Clean internship shape: two app services behind one nginx on a shared compose network. The ops habit that prevents most 502 tickets is resolving upstreams by service name, not by published host ports — leave the app ports internal and expose only 80/443 on the proxy. After a backend recreate, a long-lived nginx worker can keep a stale resolved address unless you reload or recreate the proxy, or use a variable-plus-resolver pattern, so treat upstream DNS churn as part of the deploy checklist.

For the proxy_pass blocks I keep trailing-slash rules deliberate (join vs strip path), set Host, X-Forwarded-For, and X-Forwarded-Proto so apps build public redirects correctly, and enable proxy_http_version 1.1 with an empty Connection header when keepalive to the containers matters. After compose up I exec into the nginx container, resolve each upstream name, hit the service port directly, then through the public vhost — mismatches almost always mean network membership or a path-joining typo, not the image tag itself.