Nginx Reverse Proxy Setup on Debian Linux | Remote

Get a clean Nginx reverse proxy on Debian that fronts your apps with proper TLS, upstream routing, and stable headers—delivered remotely for teams that need infrastructure done right the first time.

What You'll Get

• Debian-tuned Nginx install - Package baseline, modules check, and config layout that survives reboots and apt upgrades.
• Reverse-proxy vhosts - Server blocks mapping public hostnames to local or private upstreams (Node, Docker, PHP-FPM, Java, or internal APIs).
• TLS termination - Let's Encrypt or your certs, modern cipher suite, HSTS options, and HTTP→HTTPS redirects without breaking health checks.
• Upstream resilience - Timeouts, retries, buffer sizing, and WebSocket/upgrade headers when your app needs them.
• Security headers & access controls - Sensible defaults, optional basic auth or IP allowlists on admin paths, and leak-free error pages.
• Handoff notes - Plain-English map of what changed, reload commands, and where to add the next site tomorrow.

Serving Remote & surrounds

This service exists for distributed product and ops teams who ship multi-service stacks from Debian VPS or bare metal without a full-time sysadmin on payroll. Demand spikes when new microservices go live, when a single public IP must front several internal ports, or when compliance asks for TLS offload before traffic hits the app layer. We work fully remote worldwide and arrange on-site only where practical for rack-side validation.

• SaaS and multi-tenant hosts consolidating APIs behind one edge hostname
• Clinics and telehealth vendors exposing patient portals without opening origin ports
• Seasonal campaign sites and education platforms needing fast extra vhosts before term or launch week

How We Work

1. Step 1: Reach Out - Share Debian version, public DNS, upstream ports, and whether you need WebSockets, large uploads, or sticky sessions—we listen before touching configs.
2. Step 2: Tailored Plan - Fixed quote for the proxy scope (single site, multi-vhost, or full edge hardening) with clear out-of-scope notes.
3. Step 3: We Deliver - Remote SSH session: install/verify nginx, write proxy blocks, issue certs, test paths, and reload safely.
4. Step 4: Confirm & Follow-up - You verify live URLs; we leave reload/test checklist and optional maintenance path for future hosts.

Common Issues & How to Fix Them

These are the failure modes we see repeatedly on Debian reverse-proxy builds—symptoms first, then safe checks you can run before escalating.

502 Bad Gateway only on some paths after enabling the proxy

Usually the upstream is bound to 127.0.0.1 on a different port than proxy_pass, or the app listens on IPv6-only while Nginx targets IPv4—classic after a Docker publish or systemd socket change.

1. Step 1: On the Debian host run ss -tlnp and confirm the exact address:port your app owns (not just the Dockerfile EXPOSE line).
2. Step 2: Align proxy_pass to that address; if the app is IPv6-only, use http://[::1]:PORT or force the app to dual-stack bind.
3. Step 3: curl -v http://UPSTREAM/path from the server, then nginx -t && systemctl reload nginx and retest the public path.

WebSockets or live dashboards connect then drop every 60 seconds

Default proxy read timeouts and missing Upgrade/Connection headers kill long-lived sockets—common on monitoring UIs, chat widgets, and collaborative editors behind Nginx.

1. Step 1: In browser devtools Network tab, confirm the failing request is an upgrade (101) or a long-poll that ends near 60s.
2. Step 2: Add proxy_http_version 1.1, proxy_set_header Upgrade $http_upgrade, proxy_set_header Connection "upgrade", and raise proxy_read_timeout (e.g. 3600s) on that location only.
3. Step 3: Reload Nginx and leave a test socket open past the old cutoff; access logs should show sustained upstream activity without 504s.

TLS works on the apex but www (or a second hostname) still serves the wrong certificate

Certbot wrote one server block; the second name never entered the certificate SAN list, or an old default_server still answers SNI first—frequent after a rushed multi-domain cutover.

1. Step 1: Run echo | openssl s_client -servername OTHER.NAME -connect YOUR.IP:443 2>/dev/null | openssl x509 -noout -text and read Subject Alternative Name.
2. Step 2: Expand the cert (certbot certonly --nginx -d apex -d www...) or merge names into one server block with a single ssl_certificate pair; remove duplicate listen 443 default_server leftovers.
3. Step 3: Re-test both hostnames in an incognito window and confirm the chain and names match; then force HTTPS redirects consistently.

When DIY is not enough (urgent, unsafe, recurring, or burning time), book Fixwebnode for direct professional support—no freelancers, bidding, or marketplace noise.

Why Choose Fixwebnode

We configure reverse proxies as a direct infrastructure provider: one accountable engineer path, Debian-aware defaults, and documentation your next teammate can follow. Empathy shows up in clear handoffs—not in vague marketplace copy.

• ✓ Hands-on Nginx on Debian for multi-upstream production edges
• ✓ Fixed-scope remote delivery with reload-safe change discipline
• ✓ Security-minded headers, TLS, and least-exposure upstream design

Tools & Technologies

Debian 11/12, Nginx (mainline or distro), OpenSSL, Certbot/Let's Encrypt, systemd, UFW/nftables awareness, Docker-published upstreams, PHP-FPM and Node reverse paths, WebSocket upgrade maps, access/error log triage, curl/openssl s_client verification, optional Fail2ban coordination on auth locations.

Perfect For

Product teams, MSPs, and small SaaS operators who need a reliable public edge in front of internal Debian services without hiring a standing ops bench. Ideal when you are launching a second API hostname, locking down admin paths, or replacing ad-hoc port forwards before a compliance or customer security review. Fully remote worldwide.

Ready to stabilise your edge? Chat with us or reach us at fixwebnode.com.au/contact-support for a scoped reverse-proxy engagement.