API Gateway Architecture Explained: nginx, Load Balancers, and NestJS Request Flow

An API gateway is the front door to your backend. Instead of exposing every NestJS microservice to the internet, clients call one hostname. The gateway authenticates (often via JWT from Keycloak), routes to the right service, and enforces cross-cutting policies — rate limits, request logging, and protocol translation.

Around that gateway sit load balancers and often nginx as a reverse proxy or Ingress. Understanding the full hop-by-hop path is what turns “it works on my laptop” into a production architecture.

End-to-end request flow

1. Browser or mobile app calls `https://api.example.com/...`.
2. DNS points to a cloud load balancer (or Kubernetes LoadBalancer / Ingress IP).
3. TLS is terminated at the LB or at nginx/Ingress.
4. nginx reverse-proxies to the NestJS API gateway Service/Pods.
5. Gateway validates the bearer token, applies routes (e.g. `/orders` → order service).
6. Domain service executes business logic and returns; gateway relays the response.

API gateway vs nginx reverse proxy

• nginx excels at TLS, HTTP routing, buffering, and static edge concerns
• API gateway (NestJS or dedicated product) owns authZ/authN integration, domain routing, and app-level policies
• Many stacks use both: nginx at the edge, NestJS gateway as the application entry service

What belongs in a NestJS API gateway

• JWT validation against Keycloak / OIDC issuer
• Route tables to order, catalog, tenant, billing services
• Correlation IDs and structured request logs
• Coarse rate limiting and payload size guards
• Health endpoints for Kubernetes probes

Keep business rules in domain services. The gateway should be a disciplined doorman — not a second monolith.

Load balancing basics

A load balancer spreads connections across healthy gateway replicas so one Pod crash does not take the API down. In Kubernetes, that is often a cloud LB or Ingress controller distributing to Pods selected by a Service. Pair it with readiness probes so traffic only hits NestJS instances that finished bootstrapping Keycloak JWKS and DB connections.

Ready to explore packaged gateway architectures? Visit cyberinfoware.com or contact the team.