For reverse proxy + HTTPS I terminate TLS at nginx and always set X-Forwarded-Proto and Host so the app does not emit http:// links. I keep a short proxy_read_timeout and fail closed on upstream errors rather than serving a stale empty response.