gRPC proxying in Nginx - Step-by-Step Execution

Process Flow - gRPC proxying

Client sends gRPC request

↓

Nginx receives request

↓

Nginx checks grpc_pass config

↓

Nginx forwards request to gRPC backend

↓

Backend processes request

↓

Backend sends gRPC response

↓

Nginx forwards response to client

↓

Client receives response

This flow shows how Nginx receives a gRPC request, forwards it to the backend server using grpc_pass, and then sends the backend's response back to the client.

Execution Sample

Nginx

server {
    listen 50051 http2;
    location / {
        grpc_pass grpc://localhost:60051;
    }
}

Nginx listens on port 50051 for gRPC requests and proxies them to a backend gRPC server on localhost port 60051.

Process Table

Step	Action	Nginx State	Backend State	Client State
1	Client sends gRPC request to Nginx on port 50051	Waiting for request	Idle	Request sent
2	Nginx receives gRPC request	Received request	Idle	Request sent
3	Nginx checks grpc_pass directive	Preparing to proxy	Idle	Request sent
4	Nginx forwards request to backend at localhost:60051	Request forwarded	Received request	Request sent
5	Backend processes gRPC request	Request forwarded	Processing request	Request sent
6	Backend sends gRPC response to Nginx	Waiting response	Response sent	Request sent
7	Nginx receives response and forwards to client	Response forwarded	Response sent	Response received
8	Client receives gRPC response	Idle	Idle	Response received

💡 Client receives response, completing the gRPC proxy cycle.

Status Tracker

Variable	Start	After Step 2	After Step 4	After Step 6	Final
Nginx State	Waiting for request	Received request	Request forwarded	Waiting response	Idle
Backend State	Idle	Idle	Received request	Response sent	Idle
Client State	Request not sent	Request sent	Request sent	Request sent	Response received

Key Moments - 3 Insights

Why does Nginx need the 'http2' parameter in the listen directive?

Because gRPC uses HTTP/2 protocol, Nginx must listen with 'http2' enabled to properly receive and proxy gRPC requests, as shown in step 1 and 2 of the execution_table.

What happens if the grpc_pass directive points to the wrong backend address?

Nginx will fail to forward the request properly, causing the client to not receive a valid response. This would be evident as Nginx state stuck at 'Preparing to proxy' or 'Request forwarded' without backend processing in steps 3-5.

Does Nginx modify the gRPC request or response during proxying?

No, Nginx acts as a transparent proxy forwarding the gRPC messages unchanged, as seen by the direct forwarding actions in steps 4 and 7.

Visual Quiz - 3 Questions

Look at the execution table, what is the Nginx state at step 5?

A Request forwarded

B Waiting for request

C Response forwarded

D Idle

💡 Hint

Check the 'Nginx State' column at step 5 in the execution_table.

At which step does the backend send the gRPC response to Nginx?

A Step 4

B Step 6

C Step 7

D Step 8

💡 Hint

Look for the action mentioning backend sending response in the execution_table.

If the client never sends a request, what would be Nginx's state after step 1?

A Received request

B Idle

C Waiting for request

D Request forwarded

💡 Hint

Refer to the initial Nginx state before receiving any request in variable_tracker.

Concept Snapshot

Nginx gRPC proxying setup:
- Listen with 'http2' for gRPC support
- Use 'grpc_pass' to forward requests to backend
- Nginx forwards requests and responses transparently
- Backend processes gRPC calls normally
- Client communicates via Nginx proxy without changes

Full Transcript

This visual execution shows how Nginx proxies gRPC requests. The client sends a gRPC request to Nginx listening on port 50051 with HTTP/2 enabled. Nginx receives the request and uses the grpc_pass directive to forward it to the backend gRPC server at localhost port 60051. The backend processes the request and sends a response back to Nginx. Nginx then forwards this response to the client. The states of Nginx, backend, and client change step-by-step to reflect this flow. Key points include the need for HTTP/2 in Nginx, correct backend address in grpc_pass, and that Nginx acts as a transparent proxy without modifying messages.

Practice

1. What directive in nginx is used to forward gRPC requests to a backend server?

easy

A. fastcgi_pass

B. proxy_pass

C. grpc_pass

D. uwsgi_pass

Solution

1. Step 1: Understand gRPC proxying in nginx

   nginx uses a special directive to forward gRPC calls to backend servers.

2. Step 2: Identify the correct directive

   The directive grpc_pass is specifically designed for gRPC proxying, unlike proxy_pass which is for HTTP, or others for different protocols.

3. Final Answer:

   grpc_pass -> Option C

4. Quick Check:

   gRPC forwarding uses grpc_pass [OK]

Hint: gRPC proxying always uses grpc_pass directive [OK]

Common Mistakes:

• Confusing grpc_pass with proxy_pass
• Using fastcgi_pass for gRPC
• Not enabling HTTP/2 for gRPC

2. Which of the following is the correct syntax to proxy gRPC traffic to a backend at 127.0.0.1:50051 in nginx?

easy

A. grpc_pass grpc://127.0.0.1:50051;

B. grpc_pass http://127.0.0.1:50051;

C. proxy_pass grpc://127.0.0.1:50051;

D. proxy_pass http://127.0.0.1:50051;

Solution

1. Step 1: Recognize correct protocol prefix for grpc_pass

   The grpc_pass directive requires the backend address to start with grpc:// or grpcs:// for secure connections.

2. Step 2: Match syntax with correct directive and protocol

   grpc_pass grpc://127.0.0.1:50051; uses grpc_pass grpc://127.0.0.1:50051; which is the correct syntax. Options A and D use http:// which is incorrect for gRPC. proxy_pass grpc://127.0.0.1:50051; uses proxy_pass which is not for gRPC.

3. Final Answer:

   grpc_pass grpc://127.0.0.1:50051; -> Option A

4. Quick Check:

   grpc_pass + grpc:// = correct syntax [OK]

Hint: Use grpc_pass with grpc:// for gRPC backend URLs [OK]

Common Mistakes:

• Using proxy_pass instead of grpc_pass
• Using http:// instead of grpc://
• Omitting the semicolon at the end

3. Given this nginx snippet inside a server block:

location /grpc {
  grpc_pass grpc://backend:9000;
  error_page 502 = /error502grpc;
}

What happens if the backend server at backend:9000 is down?

medium

A. nginx silently drops the request without response

B. nginx returns the custom error page at /error502grpc

C. nginx returns a default 404 Not Found error

D. nginx retries the request indefinitely

Solution

1. Step 1: Understand error_page directive usage

   The error_page 502 = /error502grpc; tells nginx to serve the URI /error502grpc when a 502 Bad Gateway error occurs.

2. Step 2: Recognize backend down causes 502 error

   If the backend is down, nginx cannot connect and returns a 502 error, triggering the custom error page.

3. Final Answer:

   nginx returns the custom error page at /error502grpc -> Option B

4. Quick Check:

   502 error triggers custom error_page [OK]

Hint: 502 errors can be customized with error_page directive [OK]

Common Mistakes:

• Assuming 404 is returned for backend failure
• Thinking nginx retries endlessly
• Ignoring error_page directive effect

4. You configured nginx to proxy gRPC with:

grpc_pass grpc://backend:50051;

But clients report connection errors. Which nginx configuration is missing?

medium

A. fastcgi_pass backend;

B. listen 80;

C. proxy_http_version 1.1;

D. listen 443 ssl http2;

Solution

1. Step 1: Identify protocol requirements for gRPC

   gRPC requires HTTP/2 support, so nginx must listen with http2 enabled.

2. Step 2: Check the listen directive

   listen 443 ssl http2; includes listen 443 ssl http2; which enables HTTP/2 over TLS, necessary for secure gRPC connections. Options B and C do not enable HTTP/2, and A is unrelated.

3. Final Answer:

   listen 443 ssl http2; -> Option D

4. Quick Check:

   HTTP/2 is required for gRPC proxying [OK]

Hint: Enable HTTP/2 with listen directive for gRPC [OK]

Common Mistakes:

• Not enabling http2 in listen directive
• Using proxy_http_version 1.1 instead of http2
• Confusing fastcgi_pass with grpc_pass

5. You want nginx to proxy gRPC securely to a backend using TLS on port 50051. Which configuration snippet correctly sets this up?

hard

A. grpc_pass grpcs://backend:50051; listen 443 ssl http2;

B. grpc_pass grpc://backend:50051;

C. proxy_pass grpcs://backend:50051; listen 443 ssl http2;

D. grpc_pass grpc://backend:50051; listen 80;

Solution

1. Step 1: Use grpcs:// for secure gRPC backend

   To proxy gRPC over TLS, the backend URL must start with grpcs://.

2. Step 2: Enable SSL and HTTP/2 on nginx listen

   Listening on port 443 with ssl and http2 is required for secure gRPC proxying.

3. Step 3: Verify correct directive usage

   Use grpc_pass (not proxy_pass) with the secure URL and proper listen directive.

4. Final Answer:

   grpc_pass grpcs://backend:50051; listen 443 ssl http2; -> Option A

5. Quick Check:

   Secure gRPC needs grpcs:// and ssl http2 [OK]

Hint: Use grpcs:// and listen 443 ssl http2 for secure gRPC [OK]

Common Mistakes:

• Using grpc:// instead of grpcs:// for TLS
• Not enabling ssl and http2 on listen
• Using proxy_pass instead of grpc_pass