# Two-node reverse proxy HA on Windows without pretending it is a cluster

> Design an active/passive or DNS/LB fronted pair, keep configuration identical, handle sessions and health, and know the limits versus NLB.

**Tested on**

- Build: 26100.33650
- Edition: Standard / Datacenter
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-29

## The short answer

HA is not “two servers”. It needs:

- a shared front (DNS round-robin with health, a load balancer, or NLB);
- identical configuration on both nodes;
- a session model (sticky, shared cache, or stateless tokens);
- certificate/config distribution;
- a tested failover and a split-brain story.

A single Windows box with two Nginx processes is not HA.

## Topologies

| Pattern | Use | Limit |
|---|---|---|
| DNS round-robin | quick, cheap | no health, client caching |
| External LB / cloud LB | most production | extra hop/cost |
| Windows NLB | on-prem pair | unicast/multicast quirks, not a WAF |
| ARR/Nginx pair behind LB | TLS + routing | LB is still the SPOF unless redundant |

If the LB is one VM, you moved the SPOF, not removed it.

## Configuration consistency

- Keep both nodes’ IIS/Nginx config in version control.
- IIS: shared configuration on a highly available share, or deploy the same `applicationHost.config`/site XML.
- Nginx: same `nginx.conf` + includes; deploy with checksum verification.
- Certificates: same PFX/PEM, same renewal automation, same reload.
- App versions: same artifact hash on both nodes.

## Sessions

- Prefer **stateless** (JWT/signed cookie) or a shared cache (Redis).
- Sticky sessions work but break on failover unless the session store is shared.
- IIS/ASP.NET session state in a shared store, not in-proc, for multi-node.

## Health and failover

- Probe `/readyz` from the LB.
- Remove a node on N consecutive failures; add back slowly.
- Test failover in business hours, not only at 3am.
- Alert on node count/health, not just per-node CPU.

> **Caution: Shared configuration is a dependency**
>
> If IIS shared config lives on one file server, that file server is now part of your web tier. Make it redundant or keep local config + deployment.

## Verify

```powershell
# from the LB/host, both nodes answer
curl.exe -I https://lab.example/ --resolve lab.example:443:<node1>
curl.exe -I https://lab.example/ --resolve lab.example:443:<node2>
Get-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter 'system.webServer/rewrite/rules' -Name '.'
```

Stop one node; the site should stay up and the LB should remove it. If it does not, you have a diagram, not HA.

## Lab boundary

E1. The lab is a single VM; no LB or second node was built. The topologies are the design to validate on Server 2025.

## Sources

- [nginx — Upstream module](https://nginx.org/en/docs/http/ngx_http_upstream_module.html)
- [Microsoft Learn — Network Load Balancing](https://learn.microsoft.com/en-us/windows-server/networking/technologies/network-load-balancing)

---

Source: https://winbook.fyi/en/server/ops/ha/