Most 502s after a deploy are upstream not listening yet or a wrong proxy_pass port. I check ss -lntp for the app port, curl the upstream on localhost, then look at proxy_connect_timeout / proxy_read_timeout before touching nginx reload.