Reverse Proxy Setup for AEM Publish Instances with NGINX
Adobe Experience Manager powers digital experiences for some of Australia's largest banks, telcos and government agencies, from the customer portals of Westpac and ANZ in Sydney to the marketing sites run by Telstra and Optus in Melbourne. Putting NGINX in front of the AEM Publish tier is now the de facto pattern for teams that want predictable performance under the weight of campaign-day traffic, particularly when Black Friday, EOFY sales or the Melbourne Cup surge arrives all at once.
This article walks through the technical foundations of a reverse proxy configuration for AEM Publish instances, covering TLS termination, caching coordination with the AEM Dispatcher, load balancing across multiple publishers, and the security headers that help meet the Australian Cyber Security Centre's Essential Eight expectations. For a deeper look at the broader AEM ecosystem, the CIRCUIT event archive hosts session recordings from previous years.
Why Australian AEM Deployments Benefit from a Reverse Proxy
AEM Publish is a Java application server, typically running on an Apache Felix OSGi container, that responds to HTTP requests for rendered content. Sitting a reverse proxy in front offers several practical wins. It absorbs TLS handshake overhead, hides the JVM ports from the public internet, lets you terminate and renew certificates through ACME clients like Let's Encrypt, and provides a clean layer for HTTP/2, gzip or Brotli compression. For Australian teams hosting in the AWS Sydney region or on NextDC's S3 data centres, this separation also keeps AEM-specific patches from bleeding into edge infrastructure changes.
Reverse proxies also smooth the path to compliance. APRA-regulated banks and federal agencies that use AEM for customer-facing applications often need to demonstrate strict transport security, request filtering and audit logging. NGINX logs every transaction with millisecond precision and supports structured logging that pipes straight into Splunk, Elastic or a sovereign SIEM running out of a Canberra colocation facility. The proxy becomes the single chokepoint where rate limiting, IP allow-listing and bot mitigation are enforced before traffic ever reaches the AEM Publish farm.
Core Architecture: NGINX in Front of AEM Publish
The reference topology places NGINX on a pair of Linux hosts, typically Rocky Linux or Ubuntu LTS, in the public-facing DMZ. Behind it sits a load balancer such as F5 or AWS ALB that distributes requests across two or more AEM Publish instances, each running on its own VM or container. The Dispatcher module, AEM's own caching and filtering layer, runs inside or alongside the publish instance and writes cached responses to a shared filesystem such as EFS or NFS, or to a local SSD replicated across nodes.
In a standard nginx.conf file, the upstream block declares the publish servers while the server block listens on 443 and proxies requests upstream. The proxy_set_header directives preserve the original client IP through the X-Forwarded-For header so that AEM's analytics and personalisation engine see the real visitor rather than the proxy address. Australian teams running multi-region setups often duplicate this stack in Sydney and Melbourne, then use GeoDNS to route New Zealand and Pacific Island visitors to the closest node.
| Reverse Proxy | TLS Termination | Dynamic Config Reload | Built-in Caching | Dispatcher Awareness | Licence Cost |
|---|---|---|---|---|---|
| NGINX Open Source | Strong, OpenSSL 3.x | Yes, via reload signal | Yes, proxy_cache | Manual via cache purger | Free |
| NGINX Plus | Strong, dynamic cert rotation | Yes, API-driven | Yes, active health checks | Metrics to Prometheus | Paid, per instance |
| Apache HTTP Server | Strong, mod_ssl | Yes, graceful restart | Yes, mod_cache | Mature, widely used | Free |
| HAProxy | Strong, SSL frontend | Yes, Runtime API | Limited, mostly static | No native integration | Free / Enterprise |
NGINX Plus earns its licence fee in larger Australian deployments where live activity monitoring and on-the-fly upstream membership changes keep AEM publishers patched without dropping user sessions. Smaller teams running a handful of publishers generally find Open Source NGINX more than adequate.
SSL Termination and TLS Hardening
Terminating TLS at NGINX keeps the certificate lifecycle out of AEM's Java keystore. Certbot running on a cron schedule in the AEDT-friendly UTC offset pulls a fresh certificate from Let's Encrypt, drops it into /etc/nginx/ssl/, and triggers an nginx -s reload. The Mozilla SSL Configuration Generator offers a sensible baseline that disables TLS 1.0 and 1.1, prefers TLS 1.3, and sets a modern cipher list anchored on ECDHE keys.
A couple of gotchas matter locally. Australian ISPs such as Aussie Broadband, TPG and Telstra Wholesale occasionally negotiate middlebox behaviour that strips QUIC or interferes with HTTP/2 streams, so it pays to test from a residential connection in Brisbane or Perth before rolling out. Geo-restricted content for state government sites in Victoria and Queensland may need separate server blocks with allow and deny rules based on the MaxMind GeoIP2 database, refreshed monthly.
Caching Strategies and Dispatcher Coordination
NGINX can cache rendered HTML itself, but most AEM architects prefer to let the Dispatcher own that responsibility. The proxy still caches static assets, namely CSS, JavaScript bundles, fonts and the small handful of icons in the AEM Sites UI. Setting a long max-age on these files lets the origin AEM Publish instance breathe, which matters during a marketing campaign launched at 9 a.m. AEST when every Australian online shopper refreshes the same landing page simultaneously.
Cache invalidation flows from AEM back to NGINX through a small flush script. When a content author publishes a page, the AEM replication agent fires an HTTP call to a protected endpoint on the NGINX host, which runs a Lua script that deletes the matching paths from the proxy_cache directory. The whole loop typically completes in under a second, and AEM's own Dispatcher cache invalidation runs in parallel.
Load Balancing and High Availability
NGINX's upstream block supports several load-balancing algorithms. Round-robin is the safe default for identical AEM Publish instances. Least-conn is helpful when content is unevenly heavy, such as a long-form editorial feature in a publisher's AEM-powered CMS that holds connections much longer than a brochure page. ip_hash gives session stickiness for sites that have not externalised session state to Redis or a database, although AEM's stateless rendering model means this is rarely needed.
Active health checks, available in NGINX Plus and in the open source nginx-upsync-module builds, probe a lightweight health endpoint on each publisher every few seconds. A failed probe removes the node from the rotation within one health-check interval, so a JVM crash in a Melbourne data centre no longer takes the entire site offline. Combined with an AWS Auto Scaling group or a similar mechanism on Azure Australian East, the publisher fleet grows and shrinks to match demand during the Boxing Day rush or the AFL Grand Final spike.
Security Headers, CORS and Local Compliance
Once TLS is terminated, NGINX is the right place to add response headers that harden the application. Strict-Transport-Security with a long max-age, X-Content-Type-Options nosniff, X-Frame-Options DENY and a Content-Security-Policy that whitelists the Adobe Tag Manager and Launch domains all stop common browser-side attacks before they reach AEM. Referrer-Policy strict-origin-when-cross-origin protects analytics integrity.
CORS handling deserves special care when AEM Content Fragments are consumed by a React Native app built by a Sydney mobile studio, or by a separate microservice running on Kubernetes. NGINX can short-circuit preflight OPTIONS requests without forwarding them to AEM, saving the Java container from dealing with headers it does not understand. For government clients subject to the Protective Security Policy Framework, a WAF such as ModSecurity running as a side module on the same NGINX host filters injection attempts and provides the audit trail that auditors expect.
Practical Steps for a Production-Ready Reverse Proxy
- Pin NGINX to a current mainline or stable build and subscribe to the nginx-announce list so patch releases land promptly.
- Keep the proxy configuration under version control in a Git repository, with peer review through pull requests before any reload.
- Automate certificate renewal with Certbot and a deploy hook that performs nginx -t before reload to catch syntax errors early.
- Add a Prometheus exporter for NGINX, then graph cache hit ratio, active connections and upstream response times on a Grafana dashboard shared with the on-call team.
- Run synthetic monitoring probes from a Trans-Tasman perspective (Auckland plus Sydney) so trans-Pacific latency regressions surface quickly.
A well-tuned NGINX layer transforms AEM Publish from a single-purpose Java application into a resilient, observable, secure content platform that scales to meet the demands of Australian audiences. Engineers who want to deepen their AEM craft can browse the agenda and reserve a seat through the registration portal for the next instalment of the conference, where these reverse-proxy patterns are explored in hands-on workshops.