Nginx Reverse Proxy

Instructions

Configure Nginx as a reverse proxy for containerized services using these patterns.

Server blocks and upstream routing:

• Define upstream blocks referencing Docker service names (e.g., upstream dify-api { server dify-api:5001; })
• Use proxy_pass with Docker Compose service names — Docker DNS resolves them automatically
• Set proxy_set_header Host $host, X-Real-IP $remote_addr, X-Forwarded-For $proxy_add_x_forwarded_for, X-Forwarded-Proto $scheme
• Use location blocks to route paths to different upstream services

CORS headers and preflight handling:

• Add Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers to responses
• Handle OPTIONS preflight requests with a dedicated if ($request_method = 'OPTIONS') block returning 204
• Set Access-Control-Max-Age to cache preflight responses (e.g., 86400 seconds)

File uploads and body size:

• Set client_max_body_size to accommodate file uploads (e.g., 15M for Dify document uploads)
• Configure proxy_read_timeout and proxy_send_timeout for large file transfers

SSL/TLS termination:

• Use Let’s Encrypt with certbot for certificate provisioning and auto-renewal
• Redirect HTTP (port 80) to HTTPS (port 443) with return 301 https://$host$request_uri
• Set ssl_protocols TLSv1.2 TLSv1.3 and strong cipher suites
• Include ssl_certificate and ssl_certificate_key directives pointing to certbot-managed certs

ITI Dify gateway pattern:

• Route /console/api, /api, /v1, /files to dify-api:5001
• Route / (default) to dify-web:3000
• Expose on port 3001 with listen 3001
• Apply CORS headers and client_max_body_size 15M globally