How to using nginx reverse proxy ssl guide

Securely expose your vLLM API, Open WebUI, AnythingLLM, or n8n to the internet with HTTPS. Uses nginx + Let's Encrypt (free SSL certificates).

Prerequisite: A domain name pointing to your server's public IP.

---

1. Why Use a Reverse Proxy?

Benefit	Description
HTTPS/SSL	Encrypt traffic; required for production
Clean URLs	https://api.yourdomain.com instead of http://ip:8000
Single entry point	Route multiple services through one domain
Security	Hide internal ports, add rate limiting, access control
Streaming support	Proper SSE/streaming for LLM token output

Services & Default Ports

Service	Internal Port	Suggested Subdomain
vLLM API	8000	api.yourdomain.com
Open WebUI	3000	chat.yourdomain.com
AnythingLLM	3001	docs.yourdomain.com
n8n	5678	n8n.yourdomain.com

---

2. DNS Setup

Point your domain(s) to the server's public IP. Create A records:

api.yourdomain.com    →  A  →  <your-server-public-ip>
chat.yourdomain.com   →  A  →  <your-server-public-ip>
docs.yourdomain.com   →  A  →  <your-server-public-ip>
n8n.yourdomain.com    →  A  →  <your-server-public-ip>

Verify DNS propagation:

dig +short api.yourdomain.com
# should return your server IP

---

3. Install nginx + Certbot

sudo apt update
sudo apt install -y nginx certbot python3-certbot-nginx

# Allow HTTP/HTTPS through firewall
sudo ufw allow 'Nginx Full'
sudo ufw allow OpenSSH

Verify nginx is running:

sudo systemctl status nginx

---

4. Reverse Proxy Configs

Create a config per service. The vLLM API config includes streaming support (critical for token-by-token output).

vLLM API — `/etc/nginx/sites-available/vllm-api`

server {
    listen 80;
    server_name api.yourdomain.com;

    # Large request bodies (long prompts)
    client_max_body_size 10M;

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Streaming (SSE) support — REQUIRED for LLM token streaming
        proxy_buffering off;
        proxy_cache off;
        proxy_set_header Connection '';
        chunked_transfer_encoding off;

        # Long generation timeouts
        proxy_read_timeout 300s;
        proxy_send_timeout 300s;
    }
}

Open WebUI — `/etc/nginx/sites-available/openwebui`

server {
    listen 80;
    server_name chat.yourdomain.com;
    client_max_body_size 50M;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket support (for live UI updates)
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_buffering off;
        proxy_read_timeout 300s;
    }
}

AnythingLLM — `/etc/nginx/sites-available/anythingllm`

server {
    listen 80;
    server_name docs.yourdomain.com;
    client_max_body_size 100M;     # large document uploads

    location / {
        proxy_pass http://127.0.0.1:3001;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 300s;
    }
}

n8n — `/etc/nginx/sites-available/n8n`

server {
    listen 80;
    server_name n8n.yourdomain.com;
    client_max_body_size 50M;

    location / {
        proxy_pass http://127.0.0.1:5678;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 300s;
    }
}

Enable Configs

# Enable each site
sudo ln -s /etc/nginx/sites-available/vllm-api /etc/nginx/sites-enabled/
sudo ln -s /etc/nginx/sites-available/openwebui /etc/nginx/sites-enabled/
sudo ln -s /etc/nginx/sites-available/anythingllm /etc/nginx/sites-enabled/
sudo ln -s /etc/nginx/sites-available/n8n /etc/nginx/sites-enabled/

# Test config
sudo nginx -t

# Reload
sudo systemctl reload nginx

---

5. Enable SSL with Let's Encrypt

Certbot automatically obtains certificates and modifies your nginx configs to use HTTPS.

# Get certificates for all domains at once
sudo certbot --nginx \
  -d api.yourdomain.com \
  -d chat.yourdomain.com \
  -d docs.yourdomain.com \
  -d n8n.yourdomain.com

Follow the prompts:

• Enter email (for renewal notices)

• Agree to terms

• Choose redirect HTTP → HTTPS (recommended)

Auto-Renewal

Certbot installs a renewal timer automatically. Verify:

sudo certbot renew --dry-run
sudo systemctl status certbot.timer

Certificates renew automatically before expiry (90-day certs, renewed at ~60 days).

Verify HTTPS

curl https://api.yourdomain.com/v1/models

---

6. Securing the API

Exposing an LLM API publicly invites abuse. Add these protections.

6.1 API Key (vLLM built-in)

Ensure vLLM runs with --api-key:

command: >
  --model ...
  --api-key sk-your-strong-secret-key

Clients must send: Authorization: Bearer sk-your-strong-secret-key

6.2 Rate Limiting (nginx)

Add to the top of /etc/nginx/nginx.conf inside the http {} block:

limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;

Then in the vLLM API location / block:

        limit_req zone=api_limit burst=20 nodelay;

6.3 IP Allowlist (Optional)

Restrict API access to specific IPs:

    location / {
        allow 203.0.113.0/24;    # your office/VPN range
        allow 198.51.100.5;       # specific IP
        deny all;
        proxy_pass http://127.0.0.1:8000;
        # ... rest of proxy config
    }

6.4 Basic Auth (extra layer)

sudo apt install -y apache2-utils
sudo htpasswd -c /etc/nginx/.htpasswd apiuser

In the location block:

        auth_basic "Restricted";
        auth_basic_user_file /etc/nginx/.htpasswd;

---

7. Troubleshooting

Certbot fails — "Could not connect"

• DNS not propagated yet: dig +short api.yourdomain.com

• Port 80 blocked: sudo ufw allow 'Nginx Full'

• nginx not running: sudo systemctl start nginx

502 Bad Gateway

• Backend service not running: docker compose ps

• Wrong port in proxy_pass: verify service port

• Test backend directly: curl http://127.0.0.1:8000/v1/models

Streaming/SSE not working (responses arrive all at once)

• Ensure proxy_buffering off; is set in the API config

• Confirm proxy_http_version 1.1;

"413 Request Entity Too Large"

• Increase client_max_body_size in the relevant config

WebSocket errors (Open WebUI / n8n)

• Ensure proxy_set_header Upgrade $http_upgrade; and Connection "upgrade"; are present

Certificate renewal issues

sudo certbot renew --dry-run
sudo nginx -t && sudo systemctl reload nginx

---

Quick Reference

# Test nginx config
sudo nginx -t

# Reload nginx
sudo systemctl reload nginx

# Get/renew SSL
sudo certbot --nginx -d yourdomain.com
sudo certbot renew --dry-run

# Check what's listening
sudo ss -tlnp | grep -E ':(80|443|8000|3000|3001|5678)'