--- title: Reverse Proxy and Load Balancing url: https://doc.liz6.com/en/networking/06-HTTP/04-reverse-proxy-and-load-balancing locale: en area: networking tags: - networking - HTTP date: 2026-06-30 modified: 2026-07-16 description: Reverse proxy is more than just "forwarding requests"—TLS termination, caching, compression, rate limiting, health checks, and blue-green deployments all converge on traffic management at this layer. The configuration philosophies of nginx, Caddy, and HAProxy differ significantly. --- # Reverse Proxy and Load Balancing > Reverse proxy is more than just "forwarding requests"—TLS termination, caching, compression, rate limiting, health checks, and blue-green deployments all converge on traffic management at this layer. The configuration philosophies of nginx, Caddy, and HAProxy differ significantly. ## Overview A reverse proxy acts as a server-side facade—it receives all external requests, handles TLS termination, SNI routing, rate limiting, and logging, then forwards requests to backend services. A load balancer distributes requests across multiple backend instances according to strategies (round-robin, least connections, IP hash), thereby improving availability and throughput. Caddy is known for automatic TLS (ACME + Let's Encrypt with zero configuration), while nginx and HAProxy dominate enterprise environments with high performance and rich L4/L7 features. Understanding reverse proxies is a prerequisite for deploying any internet-facing service. ## Reverse Proxy vs. Forward Proxy Forward Proxy vs. Reverse Proxy: Who is proxying whom Forward Proxy Client Proxy Target Example: Local mihomo :7890 → proxy browser traffic to overseas Reverse Proxy Client grafana.liz6.com (Looks like Target) Actually Caddy:443 (Proxy) 127.0.0.1:3000 (Backend) The client thinks it is connecting directly to Grafana and doesn't know it's on localhost A forward proxy helps the client access the external network and hides the client from the target; a reverse proxy does the opposite, pretending to be the target itself to the client, while hiding the real backend behind it. ## Caddy Configuration ```caddy grafana.liz6.com { reverse_proxy 127.0.0.1:3000 { header_up Host {upstream_hostport} header_up X-Real-IP {remote_host} header_up X-Forwarded-For {remote_host} header_up X-Forwarded-Proto {scheme} } } chat.liz6.com { reverse_proxy 127.0.0.1:3001 } ``` Responsibilities of a reverse proxy: 1. **TLS Termination**: Caddy handles TLS → backend HTTP → backend doesn't need to handle TLS 2. **SNI Routing**: Route to different backends on the same port (443) based on SNI 3. **Request Rewriting**: Add X-Forwarded-* headers, modify path/headers 4. **Rate Limiting**: Per-client or per-endpoint rate limiting 5. **Access Logging**: Centralized logging (Caddy JSON access log) ## L4 vs. L7 Load Balancing L4 vs. L7: Whether to parse HTTP determines routing capability and speed L4 · TCP (does not parse HTTP) nginx stream module / HAProxy mode tcp Does not parse HTTP → only looks at TCP payload → but very fast Cannot route based on URL / Host header Advantage: Very fast Suitable for raw TCP forwarding, WebSocket pass-through L7 · HTTP (parses and routes based on content) nginx http module / HAProxy mode http / Caddy Parses HTTP → can route based on Host / URL / Header / Cookie / Method Can perform content-based rate limiting, request inspection Cost: Slightly slower HTTP parsing overhead Choose L4 or L7 depending on whether content-based routing is needed: use L4 for pure forwarding and WebSocket passthrough to prioritize speed; to split traffic based on Host / Path / Header or perform content-level rate limiting, you must use L7. ## Load Balancing Algorithms ``` Round Robin: Round-robin across backends Least Connections: Select backend with fewest connections (L7 only) Random: Random selection IP Hash: Same client IP → same backend → sticky Consistent Hash: Hash ring → only 1/N remap when backends change Weighted: Backend weight → weight=3 gets 3x traffic Health Check: passive: Detect failures from actual request errors (max_fails=N) active: Periodic GET /health → expect 200 → mark as down on failure slow_start: Gradually increase traffic after backend recovery (avoid flood) ``` ## References - **Caddy**: caddyserver.com/docs/caddyfile/directives/reverse_proxy - **nginx**: nginx.org/en/docs/http/ngx_http_upstream_module.html - **HAProxy**: haproxy.org *Keywords: reverse proxy, SNI routing, L4/L7 LB, health check, sticky session, rate limiting, Caddy*