Reverse Proxy Mental Model Checklist for Nginx and Docker
A reverse proxy receives public traffic and forwards it to an internal service. This is common for Docker apps, n8n, API services, dashboards and AI automation tools. If you understand reverse proxy flow, many deployment errors become easier to fix.
Core principle
The public user talks to Nginx. Nginx talks to the internal app. The app may run on localhost, Docker network or another port. Your job is to make the domain, SSL, proxy headers and internal port agree.
Checklist
- Identify the public domain or subdomain.
- Identify the internal app port.
- Confirm the app is running locally.
- Confirm Nginx server block matches the domain.
- Set proxy_pass to the correct internal address.
- Preserve host and protocol headers.
- Install SSL on the public domain.
- Check firewall only exposes public ports.
- Read Nginx error log if proxy fails.
- Test the app through the public domain.
Where this applies
This model applies to n8n, Node.js apps, Python APIs, internal admin dashboards, Docker Compose stacks and webhook receivers.
When to Use This Checklist
Use this checklist when exposing Docker apps, n8n, APIs or internal services through Nginx and a public domain.
Required Tools
SSH access, Nginx, Docker or local app, domain, SSL, firewall, app port
Before You Start
Know the internal app port before editing Nginx. Do not expose internal service ports publicly unless necessary.
Structured Checklist Steps
- Identify public domain.
- Identify internal port.
- Confirm app is running.
- Create Nginx server block.
- Set proxy_pass.
- Add proxy headers.
- Install SSL.
- Restrict firewall.
- Read Nginx logs.
- Test public URL.
Verification Steps
- Public domain loads app.
- SSL works.
- Internal port is not unnecessarily exposed.
- Nginx logs show no proxy error.
- Webhook or dashboard works correctly.
Rollback Plan
If proxying fails, restore the previous server block and test the internal app directly on localhost or Docker network before changing Nginx again.
Common Mistakes
- Wrong internal port.
- Forgetting proxy headers.
- Exposing both Nginx and app port publicly.
- Installing SSL before DNS works.
- Debugging app code before checking proxy path.
Related Commands
docker ps
curl -I http://127.0.0.1:5678
sudo nginx -t
sudo systemctl reload nginx
sudo tail -n 100 /var/log/nginx/error.log
curl -I https://app.example.com