What to check in the first minute of a 502

A 502 has many possible causes, but the first minute only needs three checks.

First, is anything listening: ss -lntp | grep 8080. If not, the 502 is inevitable and the question becomes why the app is down.

Second, the reason in the error log:

upstream: "http://127.0.0.1:8080/x", reason: Connection refused

Connection refused means nobody is listening. Connection timed out means the app is stuck. upstream prematurely closed connection means it accepted and then died. Three different problems.

Third, bypass nginx: curl -H 'Host: example.com' http://127.0.0.1:8080/. If that works, the problem is in the proxy layer — timeouts, buffers, keepalive.