SL Silicon Lanes
Lesson 02 Infrastructure layer

Lesson 2 · Infrastructure layer

The client calls the reverse proxy, not the application server.

The client knows only localhost:7212. Nginx forwards requests to the hidden Catalog Service and can return a cached response without contacting it.

Stable entry point Origin hidden Response caching

Interactive architecture lab

Send the same request twice.

Compare a cache MISS with a cache HIT and watch whether the Catalog Service receives the request.

Known destination http://localhost:7212/api/products
You can run the same request in Postman.

Start the lesson, then execute a request through the proxy.

Execute a request to inspect the original response.
Execute a request to inspect the response headers.
Every request
Client-facing addresslocalhost:7212
forwards misses to
Hidden upstreamcatalogService1:6212
Response cache EMPTY No response stored
TTL 15s
Reverse Proxy log · URL / cache
Start the lesson to see Reverse Proxy requests.
Only on cache miss
Port :6212 The client never calls this address.
Catalog Service log · time / method / URL
Start the lesson to see Catalog Service requests.

Compare the two paths

Did the request reach the application server?

A HIT ends at Nginx. A MISS continues to the Catalog Service and PostgreSQL.

Latest cache result WAITING Execute the first request to begin.
Client requests0
Proxy requests0
Catalog requests0
Backend calls avoided0
  1. 1
    Start the lessonThe trace will show whether Nginx forwards or answers the request.

What this teaches

Add a reverse proxy in front of the service.

The next logical and meaningful improvement is to add a reverse proxy.

A reverse proxy is a server that sits in front of your application server. Clients send requests to the reverse proxy, and it forwards those requests to the appropriate backend server.

It can take over several request-related responsibilities:

  • SSL/TLS terminationThe proxy completes the HTTPS handshake and forwards a plain internal request to the application.
  • Encryption and decryptionThe proxy converts data between readable form and its protected network representation.
  • Compression and decompressionThe proxy can reduce response size before transfer and expand incoming compressed data.
  • Connection handlingThe proxy accepts, maintains, reuses, and closes external client connections.

A reverse proxy can also cache selected responses. If the same request arrives again, it can return the cached response without reaching the application server.

Origin shielding is another advantage: clients see only the reverse proxy address while the original application-server URL remains hidden. Blocking direct backend access reduces its public exposure and improves security.

This reduces backend load and lets the application server focus more on business logic.

What this gives us

  • One client-facing address
  • Application-server address remains hidden
  • Reduced public exposure: when direct backend access is blocked by network rules, clients can reach only the Reverse Proxy
  • Infrastructure work can move away from the application
  • Cacheable responses avoid backend work
  • Lower application-server load

What still remains

  • Only one Catalog Service instance
  • No load distribution
  • The Reverse Proxy may become a Single Point of Failure (SPOF)

The next design pressure

How do we scale the application server?

The proxy gives us one entry point, but every cache miss still reaches the same Catalog Service instance.

Next: distribute requests with an L7 Load Balancer →