Catalog
concept#Architecture#Security#Platform#Reliability

Reverse Proxy

A mediator server that accepts client requests and forwards them to internal backend servers, centralizing routing, security and performance functions.

A reverse proxy is a server positioned between clients and backend services that accepts requests and forwards them to internal servers.
Established
Medium

Classification

  • Medium
  • Technical
  • Architectural
  • Intermediate

Technical context

NGINX / NGINX IngressHAProxyKubernetes Ingress Controller

Principles & goals

Single responsibility: reverse proxy centralizes cross-cutting functions while backends remain stateless.Observability: proxy must provide metrics, logs and tracing contexts.Fail-fast and health checks: automatically remove unhealthy backends from the pool.
Run
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • Misconfiguration can block traffic or introduce security vulnerabilities.
  • Insufficient scaling leads to bottlenecks under load.
  • Incorrect TLS handling compromises confidentiality.
  • Run proxy instances highly available across multiple availability zones.
  • Centralize TLS management and automate certificate renewal.
  • Instrument metrics and ship logs for fast troubleshooting.

I/O & resources

  • List of backend services/upstreams
  • Routing rules and header policies
  • TLS certificates and secrets
  • Centralized routing and load balancing
  • Aggregated metrics and logs
  • Improved fault tolerance and performance

Description

A reverse proxy is a server positioned between clients and backend services that accepts requests and forwards them to internal servers. It provides load balancing, TLS termination, caching and security features as a central routing layer. Reverse proxies support health checks, canary rollouts and expose metrics and logs for observability without changing backends.

✔

  • Centralized control over routing and security policies.
  • Offloading backends via caching and TLS termination.
  • Enables canary deployments and fine-grained traffic control.

✖

  • Additional latency and potential single point of failure without HA.
  • Configuration complexity and secret management (TLS).
  • Cache invalidation and consistency can be challenging.

  • Latency (p95/p99)

    Measure of response times through the proxy; important for performance SLAs.

  • Cache hit ratio

    Share of requests served from cache; impacts backend load.

  • Upstream error rate

    Proportion of erroneous responses from backends as observed via the proxy.

NGINX as reverse proxy in front of a web application

NGINX terminates TLS, distributes load and caches static content for a scaling web application.

HAProxy for high throughput and TCP routing

HAProxy is used for SSL passthrough, TCP load balancing and detailed health checking.

Kubernetes Ingress Controller as reverse proxy

Ingress controllers (e.g., NGINX Ingress) manage routing, TLS and rate limiting for container workloads.

1

Analyze architecture and requirements

2

Choose suitable proxy software (NGINX/HAProxy/Ingress)

3

Configure upstreams, routing rules and TLS

4

Enable health checks, rate limiting and caching

5

Introduce monitoring, alerts and canary tests

⚠️ Technical debt & bottlenecks

  • Hardcoded upstream lists instead of service discovery.
  • Unversioned proxy configuration hinders rollbacks.
  • Missing automation for cert rotation and key management.
TLS CPU loadNetwork bandwidthProxy state/session management
  • Storing TLS certificates on a single proxy instance without rotation.
  • Performing all authentication checks only in the proxy and not in backends.
  • Aggressively caching dynamic API responses causing inconsistent data.
  • Omitted header forwarding (X-Forwarded-For, trace headers) breaks authentication.
  • Insufficient timeouts lead to hung connections under load.
  • Missing upstream health checks leave defective backends in rotation.
Networking and TLS fundamentalsConfiguration of web servers/proxies (NGINX, HAProxy)Monitoring and log analysis
Scalability via load distributionSecurity and perimeter controlOperational observability and monitoring
  • • Required high availability for production use
  • • Regulatory requirements for TLS/logging
  • • Limited proxy resources (CPU/RAM) affect scaling