {
limit_req zone=api burst=20 nodelay;
proxy_pass http://app_backend;
}Rate limit melindungi dari brute force dan lonjakan trafik, tetapi bisa memblokir pengguna sah jika terlalu ketat.
Cache statis
location ~* \.(css|js|png|jpg|svg|woff2)$ {
proxy_pass http://app_backend;
expires 7d;
add_header Cache-Control "public, immutable";
}Untuk aset berversi (app.abc123.js), cache panjang aman. Untuk HTML dinamis, hindari cache
agresif.
Kompresi
gzip on;
gzip_types text/plain text/css application/json application/javascript image/svg+xml;
gzip_min_length 1024;TLS modern
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options nosniff always;
add_header X-Frame-Options SAMEORIGIN always;
add_header Referrer-Policy strict-origin-when-cross-origin always;Aktifkan HSTS hanya setelah HTTPS stabil.
Health check upstream
Nginx open source punya passive health check melalui max_fails dan fail_timeout. Untuk active
health check, gunakan Nginx Plus, atau alternatif seperti Traefik/HAProxy.
server 10.10.10.11:3000 max_fails=3 fail_timeout=10s;Nginx Proxy Manager
Di NPM:
- Aktifkan Block Common Exploits.
- Aktifkan Websockets Support bila perlu.
- Atur Advanced untuk header dan timeout.
- Gunakan Custom Locations untuk path tertentu.
- Batasi akses admin port 81.
Troubleshooting proxy
| Gejala | Cek |
|---|---|
| 502 | Backend mati, port/IP salah |
| 504 | Backend lambat/timeout |
| Redirect loop | X-Forwarded-Proto, mode SSL |
| WebSocket gagal | Header Upgrade/Connection |
| Upload gagal | client_max_body_size |
| IP client salah | X-Real-IP/X-Forwarded-For |
client_max_body_size 20m;Praktik: uji konfigurasi
nginx -t
systemctl reload nginx
curl -I https://app.example.com
curl -H "X-Forwarded-Proto: https" http://127.0.0.1:3000Ringkasan
- Upstream, header, timeout, dan buffering menentukan keandalan proxy.
- WebSocket membutuhkan header khusus.
- Rate limit, cache, kompresi, dan TLS meningkatkan kualitas layanan.
- Uji konfigurasi sebelum reload.
Selanjutnya
Atur distribusi trafik di Load Balancing Strategy & Multiple Instances.
Production Troubleshooting
Metode sistematis mendiagnosis masalah produksi: 5xx, latency, resource, database, deployment, dan rollback.
Load Balancing Strategy & Multiple Instances
Menjalankan beberapa instance aplikasi, memilih algoritma load balancing, mengelola session, dan menjaga koneksi database.