Reverse proxy
A reverse proxy sits in front of application servers: it receives public requests, routes, encrypts, caches, and filters them. Nginx and its peers hold this position across most of the web.
In practice
This is the architecture of our platforms: the proxy terminates TLS, serves static files, and forwards everything else to the application over a private network. It also enables composite deployments — a single domain aggregating several services, each under its own path. Configuration is kept in versioned files, tested before every reload.