Nginx load balancing and TLS termination

Define upstream pools with load methods (`least_conn`, `ip_hash`, weights). TLS termination at Nginx frees Node from certificate management and enables HTTP/2 toward clients while speaking HTTP/1.1 upstream if needed.

					upstream node_pool {
  least_conn;
  server 10.0.0.11:3000 max_fails=3 fail_timeout=30s;
  server 10.0.0.12:3000 max_fails=3 fail_timeout=30s;
  keepalive 32;
}

server {
  listen 443 ssl http2;
  ssl_certificate     /etc/ssl/fullchain.pem;
  ssl_certificate_key /etc/ssl/privkey.pem;

  location / {
    proxy_http_version 1.1;
    proxy_set_header Connection "";
    proxy_pass http://node_pool;
  }
}
				

`proxy_http_version 1.1` plus empty `Connection` header enables upstream keepalive. Re-encrypt to upstream (`proxy_pass https://`) when internal networks are untrusted.

On interviews: SNI for multi-tenant certs; OCSP stapling; when to pass TLS through to Node (mTLS end-to-end).

Common pitfalls: no upstream keepalive causing socket churn; weak cipher suites; expired intermediate certs breaking mobile clients.

The trade-off is balancing simplicity, performance, safety, and operability — name which axis you optimized and what cost you accepted.

Checklist:

• Tune upstream keepalive and max_fails.
• Automate cert renewal (ACME).
• Align HTTP versions client-side vs upstream.
• Monitor handshake latency and cert expiry.