---
title: "Discussion on \"Deploying web apps with Nginx - web server, reverse proxy and SSL\" | Hashnode"
description: "Discussion on \"Deploying web apps with Nginx - web server, reverse proxy and SSL\". This article covers setting up Nginx web server for SPAs and PWAs, reverse proxy for APIs & SSR apps, and installing a free SSL certificate"
url: "https://hashnode.com/posts/deploying-web-apps-with-nginx-web-server-reverse-proxy-and-ssl/6605e05fe08299018f8dc322"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Deploying web apps with Nginx - web server, reverse proxy and SSL](https://blog.nixque.com/deploying-web-apps-with-nginx-web-server-reverse-proxy-and-ssl?utm_source=hashnode&utm_medium=feed)

This article covers setting up Nginx web server for SPAs and PWAs, reverse proxy for APIs & SSR apps, and installing a free SSL certificate

Mar 28, 2024 · 5 min read · blog.nixque.com  
Read the article

-   [#nginx](https://hashnode.com/tag/nginx)
-   [#spa](https://hashnode.com/tag/spa)
-   [#devops](https://hashnode.com/tag/devops)
-   [#vps-hosting](https://hashnode.com/tag/vps-hosting)
-   [#ssl](https://hashnode.com/tag/ssl)
-   [#nodejs](https://hashnode.com/tag/nodejs)

## Written by

[Fadhili Njagi](https://hashnode.com/@fadhilinjagi)

@fadhilinjagi · Nairobi, Kenya

  
[View profile](https://hashnode.com/@fadhilinjagi)

Computer Scientist | Full stack Web Developer | Data Scientist

I'm a developer from Nairobi, Kenya. I have a BSc in Computer Science and I'm pursuing an MSc in AI. I mostly do full-stack web development. I do pay attention to the finer details, so stay tuned for awesome articles.

## Responses 1

Markdown supported · ⌘↵ to post

[Edge Ops](https://hashnode.com/@edgecacheops)

[Oct 31](https://hashnode.com/posts/deploying-web-apps-with-nginx-web-server-reverse-proxy-and-ssl/6605e05fe08299018f8dc322/comment/6ae57d063e8944eb099d512e)

Solid walkthrough of nginx as web server, reverse proxy, and SSL terminator in one place. The ops footgun after TLS works is usually the forwarded headers, not the cert path: without Host and X-Forwarded-Proto the app still emits absolute http links and mixed-content warnings that look like a browser bug. I terminate once at nginx, pin proxy\_http\_version 1.1 with Connection cleared for upstream keepalive, and keep proxy\_read\_timeout shorter than the client-facing timeout so a hung backend fails closed instead of hanging the edge.

After reload I hit the app listen port on localhost, then through the proxy name, and compare status plus response time. If direct works and the proxy 502s, diff upstream resolution and the trailing-slash on proxy\_pass before blaming SSL. Log $upstream\_addr and $ssl\_protocol together for a week — spikes after renew usually mean the new cert loaded but an old worker still held the previous key briefly.