Nginx

Running a multi‑site reverse proxy on a Raspberry Pi is a classic hobby‑project. The Pi’s low power draw and cheap price make it a go‑to for hosting tiny web services, internal dashboards, or a personal API gateway. Throw TLS in there and you get confidentiality and integrity, but one small mis‑configuration can make every HTTPS request hang until the client gives up.

The usual culprit is the dance between SNI, OpenSSL’s default cipher selection, and the Pi’s limited CPU. Below I’ll walk through why this happens, how to spot it, and the practical tweaks that keep the Pi from blowing up the handshake.

Introduction to Reverse Proxies

I’ve seen this go wrong when people expose their homelab services directly to the internet - it’s a security risk waiting to happen. Exposing multiple services can make them vulnerable to attacks and unauthorized access. One way to mitigate this risk is to use a reverse proxy, which acts as an intermediary between your services and the internet. In practice, this means you can expose a single IP address and port to the internet, while keeping your services hidden behind the reverse proxy.