Set NGINX upload limits across every request layer
Client_max_body_size rejects oversized request bodies at NGINX, but application, framework, upstream proxy, and storage limits can reject at different sizes.
Understand NGINX location priority before adding another regex
NGINX first finds the longest prefix location and then evaluates regular expressions under documented rules, with exact and nested matches changing the search path.
Enable NGINX proxy cache only for responses with a safe identity key
Proxy_cache stores eligible upstream responses under a cache key; method, host, URI, arguments, authorization, cookies, and vary behavior determine whether two requests may share content.
Set NGINX proxy timeouts from phase-specific latency evidence
Proxy_connect_timeout covers upstream connection establishment while proxy_send_timeout and proxy_read_timeout apply between successive I/O operations, not one universal request deadline.
Add NGINX rate limiting without punishing every user behind one proxy
Limit_req tracks request rate by a chosen key in shared memory and applies burst and delay behavior; the key determines who shares a bucket.
Configure NGINX real client IP without trusting spoofed headers
The real IP module replaces the peer address only when the connection came from a trusted proxy range and the configured header contains the expected chain.
Log NGINX request and upstream timing without high-cardinality chaos
$request_time measures the full request while upstream timing variables expose connection, header, and response phases for one or more upstream attempts.
Test and reload NGINX without replacing healthy workers blindly
Nginx -t parses the complete active configuration, and a reload asks the master to start new workers before gracefully retiring the old generation.
Proxy WebSockets through NGINX with explicit upgrade handling
WebSocket upgrade is hop-by-hop, so NGINX must pass Upgrade and an appropriate Connection value while preserving long-lived connection behavior.
Use openssl s_client to test SNI, chain, and protocol explicitly
Openssl s_client opens a TLS connection and prints handshake evidence, but verification requires the correct hostname, trust store, return code, and application protocol context.