Nginx API Gateway Proxy Configuration

Why Nginx for API Gateway?

Nginx is the industry-standard reverse proxy and load balancer that powers over 30% of the world's busiest websites. When configured properly, it can handle millions of concurrent connections with minimal resource usage.

Nginx API Gateway Architecture

Basic Nginx Configuration

Here's a production-ready Nginx configuration for API Gateway reverse proxy:

# nginx.conf - Main Configuration
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
    worker_connections 1024;
    multi_accept on;
    use epoll;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    # Log Format
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main;

    # Basic Settings
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    server_tokens off;

    # Gzip Compression
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

    # Include API Gateway Configuration
    include /etc/nginx/conf.d/api-gateway.conf;
}
                

Load Balancing Configuration

Configure Nginx as a load balancer to distribute traffic across multiple API Gateway instances:

# API Gateway Reverse Proxy Configuration
upstream api_gateway_backend {
    # Load Balancing Methods:
    # least_conn;    # Use least connections
    # ip_hash;       # Session persistence
    least_conn;
    
    # Backend Servers
    server 10.0.1.1:8000 weight=3 max_fails=3 fail_timeout=30s;
    server 10.0.1.2:8000 weight=2 max_fails=3 fail_timeout=30s;
    server 10.0.1.3:8000 weight=2 max_fails=3 fail_timeout=30s;
    server 10.0.1.4:8000 backup;  # Backup server
}

server {
    listen 80;
    server_name api-gateway.yourdomain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name api-gateway.yourdomain.com;

    # SSL Configuration
    ssl_certificate /etc/letsencrypt/live/api-gateway.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api-gateway.yourdomain.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    # Security Headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Rate Limiting
    limit_req_zone $binary_remote_addr zone=apilimit:10m rate=100r/s;
    limit_req zone=apilimit burst=200 nodelay;

    # API Gateway Proxy Pass
    location / {
        proxy_pass http://api_gateway_backend;
        
        # Proxy Headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;
        
        # Timeout Settings
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
        proxy_buffering off;
        
        # WebSocket Support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    # Health Check Endpoint
    location /health {
        access_log off;
        proxy_pass http://api_gateway_backend/health;
        proxy_set_header Host $host;
    }

    # Static Assets Caching
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        proxy_pass http://api_gateway_backend;
    }
}
                

Security Hardening

Essential security configurations for production Nginx reverse proxy:

# Security Configuration
server_tokens off;

# Request Size Limits
client_max_body_size 10m;
client_body_buffer_size 128k;
client_header_buffer_size 1k;
large_client_header_buffers 4 4k;

# DDoS Protection
limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;
limit_conn conn_limit_per_ip 100;

limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=100r/s;
limit_req zone=req_limit_per_ip burst=200 nodelay;

# Block Common Attacks
location ~* \.(php|asp|aspx|jsp|pl|py|cgi)$ {
    deny all;
}

# Block Hidden Files
location ~ /\. {
    deny all;
    access_log off;
    log_not_found off;
}

# Block Sensitive Files
location ~* (\.git|\.env|\.svn|\.htaccess|\.htpasswd|config\.php|\.sql)$ {
    deny all;
}

# Rate Limiting by Path
map $request_uri $rate_limit_key {
    default $binary_remote_addr;
    ~^/api/v1/chat $binary_remote_addr;
    ~^/api/v1/completions $binary_remote_addr;
}

limit_req_zone $rate_limit_key zone=chat_api:10m rate=5r/s;
limit_req zone=chat_api burst=10 nodelay;

# SSL/TLS Hardening
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305';
ssl_prefer_server_ciphers on;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_stapling on;
ssl_stapling_verify on;
                

Performance Optimization

Advanced optimizations for maximum throughput and latency reduction:

# Response Caching
proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=api_cache:10m 
                 max_size=1g inactive=60m use_temp_path=off;

location ~* /api/v1/(models|health|status) {
    proxy_cache api_cache;
    proxy_cache_valid 200 302 5m;
    proxy_cache_valid 404 1m;
    proxy_cache_use_stale error timeout updating;
    add_header X-Cache-Status $upstream_cache_status;
}
                        

# Upstream Keepalive
upstream api_backend {
    server 10.0.1.1:8000;
    server 10.0.1.2:8000;
    
    keepalive 32;
    keepalive_timeout 60s;
    keepalive_requests 1000;
}

# Proxy Configuration
proxy_http_version 1.1;
proxy_set_header Connection "";
                        

Monitoring Configuration

# Nginx Status Page
server {
    listen 8080;
    server_name 127.0.0.1;
    
    location /nginx_status {
        stub_status on;
        access_log off;
        allow 127.0.0.1;
        deny all;
    }
}

# Custom Metrics Logging
log_format metrics '$remote_addr - $remote_user [$time_local] '
                   '"$request" $status $body_bytes_sent '
                   '"$http_referer" "$http_user_agent" '
                   'rt=$request_time uct="$upstream_connect_time" '
                   'urt="$upstream_response_time" cs=$upstream_cache_status '
                   'rc=$upstream_bytes_received rs=$upstream_bytes_sent';

# Error Pages
error_page 404 /404.html;
error_page 500 502 503 504 /50x.html;