Best Practice NGINX reverse proxy and Docker container depending on it - docker

Question

I need your help. I tried several searches but as I think my problem is pretty unique, I did not find any solution. So I try to find one by asking directly.
My situation is resp. should be as follows:
I have a GitLab instance with a container-registry and a container-backend-service "running" on the same server, the access is managed by a NGINX-reverse-proxy (same server, as a docker container, too).
Right now, the backend-service and the reverse-proxy are built and run with a single docker-compose file.
The problem is that this does not work, as the backend-service needs to be pulled over the reverse-proxy from GitLab container registry. So, I cannot start the backend-service without the reverse-proxy running. But I cannot start the reverse-proxy as in its config I declared a proxy_pass and upstream to the backend-service:
nginx: [emerg] host not found in upstream "xxx:yyyy" in /etc/nginx/conf.d/upstream.conf:6
So I am generally interested in best practices here:
I think I should separate the reverse-proxy and the backend-service. Right?
How can I start the proxy with a config that is not yet ready/running at starttime? I tried something like resolver and static IP, found here in the forums, but it does not work for me. depends_on does not work, too.
Is it possible to start the proxy without the configuration for the backend-service and copy the NGINX-config of the backend-service at the starttime of the container. Or is there a better best-practice?
docker-compose.yml
version: '3.6'
services:
nginx_reverse_proxy:
image: nginx:mainline-alpine
container_name: nginx_reverse_proxy
restart: unless-stopped
ports:
- "80:80"
- "443:443"
volumes:
- web-root:/var/www/html
- ./nginx-conf:/etc/nginx/conf.d
- certbot-etc:/etc/letsencrypt
- certbot-var:/var/lib/letsencrypt
- dhparam:/etc/ssl/certs
- logs:/var/log/nginx
networks:
- app-network
backend-service:
image: xxx.xxx.de:port/group/backend-service
container_name: backend-service
restart: unless-stopped
ports:
- "4000:4000"
depends_on:
- nginx_reverse_proxy
networks:
- app-network
... [some certbot instructions]
volumes:
certbot-etc:
certbot-var:
web-root:
driver: local
driver_opts:
type: none
device: xxx
o: bind
dhparam:
driver: local
driver_opts:
type: none
device: xxx
o: bind
logs:
driver: local
driver_opts:
type: none
device: xxx
o: bind
networks:
app-network:
driver: bridge
backend-service.conf (excerpt)
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name xxx.xxx.de;
server_tokens off;
ssl_certificate /etc/letsencrypt/live/xxx.xxx.de/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/xxx.xxx.de/privkey.pem;
ssl_buffer_size 8k;
ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
ssl_ecdh_curve secp384r1;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
location / {
try_files $uri #backend-service;
}
location #backend-service{
resolver 127.0.0.11 valid=30s;
set $upstream_backend-service backend-service;
proxy_pass http://$upstream_backend-service;
add_header Access-Control-Allow-Origin https://xx.xx.de;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
# add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
# enable strict transport security only if you understand the implications
}
}
upstream.conf
...
upstream backend-service {
server backend-service:4000;
}
...
I appreciate your help and look forward to your answers, thank you in advance.