https://stackonward.com/tags/reverse-proxy/Recent content in Reverse Proxy on StackOnwardHugoen-USFri, 11 Sep 2026 05:18:00 +0800https://stackonward.com/posts/domain-request-flow/Fri, 11 Sep 2026 05:18:00 +0800https://stackonward.com/posts/domain-request-flow/<p>What happens when you type a URL in the browser is a sequence of hops, not a round trip to one origin. The request usually travels through DNS, a TCP or QUIC connection, TLS, a CDN or reverse proxy, and only then the application. The HTML that comes back is not the end; the browser still fetches styles, scripts, fonts, and images. <a href="https://developer.mozilla.org/en-US/docs/Learn_web_development/Getting_started/Web_standards/How_the_web_works" target="_blank" rel="noopener">MDN’s account of how the web works<span class="sr-only">(opens in a new tab)</span></a> lists DNS, the HTTP request, the server response, and the browser assembling the page as consecutive stages.</p>https://stackonward.com/posts/caddy-nginx-npm-comparison/Fri, 11 Sep 2026 05:15:00 +0800https://stackonward.com/posts/caddy-nginx-npm-comparison/<p>Caddy vs Nginx is decided by where the reverse-proxy config lives and how certificates are renewed, not by a public request-per-second ranking. A small site with files in Git and default automatic HTTPS usually belongs on Caddy. Working Nginx configs, modules, or operator muscle stay on Nginx. A web UI for a handful of hosts is Nginx Proxy Manager, and that choice also means backing up an application, a database, and generated Nginx files.</p> <figure> <img src="https://stackonward.com/images/posts/caddy-nginx-npm-comparison/en/proxy-decision-tree.svg" alt="Decision tree that chooses Caddy, Nginx, or Nginx Proxy Manager from file versus web UI maintenance, then from existing Nginx assets" loading="lazy" decoding="async"> <figcaption>Existing Nginx assets stay on the file path. A GUI path still needs a backup of the admin data.</figcaption> </figure> <h2 id="caddy-vs-nginx-is-decided-by-the-config-source-of-truth">Caddy vs Nginx is decided by the config source of truth</h2> <div class="table-responsive" role="region" aria-label="Scrollable table" tabindex="0"> <table> <thead> <tr> <th>Axis</th> <th>Caddy</th> <th>Nginx</th> <th>Nginx Proxy Manager</th> </tr> </thead> <tbody> <tr> <td>Daily config</td> <td>Caddyfile or JSON</td> <td>Nginx config files</td> <td>Web admin UI</td> </tr> <tr> <td>HTTPS</td> <td>Certificate issue and renewal are default</td> <td>Usually Certbot, acme.sh, or a cloud certificate</td> <td>Common certificate actions in the UI</td> </tr> <tr> <td>Git</td> <td>Reviewed as files</td> <td>Reviewed as files</td> <td>Main state lives in a database</td> </tr> <tr> <td>WebSocket</td> <td>HTTP reverse proxy handles the usual upgrade</td> <td>Upgrade-related headers must be set correctly</td> <td>Follows the generated Nginx config</td> </tr> <tr> <td>Cache and limits</td> <td>Configurable</td> <td>Mature and fine-grained</td> <td>Bounded by the UI and Advanced config</td> </tr> <tr> <td>Extra state</td> <td>Config plus certificate storage</td> <td>Config, certificates, and related scripts</td> <td>App, database, certificates, and generated config</td> </tr> </tbody> </table> </div> <p>Files are easy to review and roll back. A database is easy to click through, and a restore has to cover that database together with the certificates.</p>https://stackonward.com/posts/502-504-troubleshooting/Fri, 11 Sep 2026 05:08:00 +0800https://stackonward.com/posts/502-504-troubleshooting/<p>How to troubleshoot 502 and 504 starts at the hop that produced the status. Both codes come from a gateway or reverse proxy: 502 Bad Gateway means that hop did not get a usable response from upstream; 504 Gateway Timeout means it waited past its limit. Keep the headers, then reach the upstream from that hop&rsquo;s network.</p> <figure> <img src="https://stackonward.com/images/posts/502-504-troubleshooting/en/gateway-failure-map.svg" alt="A client reaches an app through a CDN and reverse proxy; a failed connection becomes 502, a wait past the limit becomes 504" loading="lazy" decoding="async"> <figcaption>Connection refused, DNS failure, and an invalid response usually point to 502. An upstream wait past the proxy deadline usually points to 504.</figcaption> </figure> <h2 id="how-to-troubleshoot-502-and-504-at-the-hop-that-returned-the-status">How to troubleshoot 502 and 504 at the hop that returned the status</h2> <p>A browser may sit behind Cloudflare or another CDN, a cloud load balancer, and Caddy or Nginx. Save the status, headers, time, and request ID:</p>