Technical FAQ — Database & Nginx

A database server can mean either the machine running the database software or the database software/service itself.

For example, a VM or physical machine may have an IP address such as 10.0.1.25 and run PostgreSQL or MySQL. In everyday conversation, people may call that machine the database server.

Database server machine
        |
        +-- IP: 10.0.1.25
        |
        +-- Database process
        +-- Nginx
        +-- Monitoring agent
        +-- Backup software

Not exactly. A server is generally a program/process that listens for requests and provides a service. The machine hosting that process is often also casually called a server.

For example, MySQL is a server application. When it is running, the operating system has a MySQL process listening for network connections.

A port is a number used to identify a network service/process on a machine.

Client
  |
  |  IP + Port
  v
10.0.1.25 : 3306
             |
             +--> MySQL process

The IP identifies the machine. The port identifies the service endpoint on that machine.

The operating system maintains the network socket information. A server process binds to a port, for example 3306 for MySQL or 80 for HTTP.

The application/service configuration normally determines which port it listens on, while the OS keeps track of the active listening socket.

Conceptually, yes. More precisely, the port identifies a network endpoint on the destination machine. The operating system then delivers traffic arriving on that port to the process that owns the listening socket.

No. A machine can have a private IP inside a local network and reach the Internet through NAT. A public IP is an Internet-routable address. Many client devices are not directly exposed as public servers.

That is a useful mental model. A machine can act as a client when it initiates connections and as a server when it listens for incoming connections. A single machine can do both.

Yes. Public services such as Google are reachable through public DNS and Internet-facing infrastructure. The important distinction is that you normally connect using a hostname such as google.com, not by manually entering one fixed IP.

The protocol usually defines a default port. For example:

• HTTP → 80
• HTTPS → 443
• MySQL → commonly 3306
• PostgreSQL → commonly 5432

So https://google.com normally means HTTPS on port 443.

Yes, the server-side service is configured to listen on a particular port. Network firewalls/security groups and routing rules may also need to allow traffic to that port.

Client
  |
  | request to server IP : port
  v
Network / Firewall
  |
  v
Server machine
  |
  +--> Port 443 --> Nginx
  |
  +--> Port 3306 --> MySQL

Nginx is a high-performance web server and reverse proxy. It can accept HTTP/HTTPS requests and then serve static content or forward requests to application servers.

No. Nginx is not required on every server. It is one possible piece of server infrastructure.

It is commonly used when you want a dedicated web-facing component to handle HTTP/HTTPS traffic, TLS termination, reverse proxying, load balancing, static files, or access-control/authentication integration.

Nginx was originally created by Igor Sysoev. It began as a high-performance web server project and later became widely used as a reverse proxy and application gateway.

Internet
   |
   v
Nginx : 80 / 443
   |
   +------> Static files
   |
   +------> PHP-FPM / Laravel
   |
   +------> Node / other application
   |
   +------> Authentication gateway

Nginx receives the request and uses its configuration to decide what should happen next.

On a Linux system using systemd, the common commands are:

sudo systemctl start nginx
sudo systemctl status nginx

On other environments, including Windows, the method can differ.

Yes. Nginx has Windows builds, although Linux is the more common production environment for Nginx deployments.

Very widely. It is commonly used for websites, APIs, reverse proxies, load balancing, static content, and as an entry point in modern application architectures.

Yes. Keycloak can act as an Identity Provider (IdP) and provide SSO for applications using standards such as OpenID Connect and SAML.

Yes. Keycloak can manage users itself, and it can also federate authentication to external Identity Providers such as Microsoft Entra ID or Google, depending on the configured integration.

It is configured in the Keycloak realm under the Identity Providers area. The exact options depend on the provider and protocol being configured.

OpenID Connect (OIDC) is an identity/authentication layer built on top of OAuth 2.0. OAuth 2.0 provides authorization; OIDC adds a standardized way for an application to authenticate a user and receive identity information.

OAuth 2.0 is primarily an authorization framework. It lets a client obtain limited access to a protected resource on behalf of a user or another party.

oauth2-proxy is an authentication-aware reverse proxy that can sit between users and an application. It handles the OAuth/OIDC login flow and can establish an authenticated session, allowing an upstream application to remain protected without implementing the complete login flow itself.

The architecture discussed was:

User / Browser
      |
      v
   Nginx
      |
      | auth_request
      v
 oauth2-proxy
      |
      v
   Keycloak
      |
      v
 External IdP (optional)

If authenticated:
Nginx --------------------> Application

Nginx protects the application. It asks oauth2-proxy whether the request is authenticated. If authentication is required, oauth2-proxy starts the OIDC flow with Keycloak. Once authenticated, the request is allowed through to the application.

kc_idp_hint is a Keycloak authorization-request parameter that can tell Keycloak which configured external Identity Provider should handle the login. This can allow Keycloak to forward the user directly to the external IdP instead of first showing the Keycloak login page.

The configuration discussed was to make the hint configurable and empty by default, so the normal Keycloak login page remains available as a fallback when federation has a problem.

                     ┌─────────────────┐
                     │     Browser     │
                     └────────┬────────┘
                              |
                              v
                     ┌─────────────────┐
                     │      Nginx      │
                     │  auth_request   │
                     └────────┬────────┘
                              |
                     authentication check
                              |
                              v
                     ┌─────────────────┐
                     │  oauth2-proxy   │
                     └────────┬────────┘
                              |
                         OIDC login
                              |
                              v
                     ┌─────────────────┐
                     │    Keycloak     │
                     └────────┬────────┘
                              |
                     optional federation
                              |
                              v
                     ┌─────────────────┐
                     │ External IdP    │
                     │ Microsoft/etc.  │
                     └─────────────────┘

Authenticated request
        |
        v
      Nginx
        |
        v
     Application

This keeps authentication at the edge while the application receives only requests that have passed the authentication check.