8 min read #networking #HTTP
On this page

Reverse Proxy and Load Balancing

Reverse proxy is more than just "forwarding requests"—TLS termination, caching, compression, rate limiting, health checks, and blue-green deployments all converge on traffic management at this layer. The configuration philosophies of nginx, Caddy, and HAProxy differ significantly.

Overview

A reverse proxy acts as a server-side facade—it receives all external requests, handles TLS termination, SNI routing, rate limiting, and logging, then forwards requests to backend services. A load balancer distributes requests across multiple backend instances according to strategies (round-robin, least connections, IP hash), thereby improving availability and throughput. Caddy is known for automatic TLS (ACME + Let's Encrypt with zero configuration), while nginx and HAProxy dominate enterprise environments with high performance and rich L4/L7 features. Understanding reverse proxies is a prerequisite for deploying any internet-facing service.

Reverse Proxy vs. Forward Proxy

Forward Proxy vs. Reverse Proxy: Who is proxying whom Forward Proxy Client Proxy Target Example: Local mihomo :7890 → proxy browser traffic to overseas Reverse Proxy Client grafana.liz6.com (Looks like Target) Actually Caddy:443 (Proxy) 127.0.0.1:3000 (Backend) The client thinks it is connecting directly to Grafana and doesn't know it's on localhost A forward proxy helps the client access the external network and hides the client from the target; a reverse proxy does the opposite, pretending to be the target itself to the client, while hiding the real backend behind it.

Caddy Configuration

grafana.liz6.com {
    reverse_proxy 127.0.0.1:3000 {
        header_up Host {upstream_hostport}
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}
    }
}

chat.liz6.com {
    reverse_proxy 127.0.0.1:3001
}

Responsibilities of a reverse proxy:

  1. TLS Termination: Caddy handles TLS → backend HTTP → backend doesn't need to handle TLS
  2. SNI Routing: Route to different backends on the same port (443) based on SNI
  3. Request Rewriting: Add X-Forwarded-* headers, modify path/headers
  4. Rate Limiting: Per-client or per-endpoint rate limiting
  5. Access Logging: Centralized logging (Caddy JSON access log)

L4 vs. L7 Load Balancing

L4 vs. L7: Whether to parse HTTP determines routing capability and speed L4 · TCP (does not parse HTTP) nginx stream module / HAProxy mode tcp Does not parse HTTP → only looks at TCP payload → but very fast Cannot route based on URL / Host header Advantage: Very fast Suitable for raw TCP forwarding, WebSocket pass-through L7 · HTTP (parses and routes based on content) nginx http module / HAProxy mode http / Caddy Parses HTTP → can route based on Host / URL / Header / Cookie / Method Can perform content-based rate limiting, request inspection Cost: Slightly slower HTTP parsing overhead Choose L4 or L7 depending on whether content-based routing is needed: use L4 for pure forwarding and WebSocket passthrough to prioritize speed; to split traffic based on Host / Path / Header or perform content-level rate limiting, you must use L7.

Load Balancing Algorithms

Round Robin:         Round-robin across backends
Least Connections:   Select backend with fewest connections (L7 only)
Random:              Random selection
IP Hash:             Same client IP → same backend → sticky
Consistent Hash:     Hash ring → only 1/N remap when backends change
Weighted:            Backend weight → weight=3 gets 3x traffic

Health Check:
  passive: Detect failures from actual request errors (max_fails=N)
  active:  Periodic GET /health → expect 200 → mark as down on failure
  slow_start: Gradually increase traffic after backend recovery (avoid flood)

References

  • Caddy: caddyserver.com/docs/caddyfile/directives/reverse_proxy
  • nginx: nginx.org/en/docs/http/ngx_http_upstream_module.html
  • HAProxy: haproxy.org

Keywords: reverse proxy, SNI routing, L4/L7 LB, health check, sticky session, rate limiting, Caddy

Related pages

© 2026 liz's doc