Nginx as a Reverse Proxy for Flask: Configuration, SSL, and Performance

Never expose Flask (Gunicorn) directly to the internet. Nginx acts as the production-grade reverse proxy that handles SSL, serves static files at wire speed, buffers slow clients, and load balances across multiple Gunicorn workers—all things Flask wasn't designed to do.

Complete Nginx Configuration for Flask

server {
    listen 80;
    server_name mirahlabs.com www.mirahlabs.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name mirahlabs.com;

    ssl_certificate /etc/letsencrypt/live/mirahlabs.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mirahlabs.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;

    # Security headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
    add_header Referrer-Policy "strict-origin-when-cross-origin";

    # Serve static files directly (bypasses Flask entirely)
    location /static/ {
        alias /var/www/mirahlabs/frontend/static/;
        expires 30d;
        add_header Cache-Control "public, no-transform";
        gzip_static on;
    }

    # Proxy to Gunicorn
    location / {
        proxy_pass http://127.0.0.1:5001;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 90;
        proxy_connect_timeout 10;
        client_max_body_size 10M;
    }
}

Gunicorn Workers Configuration

# gunicorn.conf.py
workers = (2 * cpu_count()) + 1  # Rule of thumb for I/O-bound apps
worker_class = "gevent"           # Async workers for better concurrency
timeout = 120
keepalive = 5
accesslog = "/var/log/gunicorn/access.log"
errorlog = "/var/log/gunicorn/error.log"

Let's Encrypt SSL with Certbot

certbot --nginx -d mirahlabs.com -d www.mirahlabs.com
# Auto-renewal via cron
echo "0 12 * * * /usr/bin/certbot renew --quiet" >> /etc/crontab

Production Application Telemetry Wrapper

Here is an enterprise-grade telemetry decorator in Python to measure execution latency, record counts, and catch pipeline boundaries:

import time
import logging
from functools import wraps

logging.basicConfig(level=logging.INFO)
logger = logging.getLogger("MirahLabs.Telemetry")

def monitor_performance(operation_name: str):
    def decorator(func):
        @wraps(func)
        def wrapper(*args, **kwargs):
            t0 = time.perf_counter()
            try:
                res = func(*args, **kwargs)
                dt = time.perf_counter() - t0
                logger.info(f"{operation_name} succeeded in {dt:.4f}s")
                return res
            except Exception as e:
                dt = time.perf_counter() - t0
                logger.error(f"{operation_name} failed after {dt:.4f}s: {str(e)}")
                raise e
        return wrapper
    return decorator

Cloud Infrastructure Performance Profile

Below is a comparative latency and throughput profile of this infrastructure pattern deployed under a simulated load of 10,000 concurrent requests:

US & UK Compliance and Data Governance

Modern applications operating across US and UK regions must establish comprehensive data governance frameworks. This includes meeting the security baselines of the US NIST Cybersecurity Framework and the UK Cyber Essentials certification. Enforcing encryption at rest and in transit, keeping audit logs, and maintaining a clear incident response plan are essential to comply with both CCPA and UK GDPR regulations.