Proxies, Load Balancers and CDNs

Reverse proxies

A reverse proxy receives public traffic and forwards it to apps behind it. Nginx is the classic choice. It terminates TLS, serves static files fast, buffers slow clients and shields the app server.

server {
    listen 443 ssl http2;
    server_name pandadevhub.com;

    ssl_certificate     /etc/letsencrypt/live/pandadevhub.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/pandadevhub.com/privkey.pem;

    client_max_body_size 50m;

    location /static/ {
        alias /srv/pandadev/app/app/static/;
        expires 30d;
    }

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

server {
    listen 80;
    server_name pandadevhub.com;
    return 301 https://$host$request_uri;
}

Test and apply: sudo nginx -t && sudo systemctl reload nginx.

Forwarded headers and the real client IP

Behind a proxy, the app sees every request coming from 127.0.0.1. The proxy passes the real address in X-Forwarded-For and the original scheme in X-Forwarded-Proto. In Flask, trust exactly as many proxies as you have:

from werkzeug.middleware.proxy_fix import ProxyFix
app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1)

Trusting more hops than exist lets attackers fake their IP, which would defeat rate limiting and login lockouts.

Load balancers

A load balancer spreads requests across several app servers and removes unhealthy ones using health checks (for example GET /api/health every 10 seconds).

Prefer stateless apps (sessions in signed cookies or Redis) so any server can handle any request and sticky sessions are unnecessary.

CDNs

A Content Delivery Network (Cloudflare, Fastly, CloudFront) caches responses in data centres near users. Benefits: faster pages, lower server load and protection against traffic floods.

• Cache static files aggressively with long Cache-Control and versioned file names.
• Be careful caching HTML for signed-in users: a misconfigured cache can show one user's page to another. Mark personal responses Cache-Control: private, no-store.

Check yourself

• Why does Nginx sit in front of Gunicorn?
• What goes wrong if you trust too many forwarded hops?
• Which responses must never be cached by a CDN?