Reverse Proxy

A reverse proxy sits in front of one or more backend servers and forwards client requests to them, returning the responses — the client only ever talks to the proxy. It is the natural place for TLS termination, routing, caching, compression, rate limiting, and load balancing (nginx, Envoy, HAProxy).

Worked example: nginx receives all HTTPS traffic, terminates TLS, routes /api to the app servers and /static to a cache, and load-balances across app instances — the backends see plain HTTP and never face the internet directly. Gotcha: a reverse proxy differs from a forward proxy — a reverse proxy acts on behalf of the SERVER (clients do not know the backends), a forward proxy on behalf of the CLIENT — and because all traffic flows through it, it is a critical single point that must be redundant and is where many cross-cutting concerns (and outages) concentrate.