How to Configure Nginx as a High-Performance HTTP/2 & HTTP/3 Reverse Proxy on Netcup

Ubuntu 24.04 LTS ships with Nginx 1.24+, and you can also use the official nginx.org mainline repository for Nginx 1.26/1.27 with full HTTP/3 QUIC support (ngx_http_v3_module). After installing nginx and certbot, your first systems engineering task is raising the worker file-descriptor limit (worker_rlimit_nofile) and configuring epoll event multiplexing in /etc/nginx/nginx.conf to match your Netcup server’s vCPU or dedicated EPYC core count.

Why is worker_rlimit_nofile 65535; mandatory on a reverse proxy? Every inbound client request proxied to a local backend container consumes two file descriptors inside the Nginx worker process: one socket for the external client connection on eth0 and a second socket for the loopback connection to 127.0.0.1:3000 (or an open file handle in /var/cache/nginx). Under the default Linux ceiling of 1024 open files per process, a 4-core server starts logging socket() failed (24: Too many open files) at fewer than 2,000 concurrent connections.

On multi-core AMD EPYC Netcup instances, you should also ensure sendfile on;, tcp_nopush on;, and tcp_nodelay on; are active inside the global http block. sendfile instructs the Linux kernel to copy static assets directly from the filesystem page cache to the virtio-net NIC ring buffer via DMA without copying bytes into Nginx user space, while tcp_nopush packs HTTP response headers and the first payload chunk into a single full MTU frame.

To protect backend application workers against credential-stuffing bots and Layer-7 floods, we also define a 10 MB shared-memory rate-limiting zone (limit_req_zone $binary_remote_addr zone=api_limit:10m rate=15r/s;) inside /etc/nginx/conf.d/00-netcup-tuning.conf. Because $binary_remote_addr stores IPv4 addresses in 4 bytes and IPv6 addresses in 16 bytes, a 10 MB zone tracks roughly 160,000 unique visitor IPs in RAM with zero disk I/O.

sudo apt update
sudo apt install -y nginx certbot python3-certbot-nginx

# Verify Nginx version and compiled modules (TLS 1.3, HTTP/2, HTTP/3, RealIP)
nginx -V 2>&1 | tr ' ' '\n' | grep -E "http_v2|http_v3|realip|ssl"

--with-http_ssl_module
--with-http_v2_module
--with-http_v3_module
--with-http_realip_module

# Hide Nginx version number in HTTP response headers and error pages
server_tokens off;

# Connection upgrade map for seamless WebSocket (wss://) proxying
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

# Per-IP Rate Limiting Zone: 10 MB shared memory (~160,000 IP states), 15 req/sec baseline
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=15r/s;
limit_req_status 429;

# Upload size ceiling & keepalive timeouts
client_max_body_size 64M;
keepalive_timeout 65;
types_hash_max_size 4096;

Many tutorials show a naive proxy_pass http://127.0.0.1:3000; inside location / without an upstream keepalive pool. Because Nginx defaults to HTTP/1.0 with Connection: close for upstream requests, omitting a keepalive pool forces the Linux kernel to perform a full TCP three-way handshake and four-way teardown on lo (127.0.0.1) for every single HTTP request. Under sustained traffic, this fills the kernel’s TIME_WAIT table, exhausts the ephemeral port range (net.ipv4.ip_local_port_range), and triggers intermittent 502 Bad Gateway (99: Cannot assign requested address) errors.

Defining an upstream app_backend block with keepalive 32; instructs each Nginx worker process to maintain a pool of up to 32 idle, pre-connected HTTP/1.1 sockets to your local Docker container or Node.js/Go backend. When combined with proxy_http_version 1.1; and our $connection_upgrade map, Nginx reuses persistent upstream TCP sockets for normal HTTP requests while seamlessly upgrading to bidirectional wss:// tunnels whenever a client sends an Upgrade: websocket header.

For TLS termination, the configuration below enforces Mozilla’s Modern/Intermediate hybrid cipher profile (TLSv1.2 and TLSv1.3), allocates a 10 MB shared SSL session cache across all worker processes (ssl_session_cache shared:SSL:10m;, storing ~40,000 resumed sessions), and sets ssl_session_tickets off; to preserve strict Forward Secrecy. Note that if you experiment with TLS 1.3 zero-round-trip resumption (ssl_early_data on;), you must pass proxy_set_header Early-Data $ssl_early_data; to your backend so non-idempotent POST requests are protected against 0-RTT replay attacks.

Finally, modern web frameworks (including Next.js Auth.js, Keycloak, Laravel, and OAuth2 OIDC gateways) frequently emit large Set-Cookie JWT payloads or Content-Security-Policy headers that exceed Nginx’s default 4 KB buffer (upstream sent too big header while reading response header from upstream). Setting proxy_buffer_size 32k; and proxy_buffers 16 16k; eliminates header overflow 502 errors.

upstream app_backend {
    server 127.0.0.1:3000 max_fails=3 fail_timeout=10s;
    keepalive 32;
}

server {
    listen 80;
    listen [::]:80;
    server_name app.example.com;

    # Allow ACME HTTP-01 challenge verification, redirect everything else to HTTPS
    location /.well-known/acme-challenge/ {
        root /var/www/html;
    }
    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;

    server_name app.example.com;

    # TLS Certificates (Managed by Certbot in Step 3)
    ssl_certificate     /etc/letsencrypt/live/app.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/app.example.com/privkey.pem;

    # Modern Mozilla TLS 1.2 / 1.3 Cipher Suite Configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;

    # Hardened Security Headers
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Primary Application & WebSocket Reverse Proxy
    location / {
        limit_req zone=api_limit burst=30 nodelay;

        proxy_pass http://app_backend;
        proxy_http_version 1.1;

        # Support both keepalive pooling and WebSocket upgrades
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        # Forward original client metadata to backend
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;

        # Proxy Buffer & Timeout Tuning
        proxy_buffering on;
        proxy_buffers 16 16k;
        proxy_buffer_size 32k;
        proxy_connect_timeout 10s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }
}

Before activating the HTTPS server block above (which references /etc/letsencrypt/live/app.example.com/fullchain.pem), bootstrap your certificate using certbot --nginx or certbot certonly --webroot. Make sure both listen 80; and listen [::]:80; are present in your HTTP server block: when a domain has an AAAA IPv6 record pointing to Netcup, Let’s Encrypt’s ACME validation authority connects over IPv6 first and will fail with Timeout during connect if Nginx only listens on IPv4.

Whenever you modify /etc/nginx/sites-available/*.conf or rotate TLS certificates in production, always run sudo nginx -t && sudo systemctl reload nginx rather than systemctl restart nginx. A reload sends SIGHUP to the master process, which parses the new configuration first (aborting safely without downtime if a typo exists), spawns a fresh generation of worker processes, and lets old workers finish in-flight HTTP and WebSocket requests before exiting.

If your Nginx build includes ngx_http_v3_module (standard in Nginx 1.25+ mainline and Ubuntu 24.04 updates), you can also enable HTTP/3 (QUIC) over UDP port 443 by adding listen 443 quic reuseport; and listen [::]:443 quic reuseport; to your primary default virtual host along with add_header Alt-Svc 'h3=":443"; ma=86400' always;. Remember that the kernel socket option reuseport must be declared on only one server block per IP/port pair across your entire Nginx configuration, and UDP port 443 (443/udp) must be allowed in both UFW and the Netcup SCP Firewall.

Finally, verify that Ubuntu’s certbot.timer systemd unit is active and execute sudo certbot renew --dry-run. The timer runs twice daily with a randomized delay, renewing certificates automatically 30 days prior to expiration and triggering a graceful Nginx reload hook.

# 1. Issue certificate via Certbot
sudo certbot --nginx -d app.example.com --non-interactive --agree-tos -m admin@example.com --redirect

# 2. Enable symlink, test Nginx configuration syntax, and hot-reload workers
sudo ln -sf /etc/nginx/sites-available/app.example.com.conf /etc/nginx/sites-enabled/
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t && sudo systemctl reload nginx

# 3. Verify Certbot's twice-daily systemd renewal timer and run a dry-run test
sudo systemctl status certbot.timer --no-pager
sudo certbot renew --dry-run

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
Congratulations, all simulated renewals succeeded