How do you configure Nginx as an API gateway?

Expected Interview Answer

Step-by-Step Explanation

1. Step 1

   Define upstreams

   Create an upstream block per backend service, listing each service instance's host and port for load balancing.

2. Step 2

   Terminate TLS

   Configure a server block to listen on 443 with ssl_certificate and ssl_certificate_key so encryption is handled once at the edge.

3. Step 3

   Route by path

   Add location blocks matching URL prefixes (for example /users/ and /orders/) and forward each with proxy_pass to the matching upstream.

4. Step 4

   Set proxy headers

   Pass Host, X-Real-IP, and X-Forwarded-For so backends still see the original client details.

5. Step 5

   Apply rate limiting

   Define limit_req_zone and apply limit_req in the relevant locations to throttle abusive or excessive traffic.

6. Step 6

   Add auth and caching

   Optionally use auth_request to delegate authentication and proxy_cache to cache safe responses at the gateway.

Code Example

limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;

upstream users_service {
  server 10.0.0.11:8080;
  server 10.0.0.12:8080;
}

upstream orders_service {
  server 10.0.0.21:8080;
}

server {
  listen 443 ssl;
  server_name api.example.com;

  ssl_certificate     /etc/nginx/certs/api.crt;
  ssl_certificate_key /etc/nginx/certs/api.key;

  location /users/ {
    limit_req zone=api burst=20 nodelay;
    proxy_pass http://users_service;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  }

  location /orders/ {
    proxy_pass http://orders_service;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  }
}

Follow-up Questions

• How does an API gateway differ from a plain reverse proxy?
• How would you add authentication at the gateway with auth_request?
• How do you implement rate limiting per client with limit_req_zone?
• How can Nginx do canary or blue-green routing between service versions?
• What are the trade-offs of Nginx versus a dedicated gateway like Kong?