One front door
Production apps rarely expose the API directly. A reverse proxy like nginx is the single public entry: it serves static files itself and forwards /api/ requests to the API container, which stays private on the Compose network.
Why a reverse proxy?
Almost every production web app has one.
A reverse proxy is the one public door to your app. It serves static files very efficiently, forwards API calls to the right container, and is the natural place for HTTPS certificates, compression, caching and rate limits. The API container publishes no port at all, so the only way in is through nginx — a smaller, easier-to-secure surface.
- Static files: nginx reads them straight from disk, fast.
- /api/ requests: forwarded to http://api:3000/ on the private network.
- HTTPS: one certificate on the proxy covers everything behind it.
- Later: several API containers behind one proxy for load balancing.
The trailing slashes in location /api/ and proxy_pass http://api:3000/ strip the /api prefix. Without them, the API receives /api/menu instead of /menu.