NGINX and PM2 for Node.js

MODULE 32 · LESSON 32.4

Run a Node.js process behind a reverse proxy with explicit forwarding, timeouts, health checks and graceful shutdown.

Practice-firstBeginner-friendlyProduction-aware

From mental model to working change

Good work on NGINX and PM2 for Node.js leaves evidence: a visible behavior, a stable contract or a repeatable operational check. This lesson controls how a working change survives machines, environments, traffic and failure after it leaves a developer laptop.

Here, that decision supports a specific checkpoint: Package CourseFlow for a second CI platform, deploy it behind a reverse proxy, and write the evidence needed to operate or roll it back. A reviewable result should include a command transcript, CI result, deployment check and rollback note rather than a claim that the feature simply works.

NGINX and PM2 for Node.js workflowA four-step visual showing reverse proxy, process supervision, forwarded headers, graceful shutdown.NGINX and PM2 for Node.js workflow1Reverse Proxy2ProcessSupervision3Forwarded Headers4Graceful Shutdown

NGINX and PM2 for Node.js workflow

  1. 1Reverse Proxy
  2. 2Process Supervision
  3. 3Forwarded Headers
  4. 4Graceful Shutdown
NGINX and PM2 for Node.js workflow: a practical sequence used in this lesson.

A practical model for nginx and pm2 for node.js

Run a Node.js process behind a reverse proxy with explicit forwarding, timeouts, health checks and graceful shutdown. The useful unit of understanding is the boundary: who owns the decision, which input crosses it, what result is visible and how a failure is reported.

  • Reverse Proxy: Locate this responsibility in CourseFlow and defend the boundary you chose.
  • Process Supervision: Implement one behavior that another learner can reproduce without reading your mind.
  • Forwarded Headers: Compare the simplest correct approach with one credible alternative.
  • Graceful Shutdown: State the assumption this concept relies on and show how the system behaves when it is false.

Engineering decisions for NGINX and PM2 for Node.js

These are the details that separate a working demonstration from a maintainable production decision.

  • Restrict direct access to the application port and configure the framework's trusted-proxy boundary precisely.
  • Process supervision restarts crashes; it does not replace error monitoring, capacity limits or a safe deployment plan.
  • Terminate requests and close database connections gracefully before the supervisor's kill timeout.

Follow the data through the example

The sample is intentionally narrow. Its job is to expose reverse proxy without hiding the decision behind unrelated setup.

NGINX
server {
  listen 443 ssl;
  server_name api.example.test;

  location / {
    proxy_pass http://127.0.0.1:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_read_timeout 30s;
  }
}
Review it as someone else's change

Explain what the sample proves, what it does not prove, and which test would increase your confidence in process supervision.

Ship a reviewable increment

  1. 1
    Reverse Proxy

    Name the caller and the owner of this behavior before changing the implementation.

  2. 2
    Process Supervision

    Compare expected and actual output before editing; the difference tells you where to investigate.

  3. 3
    Forwarded Headers

    Keep names tied to the product rule so a reviewer can follow the change without decoding abbreviations.

  4. 4
    Graceful Shutdown

    Add a regression check close to the boundary where this behavior can fail.

Risks to catch during review

  • Treating reverse proxy as vocabulary instead of defining the behavior it must produce.
  • Testing the expected path while ignoring an empty, invalid, repeated or unauthorized case around process supervision.
  • Allowing forwarded headers to cross a boundary without an explicit contract or useful error.
  • Changing several layers before capturing the first piece of evidence, which makes the original cause harder to see.

A repeatable investigation sequence

  1. Reduce the problem to the smallest failing NGINX and PM2 for Node.js case.
  2. Capture the actual input and output at the reverse proxy boundary.
  3. Read the first relevant error, request, trace or query rather than the loudest downstream symptom.
  4. Test one explanation for the failure in process supervision; avoid changing two variables together.
  5. Keep a regression check that would expose the same defect if it returned.

Security decision

Use least privilege, protected secrets, reviewed dependencies and reversible changes. A deployment shortcut must never weaken the application boundary.

Performance decision

Establish a baseline, observe resource use and latency, and keep a rollback signal. Capacity changes without measurement are guesses.

PRACTICE

Build something you can inspect

Proxy a local API, verify the original protocol and client chain safely, then restart the app without dropping an in-flight health check.

Stretch challenge

Ask another person to run the exercise from your README. Fix the first place where their result differs from yours.

Definition of done

  • The behavior around reverse proxy works with realistic input.
  • A failure involving process supervision is handled clearly and without leaking sensitive detail.
  • The implementation remains keyboard-usable when it produces an interface.
  • Your evidence directly supports the claim made in the exercise.
  • The README records the important trade-off without pretending the solution is universal.

Check your reasoning

Why is trusting every X-Forwarded-For value dangerous when the application is reachable without the proxy?

Answer by naming the expected reverse proxy behavior, the layer responsible for it and the evidence that would confirm your explanation.

Where would you investigate the first failure?

Start where process supervision crosses a boundary. Compare the actual input and output there before following downstream symptoms.

What would make this work reviewable?

Show the focused change, repeatable steps, the result of your check and one honest trade-off connected to forwarded headers.

What to carry into the next lesson

  • Run a Node.js process behind a reverse proxy with explicit forwarding, timeouts, health checks and graceful shutdown.
  • Keep reverse proxy visible at the boundary where it can be tested.
  • Use evidence from process supervision before widening the implementation.

References and related reading

Progress is stored only in this browser.

Share this page

Share this page with the people who will use it next.

X Facebook LinkedIn WhatsApp Email

Discussion

No comments yet. Add the first useful question or observation.