We moved a dozen small services from Nginx to Caddy and kept Nginx in front of two others. This is the honest comparison: automatic HTTPS, config side by side, what performance looked like, and the migration traps around headers, body limits and certificate storage.
Sign in with Google worked locally and on staging but failed in production with redirect_uri_mismatch. Behind the TLS proxy our FastAPI app built an http:// callback because Uvicorn did not trust the proxy's headers. How we traced and fixed it.
A proposal to split our Django monolith into 30 services landed on day one of planning. We said no, then spent 14 months extracting four services with a strangler fig: boundaries inside the monolith first, routing at the edge, shadow traffic, and data ownership moved last.
Our live support chat dropped every connection that stayed quiet for a minute, with close code 1006 and no server error. Nginx's 60-second proxy_read_timeout and the load balancer idle timeout were closing idle sockets. A heartbeat plus proxy tuning fixed it.
Our chat assistant streamed tokens smoothly on localhost but in production the whole answer appeared after 14 seconds. nginx was buffering the event stream and gzip was holding bytes. How we proved it with curl and fixed it without breaking other routes.
Our flash sales pushed traffic to eight times normal in under a minute, and autoscaling arrived five minutes late. This guide covers what actually kept us up: the right balancing algorithm, pre-scaling around known events, queues for deferrable work and shedding load on purpose.
Uploading a PDF larger than 1 MB failed with a vague error in our claims portal. Nginx returned 413, then PHP silently dropped files, then Laravel rejected them. Four layers each had their own size limit. Here is how we aligned them and tested every boundary.
Our PayPal checkout button rendered in development and staging but was an empty box in production. A new Content-Security-Policy set in Nginx blocked the PayPal SDK script, its iframes and its API calls. We fixed it per directive, with a nonce and a report-only rollout.
Moving our SPA from cookie auth to bearer tokens broke every API call with a CORS error. The Authorization header triggered an OPTIONS preflight, our nginx auth check rejected it, and error responses carried no CORS headers.
Minutes after we proxied our marketing site through Cloudflare, every visitor hit ERR_TOO_MANY_REDIRECTS. Cloudflare's Flexible mode spoke plain HTTP to an origin that redirected all HTTP to HTTPS. Full (strict) with an origin certificate ended the loop.
Our customer portal went dark at 07:12 when its Let's Encrypt certificate expired. Certbot's timer had run twice a day for a month and failed every time, because a firewall change blocked port 80. Here is how we traced it, fixed it and made expiry impossible to miss.
During a launch our nginx reverse proxy returned errors and logged worker_connections are not enough, at well under the expected capacity. Every proxied request holds a client and an upstream connection, and the file descriptor limit was lower still. How we sized it properly.
Our API certificate renewal looked perfect in desktop Chrome, yet the Android app, curl and a partner's Java service all rejected it. The server sent only the leaf certificate without the intermediate. Serving the full chain fixed every client at once.
A routine rolling deploy restarted one realtime pod holding 50,000 WebSocket connections. Every client reconnected within two seconds, the auth and history lookups melted, and the storm kept itself alive for 25 minutes. Here is how we drain sockets, pace reconnects and make resume cheap.
After moving our PHP app to a new Ubuntu 24.04 server, every page returned 502 Bad Gateway. Fixing socket ownership got us online, then traffic spikes brought the 502s back from an undersized FPM pool. Here is how we fixed both.