Reverse Proxy Giải Thích Chi Tiết

Không có reverse proxy:
Internet → App Server (public IP, exposed ports, vulnerable)
 
Có reverse proxy:
Internet → Reverse Proxy (public IP) → App Server (private network)

X-Forwarded-For: 203.0.113.50          # IP thật của client
X-Forwarded-Proto: https               # Protocol gốc
X-Forwarded-Host: example.com          # Hostname gốc
X-Real-IP: 203.0.113.50                # Client IP (Nginx-specific)
X-Request-ID: abc-123-def              # Request identifier duy nhất

server {
    listen 443 ssl http2;
    server_name example.com;
 
    # SSL certificates
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
 
    # Modern TLS configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;
 
    # HSTS (bảo browsers luôn dùng HTTPS)
    add_header Strict-Transport-Security "max-age=63072000" always;
 
    # Proxy tới backend (plain HTTP)
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}
 
# Redirect HTTP sang HTTPS
server {
    listen 80;
    server_name example.com;
    return 301 https://$server_name$request_uri;
}

# Define cache zone (10MB metadata, 1GB storage, 60 phút hết hạn)
proxy_cache_path /var/cache/nginx levels=1:2
    keys_zone=app_cache:10m
    max_size=1g
    inactive=60m
    use_temp_path=off;
 
server {
    listen 443 ssl http2;
    server_name example.com;
 
    location /api/ {
        proxy_pass http://backend;
 
        # Bật caching
        proxy_cache app_cache;
        proxy_cache_valid 200 10m;       # Cache response 200 trong 10 phút
        proxy_cache_valid 404 1m;        # Cache response 404 trong 1 phút
        proxy_cache_use_stale error timeout updating;  # Serve stale khi error
        proxy_cache_lock on;             # Chỉ 1 request tới backend cho cùng URL
 
        # Cache key (gì tạo nên mỗi cached entry duy nhất)
        proxy_cache_key "$scheme$request_method$host$request_uri";
 
        # Thêm cache status header để debug
        add_header X-Cache-Status $upstream_cache_status;
    }
 
    # Không cache POST, PUT, DELETE
    location /api/ {
        if ($request_method != GET) {
            set $no_cache 1;
        }
        proxy_cache_bypass $no_cache;
        proxy_no_cache $no_cache;
    }
 
    # Cache static assets mạnh tay
    location /static/ {
        proxy_pass http://backend;
        proxy_cache app_cache;
        proxy_cache_valid 200 7d;        # 7 ngày cho static files
        add_header Cache-Control "public, max-age=604800";
    }
}

# Define backend server group
upstream api_servers {
    least_conn;                         # Dùng least connections algorithm
 
    server 10.0.1.101:3000 weight=3;   # Server mạnh hơn nhận nhiều traffic hơn
    server 10.0.1.102:3000 weight=2;
    server 10.0.1.103:3000 weight=1;
    server 10.0.1.104:3000 backup;     # Chỉ dùng khi các server khác down
 
    # Health checks (Nginx Plus)
    # health_check interval=10 fails=3 passes=2;
}
 
server {
    listen 443 ssl http2;
    server_name api.example.com;
 
    location / {
        proxy_pass http://api_servers;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 
        # Timeouts
        proxy_connect_timeout 5s;
        proxy_read_timeout 30s;
        proxy_send_timeout 10s;
 
        # Retry on failure
        proxy_next_upstream error timeout http_502 http_503;
        proxy_next_upstream_tries 2;
    }
}

upstream web_app {
    server 10.0.1.101:3000;
    server 10.0.1.102:3000;
}
 
upstream api_service {
    server 10.0.2.101:8080;
    server 10.0.2.102:8080;
}
 
upstream admin_panel {
    server 10.0.3.101:4000;
}
 
server {
    listen 443 ssl http2;
    server_name example.com;
 
    # Frontend application
    location / {
        proxy_pass http://web_app;
    }
 
    # API service
    location /api/ {
        proxy_pass http://api_service;
    }
 
    # Admin panel (giới hạn bởi IP)
    location /admin/ {
        allow 10.0.0.0/8;
        deny all;
        proxy_pass http://admin_panel;
    }
}

Expose trực tiếp:
Client → App Server tại 203.0.113.10:3000
(Attacker biết server IP, port, và technology)
 
Sau reverse proxy:
Client → Proxy tại 198.51.100.1:443
(Attacker chỉ thấy proxy. Backend trên private 10.x.x.x network)

# Define rate limit zone (10MB shared memory, 10 requests/giây mỗi IP)
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
limit_req_zone $binary_remote_addr zone=login_limit:10m rate=1r/s;
 
server {
    # API endpoints — 10 req/s với burst 20
    location /api/ {
        limit_req zone=api_limit burst=20 nodelay;
        proxy_pass http://backend;
    }
 
    # Login endpoint — strict 1 req/s
    location /api/auth/login {
        limit_req zone=login_limit burst=3;
        limit_req_status 429;
        proxy_pass http://backend;
    }
}

server {
    # Chặn known bad user agents
    if ($http_user_agent ~* (bot|crawler|spider|scraper)) {
        return 403;
    }
 
    # Chặn requests có SQL injection patterns
    location /api/ {
        if ($query_string ~* "(union|select|insert|update|delete|drop)") {
            return 403;
        }
        proxy_pass http://backend;
    }
 
    # Chặn request bodies quá lớn (ngăn upload attacks)
    client_max_body_size 10m;
 
    # Ẩn server version
    server_tokens off;
 
    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
}

# Admin endpoints chỉ truy cập được từ IPs cụ thể
location /admin/ {
    allow 10.0.0.0/8;       # Internal network
    allow 192.168.1.0/24;   # Office network
    deny all;               # Chặn tất cả
    proxy_pass http://admin_backend;
}

# WebSocket support
map $http_upgrade $connection_upgrade {
    default upgrade;
    ""      close;
}
 
server {
    listen 443 ssl http2;
    server_name example.com;
 
    # WebSocket endpoint
    location /ws/ {
        proxy_pass http://websocket_backend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
 
        # Timeouts dài hơn cho WebSocket connections
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
    }
 
    # HTTP thông thường
    location / {
        proxy_pass http://web_backend;
    }
}

server {
    listen 443 ssl http2;
    server_name grpc.example.com;
 
    location / {
        grpc_pass grpc://grpc_backend;
        grpc_set_header Host $host;
 
        # Error handling
        error_page 502 = /error502grpc;
    }
 
    location = /error502grpc {
        internal;
        default_type application/grpc;
        add_header grpc-status 14;
        add_header content-length 0;
        return 204;
    }
}

server {
    # Rewrite /old-api/* thành /api/v2/*
    location /old-api/ {
        rewrite ^/old-api/(.*) /api/v2/$1 break;
        proxy_pass http://backend;
    }
 
    # Strip prefix: /service-a/users → /users
    location /service-a/ {
        proxy_pass http://service_a_backend/;  # Trailing slash strip prefix
    }
 
    # Add prefix: /users → /api/v1/users
    location /users {
        proxy_pass http://backend/api/v1/users;
    }
}

server {
    location /api/ {
        proxy_pass http://backend;
 
        # Thêm headers vào request gửi tới backend
        proxy_set_header X-Request-ID $request_id;
        proxy_set_header X-Real-IP $remote_addr;
 
        # Thêm headers vào response gửi cho client
        add_header X-Served-By $hostname;
        add_header X-Response-Time $request_time;
 
        # Xóa sensitive headers từ backend response
        proxy_hide_header X-Powered-By;
        proxy_hide_header Server;
    }
}

server {
    # Bật gzip compression
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_comp_level 5;
    gzip_types
        text/plain
        text/css
        text/javascript
        application/json
        application/javascript
        application/xml
        image/svg+xml;
 
    # Không nén files đã nén
    gzip_proxied any;
 
    location / {
        proxy_pass http://backend;
    }
}

upstream auth_service {
    server 10.0.1.101:3001;
}
 
upstream user_service {
    server 10.0.2.101:3002;
    server 10.0.2.102:3002;
}
 
upstream order_service {
    server 10.0.3.101:3003;
    server 10.0.3.102:3003;
    server 10.0.3.103:3003;
}
 
server {
    listen 443 ssl http2;
    server_name api.example.com;
 
    # Auth subrequest — validate token trước khi forward
    location = /auth/validate {
        internal;
        proxy_pass http://auth_service/validate;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header X-Original-URI $request_uri;
    }
 
    # Protected endpoints — yêu cầu auth
    location /api/users/ {
        auth_request /auth/validate;
        auth_request_set $auth_user $upstream_http_x_auth_user;
        proxy_set_header X-Auth-User $auth_user;
        proxy_pass http://user_service/;
    }
 
    location /api/orders/ {
        auth_request /auth/validate;
        auth_request_set $auth_user $upstream_http_x_auth_user;
        proxy_set_header X-Auth-User $auth_user;
        proxy_pass http://order_service/;
    }
 
    # Public endpoints — không cần auth
    location /api/auth/ {
        proxy_pass http://auth_service/;
    }
}

# Complete Nginx reverse proxy setup
server {
    listen 80;
    server_name example.com;
    return 301 https://$server_name$request_uri;
}
 
server {
    listen 443 ssl http2;
    server_name example.com;
 
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
 
    # Security
    server_tokens off;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
 
    # Compression
    gzip on;
    gzip_types text/plain text/css application/json application/javascript;
 
    # Proxy tới backend
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
 
        # Timeouts
        proxy_connect_timeout 5s;
        proxy_read_timeout 60s;
    }
 
    # Static files
    location /static/ {
        alias /var/www/static/;
        expires 7d;
        add_header Cache-Control "public, immutable";
    }
}

# docker-compose.yml với Traefik
version: "3.8"
 
services:
  traefik:
    image: traefik:v3.0
    command:
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "[email protected]"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"    # Dashboard
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - letsencrypt:/letsencrypt
 
  api:
    image: my-api:latest
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`api.example.com`)"
      - "traefik.http.routers.api.tls.certresolver=letsencrypt"
      - "traefik.http.services.api.loadbalancer.server.port=3000"
    deploy:
      replicas: 3
 
  web:
    image: my-web:latest
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.web.rule=Host(`example.com`)"
      - "traefik.http.routers.web.tls.certresolver=letsencrypt"
      - "traefik.http.services.web.loadbalancer.server.port=8080"
 
volumes:
  letsencrypt:

# Caddyfile — đây là toàn bộ configuration
example.com {
    reverse_proxy 127.0.0.1:3000
 
    # Automatic HTTPS — Caddy xử lý certificates
    # Automatic HTTP → HTTPS redirect
    # Automatic certificate renewal
}
 
api.example.com {
    reverse_proxy /api/users/* 10.0.1.101:3001 10.0.1.102:3001 {
        lb_policy least_conn
        health_uri /health
        health_interval 10s
    }
 
    reverse_proxy /api/orders/* 10.0.2.101:3002
 
    # Compression
    encode gzip
 
    # Rate limiting
    rate_limit {
        zone api {
            key {remote_host}
            events 100
            window 1m
        }
    }
}

Client → Proxy → [TCP connection mới] → Backend → [đóng] → Proxy → Client
Client → Proxy → [TCP connection mới] → Backend → [đóng] → Proxy → Client

Client → Proxy → [tái sử dụng connection] → Backend → Proxy → Client
Client → Proxy → [tái sử dụng connection] → Backend → Proxy → Client

upstream backend {
    server 10.0.1.101:3000;
    server 10.0.1.102:3000;
 
    # Giữ 32 idle connections sống mỗi worker
    keepalive 32;
}
 
server {
    location / {
        proxy_pass http://backend;
        proxy_http_version 1.1;
        proxy_set_header Connection "";  # Bật keepalive tới upstream
    }
}

server {
    location /api/ {
        proxy_pass http://backend;
 
        # Buffer backend response
        proxy_buffering on;
        proxy_buffer_size 4k;        # Buffer cho phần đầu response
        proxy_buffers 8 16k;         # 8 buffers mỗi cái 16k
        proxy_busy_buffers_size 32k; # Max size trước khi gửi cho client
    }
 
    # Tắt buffering cho streaming endpoints
    location /api/stream/ {
        proxy_pass http://backend;
        proxy_buffering off;
    }
}

server {
    # Thời gian thiết lập connection tới backend
    proxy_connect_timeout 5s;
 
    # Thời gian đọc response từ backend
    proxy_read_timeout 60s;
 
    # Thời gian gửi request tới backend
    proxy_send_timeout 10s;
 
    # Client request body timeout
    client_body_timeout 10s;
 
    # Client response timeout
    send_timeout 10s;
 
    # Keep-alive timeout
    keepalive_timeout 65s;
}

# Blue environment (đang live)
upstream blue {
    server 10.0.1.101:3000;
    server 10.0.1.102:3000;
}
 
# Green environment (version mới)
upstream green {
    server 10.0.2.101:3000;
    server 10.0.2.102:3000;
}
 
# Toggle bằng cách đổi upstream
server {
    location / {
        proxy_pass http://blue;   # Đổi thành "green" để switch
    }
}

upstream stable {
    server 10.0.1.101:3000 weight=9;
    server 10.0.1.102:3000 weight=9;
}
 
upstream canary {
    server 10.0.2.101:3000 weight=1;
}
 
# Split traffic dùng map
split_clients "${remote_addr}" $backend {
    90%   stable;
    *     canary;
}
 
server {
    location / {
        proxy_pass http://$backend;
    }
}

// Express.js health check
app.get("/health", (_req, res) => {
  const health = {
    status: "ok",
    uptime: process.uptime(),
    timestamp: new Date().toISOString(),
  };
 
  try {
    // Kiểm tra database connection
    // await db.query("SELECT 1");
    res.json(health);
  } catch (error) {
    res.status(503).json({
      ...health,
      status: "error",
      message: "Database connection failed",
    });
  }
});