Nginx reverse proxy for a Java application

Why put Nginx in front

• HTTPS certificates are simple to get and renew automatically.
• Nginx serves static files and slow clients cheaply, so your threads stay free.
• The application port is closed to the internet, which reduces attack surface.
• You can run several applications behind different hostnames on ports 80 and 443.

A server block

# /etc/nginx/sites-available/app
server {
    listen 80;
    server_name example.com www.example.com;
    client_max_body_size 50m;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 120s;
    }
}

sudo ln -s /etc/nginx/sites-available/app /etc/nginx/sites-enabled/app
sudo nginx -t && sudo systemctl reload nginx

Free SSL

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com

Certbot edits the server block, adds HTTPS and sets up automatic renewal.

Tell the application it is behind a proxy

Without this, your application thinks every request is plain HTTP from 127.0.0.1, and redirects and generated links go wrong.

• Spring Boot: SERVER_FORWARD_HEADERS_STRATEGY=native, or framework to let Spring handle the headers.
• Tomcat: add the RemoteIpValve to the Host in server.xml.
• WildFly: enable proxy-address-forwarding on the HTTP listener. Our setup does this for you.

WebSockets

proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";

Close the application port

Bind Java to 127.0.0.1 and allow only ports 22, 80 and 443 in the firewall. Our servers are built this way.

Last updated October 29, 2026.