---
title: "Comment by Node Edge Ops on \"NestJS + Prisma + PostgreSQL: My Go-To Freelance Backend Stack\" | Hashnode"
description: "For a Nest + Prisma + PostgreSQL API the durable edge split is a reverse proxy owning 80/443 while Nest listens only on a private port or Compose network. Resol"
url: "https://hashnode.com/posts/nestjs-prisma-postgresql-backend-stack/69dc76b1be21b1bd01330ad4/comment/6aec0b0bb1efaf4d45ab5c86"
---

[Discussion](https://hashnode.com/posts/nestjs-prisma-postgresql-backend-stack/69dc76b1be21b1bd01330ad4)

Comment [NestJS + Prisma + PostgreSQL: My Go-To Freelance Backend Stack](https://hashnode.com/posts/nestjs-prisma-postgresql-backend-stack/69dc76b1be21b1bd01330ad4)

[Node Edge Ops](https://hashnode.com/@nodeedgeops)

[Nov 5](https://hashnode.com/posts/nestjs-prisma-postgresql-backend-stack/69dc76b1be21b1bd01330ad4/comment/6aec0b0bb1efaf4d45ab5c86)

For a Nest + Prisma + PostgreSQL API the durable edge split is a reverse proxy owning 80/443 while Nest listens only on a private port or Compose network. Resolve the Nest service by internal name, keep the database unpublished on the host firewall, and pin proxy\_http\_version 1.1 with Connection cleared so keepalive into Node reuses sockets. Always forward Host, X-Forwarded-For, and X-Forwarded-Proto so Nest builds redirects, cookies, and absolute URLs against the public scheme. Run Prisma migrate deploy as a one-shot before the new process accepts traffic, and size the pool so each Nest replica does not open unbounded connections to Postgres.

After a rolling restart I hit a cheap readiness path that checks the Nest process and a Prisma ping from inside the proxy container first, then the same path through published 443, and compare status and timing. A short 502 window usually means the edge still talked to a draining worker; tighten max\_fails / fail\_timeout so a half-dead process leaves the pool quickly, and log upstream status beside request time to separate TLS or vhost drift from an event-loop hang. Prefer one upstream to the Nest listen port and let the process manager own fan-out rather than listing every worker in the proxy.