Glossary

ACME — the protocol public certificate authorities (Let's Encrypt) use to issue certificates after you prove control of a domain. nginx consumes the result; a client like certbot runs the protocol.

alias — a location directive that maps the location to a directory by replacing the matched prefix. Its trailing-slash mismatch with location is the classic nginx trap.

autoindex — when on, a directory request without an index file returns a generated listing of the directory. Off by default; a listing is a disclosure.

Block — a directive whose value is braces holding more directives: server { ... }, location { ... }.

Context — where a directive sits in the nesting: main, events, http, server, location, upstream. Context decides what a directive may say and what it inherits.

Directive — one instruction in the config, ending in a semicolon (or a block, which is a directive with braces).

error_page — serves a chosen page (or redirect) for a status code, keeping the code: error_page 404 /404.html;.

limit_req — nginx's built-in rate limiter: a zone budgets requests per client, locations enforce it with optional burst.

location — the block that handles one slice of the URL space, chosen by the precedence rules: exact =, longest prefix, ^~, regexes in order, fallback prefix.

Master / worker — nginx is one master process (reads config, binds ports, supervises) and several worker processes that serve requests, normally as an unprivileged user.

prefix — the directory nginx treats as home (-p flag); relative paths in the config resolve against it. The lab runs its own instance under a lab prefix.

proxy_pass — forward matching requests to another server (or upstream pool) and relay the response: the reverse proxy in one directive.

proxy_set_header — set or replace a header on the request sent to the backend. How the visitor's real host, address, and scheme cross the proxy.

Reload — SIGHUP: the master re-reads the config and rolls workers gracefully; in-flight requests finish on the old workers. nginx -s reload or systemctl reload nginx.

Reverse proxy — a server that receives requests and forwards them to an app behind it, relaying responses — nginx's most common job.

rewrite — pattern-matching redirect/reserve: transform a path by regular expression, with permanent (301) or redirect (302) flags, or internally with no flag.

root — the directory the URL space maps onto; the whole request path is appended to it.

server block — one virtual host: a listen and a server_name, plus the locations under it.

try_files — try each candidate in order — file, directory — and fall back to a final URI or status: try_files $uri $uri/ =404;.

upstream — a named pool of backend servers that proxy_pass can target, with round-robin distribution and passive failover.

X-Forwarded-For — the header convention by which each proxy appends the real client's address, so the backend can know who actually asked.

502 Bad Gateway — nginx's report that the backend didn't answer: nginx is fine, the app isn't. The error log names the upstream and the failure.