反向代理与 API 网关：Nginx/Kong/Envoy 实践

# 全局 http 块
http {
    # 动态上游：按权重负载均衡 + 被动健康检查
    upstream backend_api {
        server 192.168.1.11:8080 weight=5 max_fails=3 fail_timeout=30s;
        server 192.168.1.12:8080 weight=3 max_fails=3 fail_timeout=30s;
        server 192.168.1.13:8080 backup;          # 冷备节点

        keepalive 32;                              # 与后端的长连接池
        keepalive_timeout 60s;
    }

    server {
        listen 80;
        server_name api.example.com;

        location /api/ {
            proxy_pass http://backend_api;
            proxy_http_version 1.1;
            proxy_set_header Connection "";

            # 透传关键头
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # 超时控制
            proxy_connect_timeout 5s;
            proxy_read_timeout 30s;
            proxy_send_timeout 30s;
        }
    }
}

# 简单请求级健康检查：给 /healthz 单独分组
upstream backend_api {
    server 192.168.1.11:8080;
    server 192.168.1.12:8080;
    zone upstream_backend 64k;   # 共享内存，配合 nginx-plus/openresty
}

server {
    location = /healthz {
        # 该请求专门用于健康探测
        access_log off;
        proxy_pass http://backend_api;
        proxy_connect_timeout 2s;
        proxy_read_timeout 3s;
    }
}

http {
    # 定义限流区域：1r/s 平均速率，突发 5
    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=1r/s;

    # 定义并发连接限制
    limit_conn_zone $binary_remote_addr zone=per_ip_conn:10m;

    server {
        listen 80;

        location /api/ {
            # 漏桶限流，超过突发返回 503
            limit_req zone=api_limit burst=5 nodelay;
            limit_req_status 429;

            # 每 IP 最多 20 并发
            limit_conn per_ip_conn 20;
            limit_conn_status 429;

            proxy_pass http://backend_api;
        }

        # 静态资源不限流
        location /static/ {
            alias /data/static/;
            expires 30d;
        }
    }
}

# declarative.yaml（DB-less 模式）
_format_version: "2.1"
services:
  - name: order-service
    url: http://order-svc:8080
    routes:
      - name: order-route
        paths: ["/orders"]
        methods: ["GET", "POST"]
        strip_path: true
    plugins:
      - name: rate-limiting
        config:
          minute: 60
          hour: 3000
          policy: local
      - name: key-auth
        config:
          key_names: ["apikey"]
consumers:
  - username: partner-a
    keyauth_credentials:
      - key: secret-key-001

# 最小 Envoy 静态配置（示例）
static_resources:
  listeners:
    - name: listener_0
      address:
        socket_address: { address: 0.0.0.0, port_value: 10000 }
      filter_chains:
        - filters:
            - name: envoy.filters.network.http_connection_manager
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                stat_prefix: ingress_http
                http_filters:
                  - name: envoy.filters.http.router
                route_config:
                  virtual_hosts:
                    - name: vh
                      domains: ["*"]
                      routes:
                        - match: { prefix: "/api" }
                          route:
                            cluster: backend
  clusters:
    - name: backend
      connect_timeout: 5s
      type: STRICT_DNS
      lb_policy: ROUND_ROBIN
      load_assignment:
        cluster_name: backend
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address: { address: backend, port_value: 8080 }

# Envoy route 上的治理配置
routes:
  - match: { prefix: "/api/order" }
    route:
      cluster: order_cluster
      timeout: 10s
      retry_policy:
        retry_on: "connect-failure,reset,5xx"
        num_retries: 3
        retry_host_predicate:
          - name: envoy.retry_host_predicates.previous_hosts
        per_try_timeout: 3s
circuit_breakers:
  thresholds:
    - priority: DEFAULT
      max_connections: 10000
      max_pending_requests: 5000
      max_requests: 10000
      max_retries: 3

// 网关层面校验 JWT 后，将解析出的用户信息以请求头透传给后端
package main

import (
    "fmt"
    "github.com/golang-jwt/jwt/v5"
)

// 校验并提取 claims（网关侧伪代码）
func verifyAndForward(token string) error {
    claims := jwt.MapClaims{}
    _, err := jwt.ParseWithClaims(token, claims, func(t *jwt.Token) (interface{}, error) {
        return []byte("gateway-secret"), nil
    })
    if err != nil {
        return fmt.Errorf("token invalid: %w", err)
    }
    // 通过 X-User-ID / X-User-Role 透传给下游
    // header.Set("X-User-ID", claims["sub"].(string))
    return nil
}

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

upstream ws_backend {
    server 192.168.1.21:9000;
    server 192.168.1.22:9000;
}

server {
    listen 80;
    location /ws/ {
        proxy_pass http://ws_backend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        # 长连接超时：覆盖默认 60s，防止空闲被切断
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;

        # 支持粘性会话：同一连接固定到同一节点
        sticky cookie ws_route expires=1h;
    }
}

http {
    # gRPC 需要 HTTP/2 与 ssl
    server {
        listen 443 ssl http2;
        server_name grpc.example.com;

        ssl_certificate     /etc/nginx/tls/server.crt;
        ssl_certificate_key /etc/nginx/tls/server.key;

        # 监听 gRPC 端口（默认 50051 示例）
        location /helloworld.Greeter/ {
            grpc_pass grpc://grpc_backend;
        }
    }

    upstream grpc_backend {
        server 192.168.1.31:50051;
        server 192.168.1.32:50051;
    }
}