{"post":{"slug":"reverse-proxies-explained-2026","title":"Reverse proxies explained in 2026","excerpt":"Reverse proxies sit between clients and your servers, enabling TLS termination, caching, rate limiting, and routing in one place. Here is the 2026 guide.","category":"code","date":"April 21, 2026","author":"ByteLedger Team","content":"<span class=\"dropcap\">R</span>everse proxies are one of those infrastructure components that feel optional until the moment you need them — and then you realise you should have had one all along. They centralise TLS termination, header manipulation, caching, rate limiting, and routing into a single layer that backends never have to think about.\n\n## What changed in 2026\n\n- **Caddy is widely adopted.** Its automatic HTTPS (via ACME/Let's Encrypt) and JSON/Caddyfile configuration reduced certificate management from a recurring task to a zero-touch operation.\n- **Envoy replaced Nginx in most Kubernetes clusters.** Istio, Contour, and Emissary all use Envoy as the data plane. Understanding Envoy's xDS API is now infrastructure-engineer knowledge.\n- **AI-driven WAFs.** Cloudflare and AWS WAF now use ML models to detect anomalous traffic — traditional rule-based WAFs are being supplemented with behavioural analysis.\n- **HTTP/3 (QUIC) at the edge.** Cloudflare, Nginx, and Caddy support QUIC. Clients connecting over lossy networks (mobile) see 20–40 % lower latency at connection setup.\n\n## What a reverse proxy does\n\n```\nClient → [Reverse Proxy] → Backend Server A\n                        → Backend Server B\n                        → Backend Server C\n```\n\nThe proxy receives the request, applies policies (TLS, auth, rate limit, routing), and forwards to the appropriate backend. The backend's response travels the same path back.\n\nKey capabilities:\n\n| Capability | Benefit |\n| --- | --- |\n| TLS termination | Backends handle plain HTTP; certs in one place |\n| Load balancing | Distribute across multiple backends |\n| Caching | Serve repeated responses without hitting backends |\n| Rate limiting | Protect backends from traffic spikes |\n| Header manipulation | Add `X-Real-IP`, strip internal headers |\n| Path-based routing | `/api/*` → API service, `/app/*` → frontend |\n| Authentication | JWT validation, OAuth at the proxy layer |\n\n## Nginx reverse proxy\n\n```nginx\nserver {\n    listen 443 ssl http2;\n    server_name api.example.com;\n\n    ssl_certificate     /etc/ssl/cert.pem;\n    ssl_certificate_key /etc/ssl/key.pem;\n    ssl_protocols       TLSv1.2 TLSv1.3;\n\n    # Rate limiting (define zone in http block)\n    # limit_req zone=api burst=20 nodelay;\n\n    location /api/ {\n        proxy_pass         http://127.0.0.1:3000;\n        proxy_http_version 1.1;\n        proxy_set_header   Host              $host;\n        proxy_set_header   X-Real-IP         $remote_addr;\n        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;\n        proxy_set_header   X-Forwarded-Proto $scheme;\n\n        # Timeouts\n        proxy_connect_timeout 5s;\n        proxy_read_timeout    30s;\n        proxy_send_timeout    10s;\n    }\n\n    location /static/ {\n        root /var/www;\n        expires 30d;\n        add_header Cache-Control \"public, immutable\";\n    }\n}\n```\n\n## Caddy reverse proxy\n\nCaddy's Caddyfile is dramatically simpler and handles HTTPS automatically:\n\n```caddyfile\napi.example.com {\n    reverse_proxy localhost:3000 {\n        header_up X-Real-IP {remote_host}\n        transport http {\n            dial_timeout 5s\n            response_header_timeout 30s\n        }\n    }\n}\n\n# Path-based routing\napp.example.com {\n    handle /api/* {\n        reverse_proxy localhost:3000\n    }\n    handle {\n        reverse_proxy localhost:5173\n    }\n}\n```\n\nRun `caddy run --config Caddyfile` and HTTPS is live, auto-renewing forever.\n\n## Envoy for service-to-service traffic\n\nEnvoy uses a dynamic configuration API (xDS) rather than static config files:\n\n```yaml\n# envoy.yaml (static bootstrap example)\nstatic_resources:\n  listeners:\n    - name: listener_0\n      address:\n        socket_address: { address: 0.0.0.0, port_value: 8080 }\n      filter_chains:\n        - filters:\n            - name: envoy.filters.network.http_connection_manager\n              typed_config:\n                \"@type\": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\n                route_config:\n                  virtual_hosts:\n                    - name: backend\n                      domains: [\"*\"]\n                      routes:\n                        - match: { prefix: \"/\" }\n                          route: { cluster: backend_service }\n  clusters:\n    - name: backend_service\n      connect_timeout: 5s\n      load_assignment:\n        cluster_name: backend_service\n        endpoints:\n          - lb_endpoints:\n              - endpoint:\n                  address:\n                    socket_address: { address: 127.0.0.1, port_value: 3000 }\n```\n\nIn Kubernetes, you rarely write Envoy config directly — Istio's control plane generates it from `VirtualService` and `DestinationRule` resources.\n\n## Reverse proxy vs API gateway vs load balancer\n\n| Tool | Primary role | Typical layer |\n| --- | --- | --- |\n| Reverse proxy | Route, terminate TLS, cache | North-South edge |\n| Load balancer | Distribute traffic across backends | North-South or East-West |\n| API gateway | Auth, rate limit, API versioning, billing | North-South API entry point |\n| Service mesh proxy | mTLS, observability, retries | East-West (service to service) |\n\nThe boundaries blur — Nginx can be all four. The distinction is conceptual, not technical.\n\n## How to pick\n\n1. **Simple single-server app with HTTPS?** → Caddy (zero config, auto-certs).\n2. **High-traffic, fine-tuned config?** → Nginx.\n3. **Kubernetes service mesh?** → Envoy (via Istio or Contour).\n4. **Managed, zero-ops?** → Cloudflare Tunnel + Workers, or a cloud ALB.\n5. **Need a full API gateway?** → Kong, Traefik, or AWS API Gateway.\n\n## Common mistakes\n\n**Not setting timeouts.** A reverse proxy without `proxy_read_timeout` holds connections open for the default (60 s in Nginx) on slow/stuck backends. Set aggressive timeouts and rely on retries for transient errors.\n\n**Forwarding the wrong `Host` header.** Some backends use the `Host` header for routing. Forgetting `proxy_set_header Host $host` causes 404s from virtual-hosted backends.\n\n**Caching dynamic API responses.** Nginx's `proxy_cache` will cache a `GET /api/user/1` response and serve it stale to every user. Only cache explicitly: static assets and GET endpoints with `Cache-Control: public`.\n\n**No `X-Forwarded-For` handling in the backend.** Backends that log `REMOTE_ADDR` will log the proxy's IP, not the real client IP. Read `X-Forwarded-For` (or use the PROXY protocol) and validate it.\n\n## What to skip\n\n- **Apache httpd as a reverse proxy in new projects** — Nginx and Caddy have better performance and simpler config; Apache's rewrite rules are hard to maintain.\n- **Multiple reverse proxies in series without a clear reason** — each hop adds latency and complexity. One well-configured proxy at the edge is enough for most architectures.\n- **Disabling TLS between proxy and backend \"for speed\"** — use mTLS or at minimum enforce plain HTTP only on a private VPC interface, never on the public internet.\n\n## FAQ\n\n**Is Cloudflare a reverse proxy?**\nYes — when you put your domain behind Cloudflare, all traffic passes through Cloudflare's global network before reaching your origin. It acts as a reverse proxy with caching, WAF, and DDoS protection built in.\n\n**What is TLS termination?**\nThe reverse proxy decrypts incoming HTTPS traffic, inspects and routes the request as plain HTTP, then (optionally) re-encrypts before forwarding to the backend. This offloads TLS from backend servers.\n\n**How is a reverse proxy different from a forward proxy?**\nA forward proxy sits in front of clients (e.g. a corporate proxy that intercepts outbound employee traffic). A reverse proxy sits in front of servers (intercepts inbound client traffic). Clients know about forward proxies; they typically do not know about reverse proxies.\n\n**Can I use Nginx as both a web server and a reverse proxy?**\nYes — this is the most common Nginx configuration. Nginx serves static files directly from disk and proxies dynamic requests to an app server (Node, Gunicorn, etc).\n\n## Where to go next\n\n- [Load balancers explained in 2026](/blog/load-balancers-explained-2026)\n- [How to set up Nginx in 2026](/blog/how-to-set-up-nginx-2026)\n- [How to set up SSL in 2026](/blog/how-to-set-up-ssl-2026)","hue":308,"metaTitle":"Reverse Proxies Explained in 2026 (Nginx, Caddy, Envoy)","metaDescription":"2026 guide to reverse proxies: how they work, Nginx vs Caddy vs Envoy, TLS termination, caching, rate limiting, and real configuration examples.","keywords":["reverse proxies explained 2026","reverse proxy 2026","nginx reverse proxy 2026","caddy reverse proxy 2026","envoy proxy 2026","tls termination reverse proxy 2026","reverse proxy vs load balancer 2026","reverse proxy configuration 2026","api gateway vs reverse proxy 2026","reverse proxy caching 2026"],"tldr":["**A reverse proxy receives client requests and forwards them to backend servers** — clients never talk to backends directly.","**Caddy is the 2026 default for small teams** — automatic HTTPS, simple config, zero certificate management.","**Nginx remains dominant for high-throughput** production environments and complex routing rules.","**Envoy handles East-West (service-to-service) traffic** inside Kubernetes as a sidecar proxy.","**Skip:** putting a reverse proxy in front of a single-server app just to say you have one — if you need it, you will know (TLS, routing, caching); otherwise it adds complexity for no gain."],"readTime":"5 min read","wordCount":1087},"related":[{"slug":"what-is-a-reverse-proxy-2026","title":"What Is a Reverse Proxy? Explained for 2026","excerpt":"A reverse proxy sits in front of your servers and handles TLS, routing, caching, and load balancing. Here is the plain-language 2026 version.","category":"code","date":"May 1, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":138},{"slug":"api-gateway-explained-2026","title":"API Gateway Explained 2026: What It Does and When You Need One","excerpt":"An API gateway sits between clients and your services to handle routing, auth, and rate limiting in one place. Here is what it actually does in 2026 and when a microservices setup needs one.","category":"code","date":"July 5, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":260},{"slug":"how-to-set-up-nginx-2026","title":"How to set up Nginx in 2026: reverse proxy, HTTPS, and performance basics","excerpt":"Nginx is still the default reverse proxy for most production stacks in 2026. This guide covers installation, virtual hosts, HTTPS via Certbot, and tuning.","category":"code","date":"March 16, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":308}],"sameCategory":[{"slug":"bazel-build-explained-2026","title":"Bazel Explained: What Hermetic Builds Actually Cost","excerpt":"Bazel delivers reproducible, precisely cached builds and demands that you describe everything. Here is what you get, what it costs, and who should say no.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":145},{"slug":"graphql-federation-2026","title":"GraphQL Federation: One Graph, Many Teams","excerpt":"Federation composes independently-owned subgraphs into a single API. Here is what it solves, the operational cost it adds, and when a simpler gateway is enough.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":300},{"slug":"hermetic-builds-explained-2026","title":"Hermetic Builds Explained: Same Inputs, Same Output","excerpt":"A hermetic build depends only on declared inputs. Here is what that property gives you, the common leaks that break it, and how to move toward it incrementally.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":130},{"slug":"monorepo-tooling-compared-2026","title":"Monorepo Tooling Compared: What You Actually Need","excerpt":"Monorepo tools solve task orchestration and caching, not repository layout. Here is what each tier provides and how to tell when you have outgrown the simple option.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":150}],"newer":{"slug":"redis-vs-memcached-2026","title":"Redis vs Memcached in 2026: which cache should you use?","excerpt":"Redis and Memcached are both fast in-memory caches, but Redis has grown into a multi-purpose data store. Here is when each makes sense in 2026.","category":"code","date":"April 21, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":315},"older":{"slug":"roth-ira-explained-2026","title":"Roth IRA explained in 2026: rules, limits, and who should open one","excerpt":"A Roth IRA offers tax-free growth and tax-free withdrawals in retirement — one of the best accounts available to eligible earners. Here is how it works in 2026.","category":"finance","date":"April 21, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":310}}