A reverse proxy sits in front of your backend services, handling incoming requests and distributing them to the appropriate application. It is essential for running multiple services like Node.js, Python apps, and static sites on a single VPS, providing SSL termination, load balancing, caching, and security filtering. This guide walks through setting up three popular options on your VPS and compares their strengths for different use cases.<\/p>\n\n\n\n
Nginx powers over 30% of websites. It excels as a reverse proxy with low memory usage, as little as 2MB per worker, and excellent concurrency handling with its event-driven architecture.<\/p>\n\n\n\n
# \/etc\/nginx\/sites-available\/reverse-proxy.conf\nserver {\n listen 443 ssl;\n server_name app.example.com;\n\n ssl_certificate \/etc\/ssl\/certs\/cert.pem;\n ssl_certificate_key \/etc\/ssl\/private\/key.pem;\n\n location \/ {\n proxy_pass http:\/\/127.0.0.1:3000;\n proxy_http_version 1.1;\n proxy_set_header Upgrade $http_upgrade;\n proxy_set_header Connection 'upgrade';\n proxy_set_header Host $host;\n proxy_cache_bypass $http_upgrade;\n }\n\n location \/api\/ {\n proxy_pass http:\/\/127.0.0.1:8080;\n proxy_set_header X-Real-IP $remote_addr;\n }\n}<\/code><\/pre>\n\n\n\nPros:<\/strong> Proven performance at scale (10,000+ concurrent connections on a 1GB VPS), WebSocket proxying out of the box, extensive module ecosystem, and excellent static file serving.<\/p>\n\n\n\nCons:<\/strong> Configuration can be verbose, no native active health checking without Nginx Plus, and reloads require SIGHUP.<\/p>\n\n\n\nOption 2: HAProxy – The Load Balancing Specialist<\/h2>\n\n\n\n
HAProxy is designed specifically for high-availability load balancing. It offers granular health checks, advanced routing algorithms, and an astonishingly small memory footprint of approximately 15MB for 10,000 connections. It is the go-to choice for mission-critical routing.<\/p>\n\n\n\n
HAProxy Configuration Example<\/h3>\n\n\n\n# \/etc\/haproxy\/haproxy.cfg\nglobal\n log \/dev\/log local0\n maxconn 4096\n user haproxy\n group haproxy\n\ndefaults\n log global\n mode http\n option httplog\n timeout connect 5000\n timeout client 50000\n timeout server 50000\n\nfrontend web_front\n bind *:443 ssl crt \/etc\/haproxy\/certs\/\n default_backend app_servers\n\nbackend app_servers\n balance roundrobin\n option httpchk GET \/health\n server app1 127.0.0.1:3000 check inter 10s fall 3 rise 2\n server app2 127.0.0.1:3001 check inter 10s fall 3 rise 2<\/code><\/pre>\n\n\n\nPros:<\/strong> Best-in-class health checking (active and passive), lowest memory overhead, advanced ACL engine for traffic routing, and a native stats dashboard.<\/p>\n\n\n\nCons:<\/strong> No native static file serving (pair with Nginx), SSL configuration less intuitive than Caddy.<\/p>\n\n\n\nOption 3: Caddy – The Modern Automatic Choice<\/h2>\n\n\n\n
Caddy is a Go-based web server that automates HTTPS via Let’s Encrypt and has a clean, readable configuration language called the Caddyfile. It is the easiest option to set up securely with zero manual certificate management.<\/p>\n\n\n\n
Caddy Configuration Example<\/h3>\n\n\n\n# Caddyfile\napp.example.com {\n reverse_proxy localhost:3000\n\n # Route \/api\/* to a different backend\n handle_path \/api\/* {\n reverse_proxy localhost:8080\n }\n\n # Static files directly\n handle \/static\/* {\n root * \/var\/www\/static\n file_server\n }\n}\n\napi.example.com {\n reverse_proxy localhost:8080\n}<\/code><\/pre>\n\n\n\nPros:<\/strong> Automatic HTTPS with Let’s Encrypt, clean minimal configuration, native HTTP\/2 and HTTP\/3 (QUIC) support, and built-in static file serving.<\/p>\n\n\n\nCons:<\/strong> Higher memory footprint (~50MB idle vs ~10MB for Nginx\/HAProxy), smaller ecosystem of modules, and Go-based debugging can be less familiar.<\/p>\n\n\n\nWhich One Should You Choose?<\/h2>\n\n\n\n