A reverse proxy is the single highest-leverage piece of software on a small VPS. It terminates TLS, absorbs slow clients, and keeps a pool of persistent connections open to your application so that PHP-FPM, Node, or Gunicorn never has to pay for a TCP handshake. This guide skips the “apt install nginx” filler and focuses on the directives that change behaviour under load: upstream keepalive, proxy buffering, and timeout arithmetic that prevents the classic 502 and 504 cascade.<\/p>\n\n\n\n
Out of the box, Nginx opens a new TCP connection to the upstream for every proxied request and closes it immediately afterwards. On a 2 vCPU VPS serving 300 requests\/second, that is 600 extra socket operations and 300 TIME_WAIT entries per second. The upstream’s accept queue becomes the bottleneck long before CPU does.<\/p>\n\n\n\n
The fix is an upstream block with keepalive, and the matching The A healthy keepalive pool shows a flat, low TIME_WAIT count. If TIME_WAIT climbs in step with request rate, the Without buffering, a backend worker stays occupied for the entire duration of a slow client download. For dynamic sites the right posture is to buffer responses on disk up to a sane limit, then stream.<\/p>\n\n\n\n Timeouts must be ordered from the outside in: the proxy must wait longer than the backend, so the backend’s error surfaces as a clean 502\/500 rather than a truncated connection. A common production set:<\/p>\n\n\n\n If your application legitimately needs 90 seconds for a report export, raise Reload without dropping connections and confirm the behaviour with a quick benchmark against the loopback:<\/p>\n\n\n\n If proxy_set_header Connection \"\"<\/code> that stops Nginx from passing Connection: close<\/code> to the backend.<\/p>\n\n\n\nupstream app_backend {\n server 127.0.0.1:9000;\n keepalive 32; # idle connections cached per worker\n keepalive_requests 1000;\n keepalive_timeout 60s;\n}\n\nserver {\n listen 443 ssl http2;\n server_name example.com;\n\n location \/ {\n proxy_pass http:\/\/app_backend;\n proxy_http_version 1.1;\n proxy_set_header Connection \"\"; # required for keepalive\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n proxy_set_header X-Forwarded-Proto $scheme;\n }\n}<\/code><\/pre>\n\n\n\nSizing the keepalive pool<\/h2>\n\n\n\n
keepalive<\/code> value is per worker process, not global. With worker_processes auto<\/code> on a 2 vCPU box you get 2 workers, so keepalive 32<\/code> means up to 64 idle backend connections. Measure the real concurrency first:<\/p>\n\n\n\n# active connections to the upstream, sampled over 10s\nss -tn state established '( dport = :9000 )' | wc -l\n\n# verify Nginx is reusing backend sockets (TIME_WAIT should be near zero)\nwatch -n1 \"ss -tn state time-wait '( dport = :9000 )' | wc -l\"<\/code><\/pre>\n\n\n\nConnection \"\"<\/code> header is missing or proxy_http_version<\/code> is still 1.0.<\/p>\n\n\n\nBuffering: protect the backend from slow clients<\/h2>\n\n\n\n
proxy_buffering on;\nproxy_buffers 16 16k; # 256 KB total per connection\nproxy_buffer_size 16k; # headers, must exceed largest response header\nproxy_busy_buffers_size 32k;\nproxy_max_temp_file_size 1024m;\n\n# stream large downloads instead of buffering them\nlocation ~* \\.(mp4|zip|iso)$ {\n proxy_buffering off;\n proxy_request_buffering off;\n}<\/code><\/pre>\n\n\n\nDirective<\/th> Too low<\/th> Too high<\/th><\/tr><\/thead> proxy_buffer_size<\/td> 502 “upstream sent too big header”<\/td> wasted RAM per idle conn<\/td><\/tr> proxy_busy_buffers_size<\/td> client sees stuttering<\/td> memory growth on many conns<\/td><\/tr> keepalive<\/td> TIME_WAIT churn<\/td> idle sockets held on backend<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Timeout arithmetic that prevents 504s<\/h2>\n\n\n\n
proxy_connect_timeout 5s;\nproxy_send_timeout 60s;\nproxy_read_timeout 60s;\nsend_timeout 60s;\n\n# make Nginx try the next upstream on a timeout, not just a 502\nproxy_next_upstream error timeout http_502 http_504;\nproxy_next_upstream_tries 2;<\/code><\/pre>\n\n\n\nproxy_read_timeout<\/code> only for that location rather than globally. Global long timeouts are how a single stuck request consumes a worker slot that thousands of fast requests needed.<\/p>\n\n\n\nVerifying the change<\/h2>\n\n\n\n
nginx -t && systemctl reload nginx\n\n# 5000 requests, 50 concurrent, against the proxied endpoint\nwrk -t4 -c50 -d20s http:\/\/127.0.0.1\/\n\n# backend handshake churn should not scale with request count\nnstat -az TcpExtTCPReqQFullDrop TcpPassiveOpens<\/code><\/pre>\n\n\n\nTcpPassiveOpens<\/code> grows by roughly one per request, keepalive is not working. After the fix it should grow only as workers cycle.<\/p>\n\n\n\nTLS and CPU on a small VPS<\/h2>\n\n\n\n