Nginx Web Server & Reverse Proxy
The directives everyone copies from a blog post and nobody can explain. Learn how nginx picks a server block, what the trailing slash in proxy_pass actually does, why alias is not root, and how upstreams fail over — remembered with spaced repetition.
- flashcards
- 52
- flashcards
- per day
- ~10 min
- per day
- level
- Beginner → Intermediate
- level
- modules
- 5
- modules
What this track is for
Almost every nginx config in production was copied from somewhere else. That works right up to the day a request lands in the wrong location block, a proxied path loses its prefix, or a redirect drops the query string — and then the config is unreadable, because nobody ever learned the rules it follows.
This track teaches those rules. nginx resolves a request in a fixed order: it picks a server block from listen and server_name, then matches a location by an explicit precedence in which an exact = match wins, ^~ can stop regex evaluation, and regexes are tried in file order. Directive inheritance follows its own rule — a nested block that sets add_header or proxy_set_header replaces the inherited set rather than adding to it, which is the single most common source of headers that mysteriously vanish.
From there the modules cover serving files (root versus alias, try_files, expires, gzip, sendfile), reverse proxying (proxy_pass with and without a URI, Host and X-Forwarded-For, buffering, timeouts, WebSocket upgrades), load balancing (round-robin, least_conn, ip_hash, weights, keepalive, backup and down — and which features need NGINX Plus rather than open-source nginx), and TLS with rate limiting. Every card is grounded in the official nginx documentation.
5 modules, seed to bloom
Each module is a set of flashcards — 52 in total. Answer, review, and watch your knowledge grow from seed to full bloom.
Config Model
http/server/location blocks, directives, contexts and inheritance
11 cardsServing Content
Static files, root/alias, index and try_files, MIME types and caching
11 cardsReverse Proxy
proxy_pass, forwarded headers, upstreams, timeouts and buffering
10 cardsLoad Balancing
Balancing methods, passive health checks, upstream keepalive and NGINX Plus limits
10 cardsTLS & Security
HTTPS certs, HTTP-to-HTTPS redirect, HSTS, rate limiting and access control
10 cardsSample questions
A taste of the real flashcards. Pick an answer, then reveal the explanation.
What does the ^~ modifier on a location do when it is the longest matching prefix?
- AIt stops nginx from checking regular-expression locations and uses this prefix location
- BIt forces nginx to check regular-expression locations first and prefer their result
- CIt makes the prefix comparison case-insensitive when tested against the request URI
- DIt marks the location as internal so only redirected requests are able to reach it
How does the alias directive differ from root when mapping a location to disk?
- Aalias replaces the matched location part of the URI with the alias path
- Balias appends the entire request URI to the alias path, exactly like root does
- Calias serves files only from memory, whereas root reads them from the disk
- Dalias works only inside regex locations, whereas root works in prefix ones
How does adding a URI part to proxy_pass (e.g. proxy_pass http://back/app/) affect the forwarded path?
- AThe part of the request URI matching the location is replaced by the proxy_pass URI
- BThe proxy_pass URI is appended to the full original request URI before it is sent
- CThe proxy_pass URI is ignored and the original request URI is always sent as-is
- DThe request is rejected because proxy_pass may not contain a URI component at all
What is the recommended way to redirect all HTTP traffic to HTTPS in nginx?
- AA port-80 server that runs return 301 https://$host$request_uri to the client
- BA port-80 server that runs rewrite ^ https://$host permanent without the path
- CA port-443 server with an if block that checks the scheme on every request
- DA global directive force_https on that upgrades every request automatically
Learn it once, keep it for good
Answer a question
Each card is one practical concept with multiple options. Pick what you think is right.
Get the full answer
See the correct option plus a clear explanation, and a link to deeper docs when one is available.
Review at the right time
A spaced-repetition engine (SM-2 or FSRS) resurfaces each card just before you would forget it.
Why this material is worth your time
Location matching stops being guesswork
Exact, prefix, ^~ and regex locations have a documented precedence. Once you know it, you can read a config top to bottom and predict which block wins.
The proxy_pass trailing slash, settled
A URI in proxy_pass replaces the matched location prefix; without one the path passes through untouched. It is one rule, and it explains most broken reverse proxies.
Inheritance you can reason about
Ordinary directives inherit downward, but add_header and proxy_set_header are replaced wholesale by a nested block. That asymmetry silently drops security headers.
Open-source limits stated honestly
Active health checks and session persistence are NGINX Plus features. Knowing where the free build stops saves you from configuring something that was never there.
Common questions
Is this about open-source nginx or NGINX Plus? +
Open-source nginx. The commercial build appears only where the difference matters — for example, active health checks and the sticky session methods are NGINX Plus features, and the cards say so rather than letting you assume otherwise.
Do I need to know HTTP first? +
Not strictly, but it helps. The cards assume you know what a request, a header and a status code are. If those are shaky, the HTTP & Networking track covers them and pairs well with this one.
Does it cover nginx as a Kubernetes Ingress controller? +
No. This track is the nginx server itself — its configuration model, proxying and TLS. Ingress resources and controllers belong to the Kubernetes tracks, though everything you learn here is what the controller ends up generating.
Is it free? +
Yes, completely free. No registration or credit card is required, and all your progress is stored locally in your browser.
Ready to actually read an nginx config?
Plant your first seed today. Ten minutes a day turns copied directives into a config you can defend.