infra-routing-layer-selector

An API gateway centralizes crosscutting concerns like auth, rate limiting, and caching for client-to-backend request flows, whereas a load balancer primarily distributes traffic across instances using L4 or L7 health checks. A reverse proxy handles L7 routing and SSL termination, while a CDN caches static content at the network edge.

To decide which routing layers to use, map your capability requirements—such as SSL termination, L4 vs L7 routing, caching, auth, rate limiting, and health checks—to the minimal set of layers required. This prevents under-engineering and aligns your infrastructure to real traffic requirements.

SSL termination and rate limiting should live at specific infrastructure routing layers based on your microservices pattern. SSL termination typically happens at the CDN or reverse proxy layer, while rate limiting and auth are centralized at the API gateway to manage client-to-backend request flows effectively.

You need a CDN in addition to a load balancer and reverse proxy if your traffic routing requires edge caching for static assets and closer proximity to external clients. A CDN reduces backend load, while the load balancer and reverse proxy handle internal traffic distribution and L7 routing.

The best way to migrate from a single reverse proxy to a layered architecture is to follow a suggested migration path that diagrams the request flow. Map capabilities like auth and rate limiting to a new API gateway layer, scale with load balancers, and select appropriate tools like Nginx, Kong, or Traefik for your deployment scenario.

Nginx can be used for both L4 and L7 traffic routing, handling SSL termination and reverse proxy capabilities. However, for complex microservices deployment architectures requiring advanced crosscutting concerns like centralized auth and rate limiting, pairing it with a dedicated API gateway like Kong or Traefik may be recommended.