Solid path from a bare EC2 Node process to nginx terminating TLS in front of PM2. Prefer a single upstream (or one proxy_pass) to the PM2 cluster port and let PM2 own worker fan-out — listing every worker port in nginx doubles the failure surface and confuses affinity. Pin proxy_http_version 1.1 with Connection cleared for keepalive into Node, forward Host plus X-Forwarded-For and X-Forwarded-Proto, and raise proxy_read_timeout / proxy_send_timeout above any long request your API actually serves.

Ops check after a deploy or cert renew: open the app on the private listen port, then through the 443 server block, and confirm status and timing match. A brief 502 spike right after pm2 reload usually means nginx still talked to a draining worker; wait for the new cluster accept or tighten max_fails / fail_timeout so a half-dead process leaves the pool quickly. Log $upstream_status next to $request_time so you can tell TLS edge issues from Node crashes.