# nginx.conf 全局塊
user  nginx;
worker_processes  auto;  # 自動匹配 CPU 核心數(shù)，避免過多 worker 爭搶 FD
worker_rlimit_nofile  65535;  # ?? 此值必須 ≤ 系統(tǒng) ulimit -n，且需配合 systemd 設置

# events 塊
events {
    use epoll;           # Linux 必選
    worker_connections  16384;  # 單 worker 最大連接數(shù)，≤ worker_rlimit_nofile/2（預留 upstream FD）
    multi_accept on;    # 一次 accept 多個連接，降低 syscall 開銷
}

# http 塊內，針對 upstream 優(yōu)化
upstream backend_java {
    server 10.0.1.10:8080 max_fails=3 fail_timeout=30s;
    server 10.0.1.11:8080 max_fails=3 fail_timeout=30s;
    
    # ?? 關鍵：強制 HTTP/1.1 + 連接復用，大幅減少 upstream FD
    keepalive 32;  # 每個 worker 與 upstream 保持最多 32 個空閑連接
}

server {
    listen 80;
    location /api/ {
        proxy_pass http://backend_java;
        
        # 強制使用 HTTP/1.1 并復用連接
        proxy_http_version 1.1;
        proxy_set_header Connection '';  # 清除 Connection header，允許復用
        
        # 設置超時，避免連接長期掛起
        proxy_connect_timeout 5s;
        proxy_send_timeout 10s;
        proxy_read_timeout 10s;
        
        # 啟用緩沖，減少對 upstream 的即時壓力
        proxy_buffering on;
        proxy_buffer_size 4k;
        proxy_buffers 8 4k;
        proxy_busy_buffers_size 8k;
    }
}

[Service]
LimitNOFILE=65535
LimitCORE=infinity
TasksMax=infinity
# 防止 OOM Killer 誤殺
OOMScoreAdjust=-100

http {
    # ? 啟用 OpenSSL 硬件加速（需 CPU 支持 AES-NI, RDRAND）
    ssl_engine rdrand;  # Linux 5.4+ 內核自動啟用
    
    # ? 強制 TLS 1.3（更快握手，0-RTT 可選）
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    
    # ? 會話復用：服務端緩存 Session ID / Session Ticket
    ssl_session_cache shared:SSL:10m;  # 10MB 共享緩存，約 40,000 個會話
    ssl_session_timeout 4h;
    ssl_session_tickets on;
    ssl_session_ticket_key /etc/nginx/ssl/ticket.key;  # 32字節(jié)隨機密鑰
    
    # ? OCSP Stapling（減少客戶端證書驗證延遲）
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 1.1.1.1 valid=300s;
    resolver_timeout 5s;
    
    server {
        listen 443 ssl http2;  # 啟用 HTTP/2，多路復用降低連接數(shù)
        ssl_certificate /etc/nginx/ssl/fullchain.pem;
        ssl_certificate_key /etc/nginx/ssl/privkey.pem;
        
        # ? 啟用 TLS 1.3 0-RTT（謹慎！僅冪等接口）
        ssl_early_data on;
        # 在 location 中控制 0-RTT（需應用層防重放）
        location /api/v1/order {
            if ($ssl_early_data = "1") {
                return 425; # Too Early，強制重試（Java 側需處理）
            }
            proxy_pass http://backend_java;
        }
    }
}

@RestController
@RequestMapping("/api/v1/order")
public class OrderController {
    // 使用 Redis 實現(xiàn)簡單防重放（生產需分布式鎖 + 時間窗口）
    @Autowired
    private StringRedisTemplate redisTemplate;
    @PostMapping
    public ResponseEntity<OrderResult> createOrder(@RequestBody OrderRequest request,
                                                   HttpServletRequest httpRequest) {
        // 檢查是否來自 TLS 0-RTT（Nginx 透傳 $ssl_early_data）
        String earlyDataHeader = httpRequest.getHeader("X-Ssl-Early-Data");
        if ("1".equals(earlyDataHeader)) {
            // 生成業(yè)務唯一 ID（如訂單號前綴 + 時間戳 + 隨機數(shù)）
            String dedupKey = "dedup:" + request.getOrderNo() + ":" 
                            + System.currentTimeMillis() / 1000; // 1秒粒度
            // Redis SETNX + EXPIRE 原子操作
            Boolean isSet = redisTemplate.opsForValue()
                .setIfAbsent(dedupKey, "1", Duration.ofSeconds(60));
            if (Boolean.FALSE.equals(isSet)) {
                return ResponseEntity.status(425)
                    .header("Retry-After", "0")
                    .body(new OrderResult("DUPLICATE_REQUEST"));
            }
        }
        // 正常下單邏輯
        Order order = orderService.create(request);
        return ResponseEntity.ok(new OrderResult(order.getId()));
    }
}

http {
    # 全局安全基線
    client_max_body_size 100M;  # 防止惡意大 Body 耗盡內存
    client_body_timeout 12s;
    
    # ? 場景1：API 接口（JSON，小響應）→ 啟用緩沖，提升吞吐
    map $uri $is_api {
        ~^/api/      1;
        default       0;
    }
    
    # ? 場景2：文件下載（大響應）→ 禁用緩沖，流式傳輸
    map $uri $is_download {
        ~^/download/  1;
        ~\.(xlsx|pdf|zip)$  1;
        default       0;
    }

    server {
        location / {
            # API 路徑：啟用智能緩沖
            if ($is_api) {
                proxy_buffering on;
                proxy_buffer_size 4k;
                proxy_buffers 16 4k;
                proxy_busy_buffers_size 16k;
                proxy_max_temp_file_size 0; # 禁用臨時文件，全內存
            }
            
            # 下載路徑：禁用緩沖，零拷貝傳輸
            if ($is_download) {
                proxy_buffering off;
                proxy_buffer_size 128k;
                proxy_buffers 4 256k;
                proxy_busy_buffers_size 512k;
                # 啟用 sendfile 提升大文件性能
                sendfile on;
                tcp_nopush on;
                tcp_nodelay on;
            }
            
            proxy_pass http://backend_java;
        }
    }
}

@GetMapping("/download/{fileId}")
public void downloadFile(@PathVariable String fileId, 
                        HttpServletResponse response) throws IOException {
    Resource resource = fileService.loadAsResource(fileId);
    // ?? 關鍵：不使用 ResponseEntity<Resource>（會加載全文件進內存）
    // 改用流式寫入 + 正確 Header
    response.setContentType("application/octet-stream");
    response.setHeader("Content-Disposition", 
        "attachment; filename=\"" + resource.getFilename() + "\"");
    response.setHeader("Content-Transfer-Encoding", "binary");
    response.setContentLengthLong(resource.contentLength());
    try (InputStream is = resource.getInputStream();
         OutputStream os = response.getOutputStream()) {
        byte[] buffer = new byte[8192];
        int len;
        while ((len = is.read(buffer)) != -1) {
            os.write(buffer, 0, len);
        }
        os.flush(); // 確保立即發(fā)送
    }
}

http {
    # ? 全局熔斷：基于 upstream 健康狀態(tài)動態(tài)調整
    upstream backend_java {
        server 10.0.1.10:8080 max_fails=3 fail_timeout=10s slow_start=30s;
        server 10.0.1.11:8080 max_fails=3 fail_timeout=10s slow_start=30s;
        
        # ? 健康檢查（主動探測）
        check interval=3 rise=2 fall=5 timeout=1;
        check_http_send "HEAD /actuator/health HTTP/1.1\r\nHost: localhost\r\n\r\n";
        check_http_expect_alive http_2xx http_3xx;
    }

    server {
        location /api/ {
            proxy_pass http://backend_java;
            
            # ? 分級超時（比 Java 熔斷閾值小 20%）
            proxy_connect_timeout 3s;   # TCP 連接建立
            proxy_send_timeout 8s;      # 發(fā)送請求到 upstream
            proxy_read_timeout 8s;      # 讀取 upstream 響應
            
            # ? 限流：每 IP 每秒最多 100 請求（防爬蟲/攻擊）
            limit_req zone=perip burst=200 nodelay;
            
            # ? 限流區(qū)域定義（需在 http 塊）
            limit_req_zone $binary_remote_addr zone=perip:10m rate=100r/s;
        }
    }
}

<!-- pom.xml -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-actuator</artifactId>
</dependency>
<dependency>
    <groupId>io.micrometer</groupId>
    <artifactId>micrometer-registry-prometheus</artifactId>
</dependency>

# application.yml
management:
  endpoints:
    web:
      exposure:
        include: health,metrics,prometheus,threaddump
  endpoint:
    health:
      show-details: when_authorized
  metrics:
    export:
      prometheus:
        enabled: true

// 自定義熔斷指標（供 Nginx check 或 Prometheus 抓?。?
@Component
public class HealthIndicatorConfig {
    @Bean
    public HealthIndicator dbHealthIndicator(DataSource dataSource) {
        return () -> {
            try (Connection conn = dataSource.getConnection()) {
                conn.createStatement().execute("SELECT 1");
                return Health.up()
                    .withDetail("db_response_time_ms", System.currentTimeMillis())
                    .build();
            } catch (Exception e) {
                return Health.down()
                    .withDetail("error", e.getMessage())
                    .build();
            }
        };
    }
}

http {
    # ? 禁用 PCRE JIT（某些版本 JIT 反而更慢）
    pcre_jit off;
    
    # ? 用前綴匹配替代正則（推薦?。?
    location /api/v1/users/ {
        proxy_pass http://backend_java;
    }
    location /api/v2/users/ {
        proxy_pass http://backend_java;
    }
    
    # ? 如必須正則，使用原子組和占有量詞（PCRE 8.32+）
    # 原危險寫法：location ~* "^/api/v(\d+)/users/(\d+)/orders/(.*)$" 
    # 改為安全寫法：
    location ~* "^/api/v(?<version>\d+)/users/(?<uid>\d+)/orders/[^?]*" {
        # 使用命名捕獲組，且末尾用 [^?]* 替代 .* 防止回溯
        proxy_pass http://backend_java;
        proxy_set_header X-API-Version $version;
        proxy_set_header X-User-ID $uid;
    }
    
    # ? 對 UA 等高危字段，用 map 替代 if + regex（map 是哈希查找 O(1)）
    map $http_user_agent $is_bot {
        "~*bot|crawl|spider" 1;
        "~*Chrome/120"       0; # 白名單
        default              0;
    }
    
    server {
        location / {
            if ($is_bot) {
                return 403;
            }
            proxy_pass http://backend_java;
        }
    }
}

http {
    # ? 異步日志（Nginx 1.11.13+）
    access_log /var/log/nginx/access.log main buffer=128k flush=5s;
    
    # ? 結構化 JSON 日志（便于 ELK 解析）
    log_format json '{"time": "$time_iso8601", '
                     '"remote_addr": "$remote_addr", '
                     '"status": "$status", '
                     '"body_bytes_sent": "$body_bytes_sent", '
                     '"request_time": "$request_time", '
                     '"upstream_response_time": "$upstream_response_time", '
                     '"http_user_agent": "$http_user_agent"}';
    
    # ? 采樣日志：僅記錄錯誤和慢請求（99% 日志丟棄）
    map $status $loggable {
        ~^[23]  0;   # 2xx/3xx 不記錄
        ~^[45]  1;   # 4xx/5xx 記錄
        default 0;
    }
    
    map $request_time $slow_request {
        >1.0    1;   # 超過 1s 記錄
        default 0;
    }
    
    server {
        access_log /var/log/nginx/access.log json 
                   if=$loggable;  # 僅錯誤狀態(tài)
        access_log /var/log/nginx/slow.log json 
                   if=$slow_request; # 僅慢請求
    }
}

http {
    # ? 共享字典嚴格設限（避免內存失控）
    lua_shared_dict auth_cache 128m;   # 最大 128MB
    lua_shared_dict rate_limit 64m;
    
    # ? Lua 代碼中顯式釋放（示例：JWT 解析后清理）
    init_by_lua_block {
        -- 初始化 JWT 庫
        local jwt = require "resty.jwt"
        _G.jwt_lib = jwt:new()
    }
    
    server {
        location /api/auth {
            # ? 使用 cosocket 替代阻塞 IO
            content_by_lua_block {
                local jwt_obj = _G.jwt_lib
                local token = ngx.var.arg_token
                
                -- 解析 JWT（不阻塞）
                local ok, err = pcall(function()
                    local res, err = jwt_obj:verify_jwt_obj(token)
                    if not res then
                        ngx.exit(401)
                    end
                    -- ? 解析后立即清理大對象
                    jwt_obj = nil
                    collectgarbage() -- 強制 GC
                end)
                
                if not ok then
                    ngx.log(ngx.ERR, "JWT parse error: ", err)
                    ngx.exit(500)
                end
            }
        }
    }
}

# /etc/nginx/nginx.conf
user  nginx;
worker_processes  auto;
worker_rlimit_nofile  65535;

# 全局日志與錯誤處理
error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

# 事件模型
events {
    use epoll;
    worker_connections  16384;
    multi_accept on;
    accept_mutex off;
}

http {
    # MIME 類型
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    # 日志格式（結構化 JSON）
    log_format json '{"@timestamp":"$time_iso8601",'
                     '"host":"$server_addr",'
                     '"client":"$remote_addr",'
                     '"method":"$request_method",'
                     '"uri":"$uri",'
                     '"status":$status,'
                     '"bytes":$body_bytes_sent,'
                     '"request_time":$request_time,'
                     '"upstream_time":"$upstream_response_time",'
                     '"upstream_addr":"$upstream_addr",'
                     '"http_user_agent":"$http_user_agent"}';

    # 異步日志
    access_log /var/log/nginx/access.log json buffer=128k flush=5s;
    # 錯誤日志采樣
    map $status $log_error {
        ~^[45]  1;
        default 0;
    }
    access_log /var/log/nginx/error_access.log json if=$log_error;

    # 連接與超時
    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;
    keepalive_timeout  65;
    types_hash_max_size 2048;

    # 客戶端限制
    client_max_body_size 100M;
    client_body_timeout 12s;
    client_header_timeout 12s;
    send_timeout 10s;

    # SSL 優(yōu)化（TLS 1.3 優(yōu)先）
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 4h;
    ssl_session_tickets on;
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 1.1.1.1 valid=300s;

    # Gzip
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

    # 上游定義
    upstream backend_java {
        least_conn;
        server 10.0.1.10:8080 max_fails=3 fail_timeout=10s;
        server 10.0.1.11:8080 max_fails=3 fail_timeout=10s;
        keepalive 32;
    }

    # 限流區(qū)域
    limit_req_zone $binary_remote_addr zone=perip:10m rate=100r/s;
    limit_req_zone $server_name zone=perserver:10m rate=5000r/s;

    include /etc/nginx/conf.d/*.conf;
}