Virtual Private Cloud (10.0.0.0/16) divided into public subnet for Nginx (internet-facing) and private subnets for backend services (no direct internet access). Mirrors AWS/GCP VPC design.
⚖️ Load Balancing
Nginx distributes traffic across both backend services using round-robin. Requests alternate between ERP Service 1 and CRM/WMS Service 2, demonstrating horizontal scaling.
🔁 Reverse Proxy
Nginx acts as a reverse proxy — clients connect only to Nginx (public IP). Backend service IPs are hidden. Nginx forwards requests internally using Docker's DNS.
🔥 Firewall / Security Groups
Only Nginx exposes port 80/443 externally. Backend services run on internal Docker network only. This simulates AWS Security Groups restricting inbound access.
🔗 NAT Gateway
Private subnet services reach the internet (e.g. npm install) through a NAT. Inbound traffic is blocked — outbound is allowed. Docker's bridge network applies the same principle.
🏷️ DNS Resolution
Docker Compose creates an internal DNS. Services reach each other by name (service-1, service-2) rather than IP. Nginx upstream block uses these DNS names to forward traffic.
🚪 Gateway
The Internet Gateway allows the public subnet (Nginx) to receive traffic from the internet. Private subnets have no IGW — they are isolated and only reachable via the load balancer.
📈 Horizontal Scaling
Run docker compose up --scale service-1=3 service-2=3 to add replicas. Nginx automatically distributes requests across all instances without any config change.