Nginx Reverse Proxy Hardening & Keepalive Connection Pooling for PeopleSoft Web Tier

Symptom & Nginx Error Logs

During student registration or payroll processing, Nginx returns HTTP 502 error pages to clients:

2026/07/26 03:59:12 [error] 4012#0: *184902 upstream timed out (110: Connection timed out) 
while reading response header from upstream, client: 192.168.1.50, 
server: peoplesoft.university.edu, request: "POST /psc/ps/EMPLOYEE/SA/c/COMMUNITY_ACCESS.SSS_STUDENT_CENTER.GBL HTTP/1.1", 
upstream: "http://10.0.4.15:8000/psc/ps/..."

---

Root Cause Analysis

By default, Nginx creates a new TCP connection to the upstream WebLogic backend for every incoming HTTP request. Under high concurrency, WebLogic exhausts available TCP socket handles, dropping incoming backend handshakes.

---

Hardened Production Nginx Configuration

Apply the following directives in /etc/nginx/conf.d/peoplesoft.conf:

# Upstream WebLogic Server Pool with Keepalive Connections
upstream peoplesoft_weblogic_backend {
    server 10.0.4.15:8000 max_fails=3 fail_timeout=30s;
    server 10.0.4.16:8000 max_fails=3 fail_timeout=30s;
    
    # Maintain persistent connection pool to backend
    keepalive 64;
}

server {
    listen 443 ssl http2;
    server_name peoplesoft.university.edu;

    # TLS Security Hardening
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers on;

    location / {
        proxy_pass http://peoplesoft_weblogic_backend;
        
        # Enable HTTP 1.1 for upstream keepalive
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        
        # Buffer & Timeout Enhancements for Long-Running PIA Reports
        proxy_read_timeout 300s;
        proxy_connect_timeout 75s;
        proxy_send_timeout 300s;
        
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

---

Diagnostic Verification

Verify your Nginx configuration and sanitize local access logs before analysis:

# Test configuration syntax
nginx -t

# Run local DBPros anonymizer script
node ./scripts/collector/dbpros-sanitize-collect.js --input-log /var/log/nginx/error.log

Need a web proxy or database checkup? Download our Digital Runbooks.