WMS keeps returning 502 while the service is still alive

• Large GetMap requests return 502 Bad Gateway nginx/1.24.0 while direct 8080 calls return 200.
• The error log shows upstream prematurely closed connection while reading response header from upstream.
• Retrying a few times sometimes succeeds because render time hovers around the timeout.

1. curl the same GetMap against 127.0.0.1:8080 and record http_code and time_total.
2. Check whether the elapsed time approaches 60 seconds.
3. Classify the nginx error log entry as prematurely closed, timed out or connection refused.
4. Check catalina.out and geoserver.log for OutOfMemoryError or render failures.
5. Check buffering limits if the log reports upstream sent too big header.

In a location dedicated to /geoserver/wms raise proxy_read_timeout and proxy_send_timeout to 120s and set proxy_buffer_size 16k with proxy_buffers 8 64k; cap image cost with maxRequestMemory=65536 in KB and maxRenderingTime=60. Serve large extents as 512-pixel TileWMS requests with TILED true.

502 Bad Gateway
nginx/1.24.0

2026/10/29 10:12:44 [error] 1842#1842: *31 upstream prematurely closed connection
while reading response header from upstream, client: 10.0.2.18,
request: "GET /geoserver/wms?SERVICE=WMS&REQUEST=GetMap&LAYERS=roads&WIDTH=2048&HEIGHT=2048 HTTP/1.1",
upstream: "http://127.0.0.1:8080/geoserver/wms?...", host: "gis.example.cn"

• Raising the global proxy_read_timeout for the whole server, which hides genuinely hung endpoints.
• Restarting GeoServer as the fix: it buys a few minutes and the oversized requests come straight back.