Project: Nginx + Tomcat

Introduction

This project puts Nginx on ports 80/443 (HTTP first) and Tomcat on 127.0.0.1:8080, serving a static SPA from disk and proxying /blog-api/ to your WAR. It combines Nginx reverse proxy Tomcat with Tomcat security into one VPS-style stack.

Prerequisites

• Project: Maven WAR Deploy or External docBase — /blog-api/posts works on loopback
• Nginx installed — Installing Nginx
• Linux VPS or WSL2 with sudo

Project Goals

  https://app.example.com/           →  Nginx static (SPA)
  https://app.example.com/blog-api/  →  Tomcat WAR
  Tomcat NOT on public 8080

Step 1: Harden Tomcat Connector

conf/server.xml:

<Connector port="8080" protocol="HTTP/1.1"
           address="127.0.0.1"
           connectionTimeout="20000"
           redirectPort="8443" />

Restart:

sudo systemctl restart tomcat
ss -tlnp | grep 8080    # 127.0.0.1:8080
curl http://127.0.0.1:8080/blog-api/posts

Step 2: Static Frontend

Step 3: Nginx Site Config

/etc/nginx/sites-available/hello-app:

Enable:

sudo ln -sf /etc/nginx/sites-available/hello-app /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

Local test without DNS:

curl -H "Host: app.example.com" http://127.0.0.1/
curl -H "Host: app.example.com" http://127.0.0.1/blog-api/posts

Step 4: Firewall

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw deny 8080/tcp
sudo ufw enable

Step 5: HTTPS (Production)

When DNS points to the server:

sudo apt install -y certbot python3-certbot-nginx
sudo certbot --nginx -d app.example.com

See Nginx HTTPS.

Step 6: Compare Static Strategies

Tomcat default servlet could serve static files from WAR—this project intentionally offloads static to Nginx.

Acceptance Checklist

• ss shows Tomcat on 127.0.0.1
  only
• Browser loads static page via Nginx
• fetch('/blog-api/posts') succeeds (same origin—no CORS)
• /var/log/nginx/hello-app.access.log shows requests
• Public 8080 blocked (if using ufw)

Troubleshooting

Next

Project: Spring Boot WAR