Configuring Nginx as a Reverse Proxy for Apache

I've found that using Nginx as a reverse proxy in front of Apache is a really effective way to improve performance and add another layer of security to my servers. It’s a common setup, especially when you're running a mix of static and dynamic content, or when you want to offload SSL termination. Here’s how I do it, along with some things I’ve learned along the way.

The Basic Idea

Essentially, Nginx acts as the entry point for all incoming requests. It handles the static files (images, CSS, JavaScript) directly, and forwards the dynamic requests (PHP, Python, etc.) to Apache. Apache then processes the request and sends the response back to Nginx, which delivers it to the client.

Configuration

I usually work with Ubuntu 24.04 and AlmaLinux 9, but the principles are the same across most Linux distributions. First, make sure both Nginx and Apache are installed. I'll assume they are.

Nginx Configuration

This is the core of the setup. I create a new Nginx configuration file (or modify the default one) to define the reverse proxy rules. Let’s say my Apache server is listening on port 8080. Here's an example configuration:

server {
    listen 80;
    server_name example.com www.example.com;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Optional: Serve static files directly from Nginx
    # location /static/ {
    #     alias /var/www/example.com/public/static/;
    # }
}

• listen 80;: Nginx listens on port 80 for HTTP traffic.
• server_name: The domain names this configuration applies to.
• proxy_pass: The address of the Apache server. 127.0.0.1 is localhost.
• proxy_set_header: These lines pass important information about the original request to Apache. The Host header is important for virtual hosting. The X-Real-IP and X-Forwarded-For headers allow Apache to see the client's IP address. X-Forwarded-Proto tells Apache whether the original request was HTTP or HTTPS.

After creating or modifying the configuration file, I reload Nginx:

sudo nginx -t # Test configuration
sudo systemctl reload nginx

Apache Configuration

Apache needs to be configured to listen on the port that Nginx is forwarding traffic to. The exact configuration depends on your Apache setup. For a simple setup, you might need to modify your Apache virtual host file. If you're using a framework like Laravel, make sure your public/index.php is configured correctly to handle requests.

My setup

I always add the proxy_set_header directives I mentioned above. Forgetting proxy_set_header Host $host; is a common mistake, it breaks virtual hosting. I also prefer to serve static assets directly from Nginx whenever possible; it's faster and reduces the load on Apache. I don't bother with complex caching rules in Nginx for small VPSes, keeping things simple usually works best.

What went wrong (gotchas)

• File Permissions: Make sure Nginx has read access to any static files it's serving. Incorrect permissions are a frequent source of errors. I usually set the owner to www-data.
• Apache Listening Port: Double-check that Apache is actually listening on the port you specified in the Nginx configuration. Use netstat -tulnp to verify.
• Firewall: Ensure your firewall allows traffic on port 80 and 443 to Nginx, and allows Nginx to connect to Apache on the internal port (e.g., 8080).
• SELinux: If you're using SELinux, you might need to adjust the SELinux contexts for the files Nginx is serving. This is less common on Ubuntu, but it's something to watch out for on AlmaLinux.
• PHP-FPM Socket Path: If you're using PHP-FPM, make sure Nginx is configured to use the correct socket path. The default path is often /run/php/php8.3-fpm.sock or similar. Check your PHP-FPM configuration (/etc/php/8.3/fpm/pool.d/www.conf).
• DNS TTL: When making changes to your DNS records, remember that DNS propagation can take time. Lowering your DNS TTL (Time To Live) before making changes can speed up the process. I usually set it to 300 seconds (5 minutes) before deployments.

HTTPS

Once you have the basic reverse proxy setup working, you should configure HTTPS. I usually use Let's Encrypt for free SSL certificates. You can find instructions on how to do this here. Make sure to configure Nginx to redirect HTTP traffic to HTTPS.

Troubleshooting

If something isn't working, here's what I check first:

1. Nginx error logs (/var/log/nginx/error.log)
2. Apache error logs (/var/log/apache2/error.log or /var/log/httpd/error_log)
3. Nginx configuration test (sudo nginx -t)
4. Apache status (sudo systemctl status apache2 or sudo systemctl status httpd)
5. Network connectivity between Nginx and Apache (using ping or telnet)

Setting up Nginx as a reverse proxy is a simple but powerful way to improve your server's performance and security. It's a technique I rely on heavily in my day-to-day work. It's a bit more complex than just running Apache directly, but the benefits are well worth the extra effort.

I find that a little extra configuration upfront saves me a lot of headaches later.

Related reading

• Nginx vs Apache Performance Tuning Guide
• Email Deliverability: SPF, DKIM, and DMARC with Postfix