How to Set Up Nginx as a Reverse Proxy for a Node.js App

A reverse proxy puts Nginx in front of your Node.js app, so visitors hit Nginx on the normal web ports (80/443) and Nginx forwards requests to your app running on an internal port. It is the standard, robust way to expose a Node app to the world on a VPS.

Why not expose Node directly?

Running Node straight on port 80/443 works but misses a lot. Nginx in front gives you clean handling of SSL, static files, multiple apps on one server, buffering of slow clients, and a stable public entry point while your app restarts behind it.

How it works

Your Node app listens on a local port (say 3000). Nginx listens on 80/443 and proxies incoming requests to localhost:3000. The core config:

location / {
proxy_pass http://localhost:3000;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

WebSockets need extra headers

If your app uses WebSockets, add the upgrade headers so connections proxy correctly:

proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade";

This matters for Socket.IO and WebSockets.

Adding SSL

Terminate HTTPS at Nginx with a free certificate — see installing Let's Encrypt on a VPS. Nginx handles encryption, and traffic to your Node app stays local.

Keep the app running behind it

Run your Node app under PM2 or a systemd service so it stays up while Nginx fronts it.

Frequently asked questions

Why use Nginx instead of serving directly from Node?

Nginx handles SSL, static files, slow clients and multiple apps far better, and gives a stable public endpoint independent of your app process. It is the conventional, resilient setup.

Can I run several Node apps behind one Nginx?

Yes — give each app its own local port and its own Nginx server block or location, routing by domain or path. This is a common way to host multiple apps on one VPS.

Where does SSL go — Nginx or Node?

Terminate SSL at Nginx. It is simpler to manage, keeps certificates in one place, and lets your Node app speak plain HTTP locally.