How to Deploy Nginx Reverse Proxy with Docker Containers

First, install the latest Docker Engine and Docker Compose. We'll use the official installation script for Docker 27.1.0+.

curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh
sudo usermod -aG docker $USER

Install Docker Compose v2.29.2:

sudo curl -SL https://github.com/docker/compose/releases/download/v2.29.2/docker-compose-linux-x86_64 -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose

Log out and back in to apply the docker group membership, then verify installation:

docker --version
docker-compose --version

Set up a clean directory structure for your reverse proxy configuration. This organization makes maintenance easier as you add more services.

mkdir -p ~/nginx-proxy/{config,ssl,logs}
cd ~/nginx-proxy

Create the main Docker Compose file that will orchestrate our reverse proxy setup:

touch docker-compose.yml

Verify the structure:

tree ~/nginx-proxy
# Should show:
# nginx-proxy/
# ├── config/
# ├── docker-compose.yml
# ├── logs/
# └── ssl/

Create the main Docker Compose configuration using the latest nginxproxy images. This setup provides automatic service discovery and SSL certificate management.

version: '3.8'

services:
  nginx-proxy:
    image: nginxproxy/nginx-proxy:1.3.0
    container_name: nginx-proxy
    restart: always
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - certs:/etc/nginx/certs
      - html:/usr/share/nginx/html
      - /var/run/docker.sock:/tmp/docker.sock:ro
      - ./config:/etc/nginx/conf.d
      - ./logs:/var/log/nginx
    environment:
      - DEFAULT_HOST=yourdomain.com
    networks:
      - nginx-reverse-proxy
    labels:
      - "com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy"

  acme-companion:
    image: nginxproxy/acme-companion:2.5.1
    container_name: nginx-proxy-acme
    restart: always
    depends_on:
      - nginx-proxy
    environment:
      - DEFAULT_EMAIL=your@email.com
      - NGINX_PROXY_CONTAINER=nginx-proxy
    volumes:
      - certs:/etc/nginx/certs
      - html:/usr/share/nginx/html
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - acme:/etc/acme.sh
    networks:
      - nginx-reverse-proxy

networks:
  nginx-reverse-proxy:
    driver: bridge

volumes:
  certs:
  html:
  acme:

Replace your@email.com with your actual email address for Let's Encrypt notifications. Start the proxy:

docker-compose up -d

Verify both containers are running:

docker-compose ps
# Should show nginx-proxy and nginx-proxy-acme as "Up"

Create a simple test application to verify our reverse proxy works correctly. We'll use a basic Node.js app that shows the container hostname.

Create a new directory for the test app:

mkdir ~/test-app && cd ~/test-app

Create a simple Node.js application:

// app.js
const express = require('express');
const os = require('os');
const app = express();
const PORT = 3000;

app.get('/', (req, res) => {
  res.json({
    message: 'Hello from reverse proxy!',
    hostname: os.hostname(),
    timestamp: new Date().toISOString(),
    headers: req.headers
  });
});

app.listen(PORT, '0.0.0.0', () => {
  console.log(`Server running on port ${PORT}`);
});

Create the Dockerfile:

FROM node:18-alpine
WORKDIR /app
RUN npm init -y && npm install express
COPY app.js .
EXPOSE 3000
CMD ["node", "app.js"]

Build and test the application:

docker build -t test-app .
docker run -d --name test-backend \
  --network nginx-proxy_nginx-reverse-proxy \
  -e VIRTUAL_HOST=app.yourdomain.com \
  -e LETSENCRYPT_HOST=app.yourdomain.com \
  -e VIRTUAL_PORT=3000 \
  test-app

Verify the backend is running and connected to the proxy network:

docker logs test-backend
docker network inspect nginx-proxy_nginx-reverse-proxy

Create custom Nginx configurations for advanced proxy settings like timeouts, buffer sizes, and security headers. This step is crucial for production deployments.

Create a custom configuration file in the config directory:

cd ~/nginx-proxy/config

Create proxy.conf with production-ready settings:

# proxy.conf
client_max_body_size 100M;
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
proxy_buffering on;
proxy_buffer_size 8k;
proxy_buffers 8 8k;
proxy_busy_buffers_size 16k;

# Security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" always;

# Real IP forwarding
set_real_ip_from 172.16.0.0/12;
set_real_ip_from 192.168.0.0/16;
set_real_ip_from 10.0.0.0/8;
real_ip_header X-Forwarded-For;
real_ip_recursive on;

Create gzip.conf for compression:

# gzip.conf
gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_comp_level 6;
gzip_types
    text/plain
    text/css
    text/xml
    text/javascript
    application/json
    application/javascript
    application/xml+rss
    application/atom+xml
    image/svg+xml;

Restart the proxy to apply the new configuration:

cd ~/nginx-proxy
docker-compose restart nginx-proxy

Verify the configuration is loaded without errors:

docker-compose logs nginx-proxy | grep -i error

Monitor SSL certificate status and renewal to prevent unexpected certificate expiration. The ACME companion handles renewal automatically, but monitoring ensures everything works correctly.

Check current certificate status:

docker exec nginx-proxy-acme /app/cert_status

Create a monitoring script to check certificate expiration:

#!/bin/bash
# cert-monitor.sh
DOMAINS=("app.yourdomain.com" "api.yourdomain.com")
WARN_DAYS=30

for domain in "${DOMAINS[@]}"; do
    expiry=$(docker exec nginx-proxy openssl x509 -in "/etc/nginx/certs/${domain}.crt" -noout -enddate 2>/dev/null | cut -d= -f2)
    if [ ! -z "$expiry" ]; then
        expiry_epoch=$(date -d "$expiry" +%s)
        current_epoch=$(date +%s)
        days_until_expiry=$(( (expiry_epoch - current_epoch) / 86400 ))
        
        if [ $days_until_expiry -lt $WARN_DAYS ]; then
            echo "WARNING: Certificate for $domain expires in $days_until_expiry days"
        else
            echo "OK: Certificate for $domain expires in $days_until_expiry days"
        fi
    else
        echo "ERROR: No certificate found for $domain"
    fi
done

Make the script executable and test it:

chmod +x cert-monitor.sh
./cert-monitor.sh

Add to crontab for daily monitoring:

echo "0 9 * * * /home/$(whoami)/nginx-proxy/cert-monitor.sh | logger -t cert-monitor" | crontab -

Verify the ACME companion is working by checking logs:

docker-compose logs acme-companion | tail -20

Demonstrate how to add multiple services behind the reverse proxy. This shows the real power of the automated proxy setup for microservices architecture.

Create a second test service (API backend):

mkdir ~/api-service && cd ~/api-service

Create a simple API service:

// api.js
const express = require('express');
const app = express();
const PORT = 4000;

app.get('/health', (req, res) => {
  res.json({ status: 'healthy', service: 'api', version: '1.0.0' });
});

app.get('/users', (req, res) => {
  res.json({
    users: [
      { id: 1, name: 'John Doe' },
      { id: 2, name: 'Jane Smith' }
    ]
  });
});

app.listen(PORT, '0.0.0.0', () => {
  console.log(`API service running on port ${PORT}`);
});

Create Dockerfile for the API service:

FROM node:18-alpine
WORKDIR /app
RUN npm init -y && npm install express
COPY api.js .
EXPOSE 4000
CMD ["node", "api.js"]

Build and deploy the API service:

docker build -t api-service .
docker run -d --name api-backend \
  --network nginx-proxy_nginx-reverse-proxy \
  -e VIRTUAL_HOST=api.yourdomain.com \
  -e LETSENCRYPT_HOST=api.yourdomain.com \
  -e VIRTUAL_PORT=4000 \
  api-service

Test both services through the proxy:

curl -H "Host: app.yourdomain.com" http://localhost/
curl -H "Host: api.yourdomain.com" http://localhost/health

Verify SSL certificates were automatically generated:

docker exec nginx-proxy ls -la /etc/nginx/certs/ | grep -E "(app|api).yourdomain.com"

Set up load balancing for high-availability services and implement health checks to ensure traffic only goes to healthy backends.

Create a load-balanced service with multiple instances:

cd ~/nginx-proxy

Add a load-balanced service configuration to your docker-compose.yml:

  web-app-1:
    image: test-app
    container_name: web-app-1
    environment:
      - VIRTUAL_HOST=lb.yourdomain.com
      - LETSENCRYPT_HOST=lb.yourdomain.com
      - VIRTUAL_PORT=3000
    networks:
      - nginx-reverse-proxy
    restart: unless-stopped

  web-app-2:
    image: test-app
    container_name: web-app-2
    environment:
      - VIRTUAL_HOST=lb.yourdomain.com
      - LETSENCRYPT_HOST=lb.yourdomain.com
      - VIRTUAL_PORT=3000
    networks:
      - nginx-reverse-proxy
    restart: unless-stopped

Create custom upstream configuration for health checks:

# config/lb.yourdomain.com_location
location /health {
    access_log off;
    return 200 "healthy\n";
    add_header Content-Type text/plain;
}

location / {
    proxy_pass http://lb.yourdomain.com;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    
    # Health check settings
    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
    proxy_connect_timeout 5s;
    proxy_send_timeout 10s;
    proxy_read_timeout 10s;
}

Deploy the load-balanced services:

docker-compose up -d web-app-1 web-app-2

Test load balancing by making multiple requests:

for i in {1..6}; do
  curl -s -H "Host: lb.yourdomain.com" http://localhost/ | jq .hostname
done

You should see requests distributed between different container hostnames, confirming load balancing is working.

Set up comprehensive monitoring and logging for your reverse proxy to track performance, errors, and security events.

Create a custom Nginx log format for better monitoring:

# config/log_format.conf
log_format proxy_log '$remote_addr - $remote_user [$time_local] '
                     '"$request" $status $body_bytes_sent '
                     '"$http_referer" "$http_user_agent" '
                     '$request_time $upstream_response_time '
                     '$upstream_addr $upstream_status';

access_log /var/log/nginx/access.log proxy_log;

Create a log rotation configuration:

# /etc/logrotate.d/nginx-proxy
~/nginx-proxy/logs/*.log {
    daily
    missingok
    rotate 52
    compress
    delaycompress
    notifempty
    create 644 root root
    postrotate
        docker exec nginx-proxy nginx -s reload
    endscript
}

Set up a simple monitoring script:

#!/bin/bash
# monitor-proxy.sh
LOG_FILE="~/nginx-proxy/logs/access.log"
ERROR_THRESHOLD=10
TIME_WINDOW="1 minute ago"

# Check for high error rates
ERROR_COUNT=$(grep -c " 5[0-9][0-9] " $LOG_FILE | tail -100)
if [ $ERROR_COUNT -gt $ERROR_THRESHOLD ]; then
    echo "HIGH ERROR RATE: $ERROR_COUNT 5xx errors detected"
fi

# Check proxy health
docker-compose ps | grep -q "Up" || echo "ALERT: Proxy containers not running"

# Check disk space for logs
DISK_USAGE=$(df ~/nginx-proxy/logs | tail -1 | awk '{print $5}' | sed 's/%//')
if [ $DISK_USAGE -gt 80 ]; then
    echo "WARNING: Log disk usage at ${DISK_USAGE}%"
fi

# Check certificate expiration
./cert-monitor.sh

Make the monitoring script executable and add to cron:

chmod +x monitor-proxy.sh
echo "*/5 * * * * /home/$(whoami)/nginx-proxy/monitor-proxy.sh" | crontab -

Test the complete setup by checking all services:

docker-compose ps
docker-compose logs --tail=50
curl -I https://app.yourdomain.com
curl -I https://api.yourdomain.com