Reverse Proxy Server using NGINX on Ubuntu

Nginx is an open source software solution that is highly scalable as a reverse proxy.

Reverse proxy with caching Load balancing with in-band health checks TLS/SSL with SNI and OCSP stapling support, via OpenSSL FastCGI, SCGI, uWSGI, support with caching SMTP, POP3, and IMAP proxy Keep-alive and pipelined connections support Access control based Response rate limiting WebSockets

Load balancing: A reverse proxy server sits in front of your backend servers and distributes client requests across a group of servers in a manner that maximizes speed and capacity utilization while ensuring no one server is overloaded, which can degrade performance. If a server goes down, the load balancer redirects traffic to the remaining online servers.

Web acceleration: Reverse proxies can compress inbound and outbound data, as well as cache commonly requested content, both of which speed up the flow of traffic between clients and servers. They can also perform additional tasks such as SSL encryption to take load off of your web servers, thereby boosting their performance.

Security and anonymity: By intercepting requests headed for your backend servers, a reverse proxy server protects their identities and acts as an additional defense against security attacks. It also ensures that multiple servers can be accessed from a single record locator or URL regardless of the structure of your local area network.

A production NGINX reverse proxy that assesses its own security, explains what it finds, and fixes what is wrong without breaking what is working.

Security assessment. 48 controls in 11 categories - SSH, networking, accounts and authentication, the filesystem, services, privileges, logging, updates, the firewall and NGINX itself. Every finding records what was observed and where it was read from: a file path, a kernel parameter, a systemd property, or the output of a configuration tool. A control the appliance could not evaluate is reported as an error and never counts as a pass. You get a score out of 100 with the arithmetic shown, and stored assessments so you can see what changed.

Remediation that undoes itself. Nothing is changed without being shown first, as a diff of the exact file content. Applying a fix backs up the file, validates the new configuration before it is written, applies it atomically, reloads the service, checks its health and re-runs the original control. A step that fails rolls the change back and is recorded as rolled back, not as completed with a warning. A plan that was never previewed, or previewed against a configuration that has since changed, is refused.

Configuration drift. Records the state of the files that matter, tells you when one changes, shows the diff, and restores from the backup it took at the time. Absent software is reported as not applicable, never as an error.

Firewall that will not strand you. Previews the effect of a rule before applying it, including whether it would cut your own session. Refuses outright to open the management port to 0.0.0.0/0. Arms a timer on risky changes that restores the previous firewall if you do not confirm.

Services, logs and metrics. Service state, health and control, with the units that would lock you out refused. Journal and application logs with passwords, tokens and keys removed before the text reaches your screen. CPU, memory, disk and network charted over 24 hours, plus NGINX's own figures.

Updates on your terms. Finds pending security updates and installs them only when you ask. Never automatically, never adding a package that was not already there, and never rebooting on its own.

Alerting. 12 conditions, including a stopped service, a failing control, low disk, configuration drift, firewall and SSH changes, an expiring TLS certificate and a spike in authentication failures. Delivered by email over SMTP with STARTTLS, working with Microsoft 365 and Google Workspace.

Reports and audit. Security posture, drift and audit reports, generated and downloadable. Three roles - Administrator, Operator, Viewer - enforced on every route rather than hidden in the interface, with every privileged action recorded: who, what, when, from where, and whether it worked.

Disclaimer: This product includes nginx, copyright (c) nginx, inc. and its contributors, licensed under the 2-clause bsd licence. This image is maintained by Cloud Infrastructure Services. nginx is provided "as is", without warranty of any kind, express or implied, and its authors and contributors accept no liability for any damages arising from its use.