Migrating an L7 balancer from another reverse proxy into nginx is mostly about making failover honest. I pin an upstream with max_fails and fail_timeout that match real probe latency, enable proxy_next_upstream only for error/timeout on safe methods, and keep proxy_read_timeout shorter than the client-facing timeout so a hung peer leaves the pool before users see a blank spinner. Round-robin is fine until replica sizes diverge; then least_conn plus equal weight beats ip_hash for NAT-heavy offices.

On the TLS side I terminate once at nginx, push X-Forwarded-Proto and Host downstream, and reload only after nginx -t so a bad cert path never takes the whole edge offline. After cutover I hit each upstream directly, then through the LB, comparing status and upstream response time while I force one peer down — if 502s spike instead of clean failover, fail_timeout is too long or next_upstream is retrying POSTs. Log $upstream_addr and $upstream_status together for a week before trusting the pool in production.