07 · Nginx & 反向代理

官方文档：https://nginx.org/en/docs/ Nginx 配置速查：https://www.nginx.com/resources/wiki/start/ iGaming 重点：WebSocket 代理 · 限流 · SSL 卸载 · 高并发调优

---

1. 配置结构

# /etc/nginx/nginx.conf 结构
main context          # 全局配置（worker_processes、error_log）
├── events {}         # 连接处理配置
└── http {}           # HTTP 配置
    ├── upstream {}   # 后端服务器组
    ├── server {}     # 虚拟主机（一个域名一个）
    │   └── location {} # 路径匹配规则
    └── include /etc/nginx/conf.d/*.conf

高并发基础配置

# /etc/nginx/nginx.conf
worker_processes auto;          # 等于 CPU 核数
worker_rlimit_nofile 1000000;   # 进程最大文件描述符

events {
    worker_connections 65535;   # 每 worker 最大连接数
    use epoll;                  # Linux 高性能 I/O
    multi_accept on;            # 一次 accept 多个连接
}

http {
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 75;
    keepalive_requests 10000;

    # Gzip 压缩
    gzip on;
    gzip_types text/plain text/css application/json application/javascript;
    gzip_min_length 1000;
    gzip_comp_level 4;
}

---

2. 反向代理 + WebSocket

# /etc/nginx/conf.d/igaming.conf

upstream api_backend {
    least_conn;                 # 最少连接算法（适合 WebSocket）
    keepalive 300;              # 长连接池
    server 10.0.10.1:8080 weight=10;
    server 10.0.10.2:8080 weight=10;
    server 10.0.10.3:8080 weight=10 backup;  # 备用节点
}

upstream ws_backend {
    ip_hash;                    # WebSocket 需要粘性会话
    server 10.0.10.4:8081;
    server 10.0.10.5:8081;
}

server {
    listen 443 ssl http2;
    server_name api.example.com;

    ssl_certificate     /etc/ssl/certs/api.example.com.crt;
    ssl_certificate_key /etc/ssl/private/api.example.com.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    # HTTP → HTTPS 强制跳转
    error_page 497 https://$host$request_uri;

    # API 反向代理
    location /api/ {
        proxy_pass http://api_backend;
        proxy_http_version 1.1;
        proxy_set_header Connection "";      # 启用 upstream keepalive
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 5s;
        proxy_read_timeout 60s;
        proxy_buffering off;                 # 实时 API 关闭缓冲
    }

    # WebSocket（实时赔率）
    location /ws/ {
        proxy_pass http://ws_backend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_read_timeout 3600s;           # WebSocket 长连接
        proxy_send_timeout 3600s;
    }

    # 限流（防刷）
    limit_req_zone $binary_remote_addr zone=api:10m rate=100r/m;
    limit_req_zone $binary_remote_addr zone=login:1m rate=10r/m;

    location /auth/login {
        limit_req zone=login burst=5 nodelay;
        limit_req_status 429;
        proxy_pass http://api_backend;
    }
}

# HTTP 跳转 HTTPS
server {
    listen 80;
    server_name api.example.com;
    return 301 https://$host$request_uri;
}

---

3. 访问日志分析

# 实时监控 5xx 错误
tail -f /var/log/nginx/access.log | awk '$9 ~ /5[0-9][0-9]/ {print $0}'

# 统计状态码分布
awk '{print $9}' /var/log/nginx/access.log | sort | uniq -c | sort -rn

# Top 10 访问 IP
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10

# 慢请求分析（$request_time > 1s）
awk '$NF > 1 {print $0}' /var/log/nginx/access.log | tail -20

# 自定义日志格式（推荐）
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                '$status $body_bytes_sent "$http_referer" '
                '"$http_user_agent" $request_time $upstream_response_time';

---

官方文档 & 学习资源

资源	链接
Nginx 官方文档	https://nginx.org/en/docs/
Nginx 配置向导	https://www.digitalocean.com/community/tools/nginx
Mozilla SSL 配置生成器	https://ssl-config.mozilla.org/
Nginx 限流模块文档	https://nginx.org/en/docs/http/ngx_http_limit_req_module.html

---

最后更新：2025-04