Clean split of static files at nginx and API traffic into Node. The ops footgun is one location block doing both keepalive clears and WebSocket Upgrade: clear Connection for HTTP keepalive to the upstream, but on the socket path map Connection from $http_upgrade so the 101 handshake still works. Always forward Host, X-Forwarded-For, and X-Forwarded-Proto so the app builds absolute URLs with the public scheme, and set proxy_http_version 1.1 before you expect either keepalive or Upgrade to stick.

After reload, hit the Node listen port on localhost, then the same path through nginx, and compare status plus response headers. If direct works and the proxy returns 502 or drops the Upgrade, check trailing-slash on proxy_pass and whether proxy_read_timeout is still at sixty seconds while your API or socket heartbeat needs longer. Keep the WebSocket location narrow so normal API routes do not inherit the long timeouts.