Part 7 of the security fundamentals series. Firewalls, intrusion detection and prevention, VPNs and forward and reverse proxies compared by what they can see, what they can stop, where they sit, and the misconfigurations we find most often.
We moved a dozen small services from Nginx to Caddy and kept Nginx in front of two others. This is the honest comparison: automatic HTTPS, config side by side, what performance looked like, and the migration traps around headers, body limits and certificate storage.
Every POST to our Django admin returned 403 after we moved TLS termination to a Traefik ingress. Django compared the browser's https Origin with a request it believed was plain http. Two settings fixed it without weakening CSRF.
During a launch our nginx reverse proxy returned errors and logged worker_connections are not enough, at well under the expected capacity. Every proxied request holds a client and an upstream connection, and the file descriptor limit was lower still. How we sized it properly.