Nginx infrastructure services
Nginx sits in front of most of what we run — terminating TLS, routing requests and serving static files faster than any application server will. It is boring, and that is the highest compliment infrastructure gets.
Where we use Nginx
Nginx is part of the stack on this service. Each page covers how we work, what you get and what it costs to start.
Nginx in practice
Nginx handles the front door: TLS termination, routing across application instances, static files, compression and cache headers. It does all of it on very little memory, which is why it has sat in front of a large share of the internet for over a decade.
Most of what it does could technically be done in the application, and almost none of it should be. Rate limiting, redirects, header policy and caching are configuration concerns that belong outside your code, where they can be changed without a deployment and where they cost the application nothing.
What we build with Nginx
Traffic distributed across application instances with health checks and sane timeouts.
Certificates issued and renewed automatically, with modern cipher configuration rather than defaults from a 2015 blog post.
Assets served with correct cache headers and compression, keeping that load off the application entirely.
Is Nginx right for you?
Ask usA good fit when
- Reverse proxy in front of application servers
- TLS termination with automated certificate renewal
- Serving static assets and media efficiently
- Rate limiting and request-level protection
Probably not when
- Environments where a cloud load balancer already does the job
- Simple setups where Caddy’s automatic configuration is less work
- Complex routing logic that really belongs in an API gateway
What we run alongside Nginx
The rest of the setup, and why each piece is there. We keep this list short on purpose — every dependency is something someone has to maintain.
- Certbot or acme.sh
- Automated Let’s Encrypt renewal, so nothing expires unnoticed.
- Brotli and gzip
- Compression configured properly, which is one of the cheapest speed wins available.
- Cache headers
- Long lifetimes on fingerprinted assets, short ones on HTML.
- Rate limiting zones
- Protection against abuse before traffic reaches the application.
- Access logs
- Structured logs shipped somewhere queryable, not left to rotate away.
Why Nginx
Let’s talkVery low resource use
It handles large numbers of concurrent connections on modest hardware, which keeps the front door cheap.
Precise control
Rate limiting, redirects, header rules and caching are all configuration rather than application code.
Extremely stable
It is one of the most deployed pieces of server software in existence, and it behaves accordingly.
What we get called in to fix
Get a second opinionCertificates that expired
Renewal never automated, discovered by users rather than by monitoring.
Outdated TLS configuration
Cipher suites copied from an old blog post and never revisited.
Missing cache headers
Assets re-downloaded on every visit because nothing sets a lifetime.
Buffer and timeout defaults
Large uploads or slow endpoints failing at the proxy with errors that look like application bugs.
Nginx or the alternative
The comparisons we are actually asked to make, answered the way we would answer them on a call.
Caddy for automatic HTTPS and much simpler configuration. Nginx for fine-grained control and existing setups.
Cloud load balancers for scaling and health checks. Nginx when you want request-level control they do not offer.
Traefik for dynamic container environments with service discovery. Nginx for static, explicit configuration.
Ansible
ArgoCD
AWS
Azure
CircleCI
Datadog
Docker
GitHub
GitLab
Go
Google CloudGot an idea? Let’s make it real.
Tell us the short version
This could be the first step towards a new and successful collaboration. A one-line idea and a finished spec are both fine — tell us the problem, the deadline you’re working to and what’s in your way.
Keep looking
Frequently asked questions
Caddy for automatic certificates and simpler configuration; Nginx where fine-grained control or existing configuration matters more.
Yes, including automated Let’s Encrypt renewal so nothing expires unnoticed.
Frequently — as an ingress layer or a per-host proxy, depending on the deployment shape.
Yes, with automated renewal and monitoring so expiry is caught by a check rather than by a customer.
Nginx, in nearly every case. It is faster and it keeps that load entirely off the application.