worker_processes  auto;              # 自动 = CPU 核数，别手动写死
events {
    worker_connections  2048;        # 单 worker 并发连接数
    use epoll;                       # Linux 默认就是 epoll，可写可不写
}

# 日志里出现这个警告 = 配置超了系统限制
# [warn] 2048 worker_connections exceed open file resource limit: 1024

# 容器运行时加参数
docker run ... --ulimit nofile=65536:65536 ...
# 或宿主机
ulimit -n 65536

upstream gateway_cluster {
    server 10.0.0.11:8080 weight=5;   # gateway 实例 1
    server 10.0.0.12:8080 weight=5;   # gateway 实例 2
    keepalive 32;                      # 到 gateway 的复用连接数（重要！）
}

server {
    listen 443 ssl;
    server_name api.example.com;

    location / {
        proxy_pass http://gateway_cluster;

        # 传递客户端真实信息给 gateway（必须配！）
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # 超时配置（按业务调整）
        proxy_connect_timeout 5s;
        proxy_read_timeout   60s;     # gateway 处理慢请求时别急着断
        proxy_send_timeout   60s;
    }
}

# 上游超时
proxy_connect_timeout 5s;    # 连接 gateway 超时（短一点，快速失败）
proxy_read_timeout   60s;    # 等待 gateway 响应超时（要覆盖慢业务）
proxy_send_timeout   60s;    # 发送请求体超时

# 客户端超时
client_body_timeout  30s;
client_header_timeout 30s;

gzip on;
gzip_comp_level 5;                     # 1-9，5 是性价比点
gzip_min_length 1024;                  # 小于 1KB 不压缩（压缩了反而大）
gzip_types text/plain text/css application/javascript application/json image/svg+xml;

server_tokens off;                     # 隐藏 nginx 版本号
add_header X-Content-Type-Options nosniff always;
add_header X-Frame-Options SAMEORIGIN always;

# 定义限流区：每 IP 每秒 5 个请求，突发 10
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=5r/s;

server {
    location /api/ {
        limit_req zone=api_limit burst=10 nodelay;
        proxy_pass http://gateway_cluster;
    }
}

log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                  '$status $body_bytes_sent "$http_referer" '
                  '"$http_user_agent" "$http_x_forwarded_for"';

access_log  /var/log/nginx/access.log  main;
error_log   /var/log/nginx/error.log   warn;

# 挂载日志目录（容器部署）
-v /var/www/nginx/logs:/var/log/nginx

# /etc/nginx/nginx.conf
user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log warn;
pid        /run/nginx.pid;

events {
    worker_connections  2048;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    server_tokens off;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    tcp_nopush      on;
    keepalive_timeout  65;

    gzip on;
    gzip_comp_level 5;
    gzip_min_length 1024;
    gzip_types text/plain text/css application/javascript application/json image/svg+xml;

    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options SAMEORIGIN always;

    include /etc/nginx/conf.d/*.conf;
}

# /etc/nginx/conf.d/api.conf
upstream gateway_cluster {
    server 10.0.0.11:8080 weight=5;
    server 10.0.0.12:8080 weight=5;
    keepalive 32;
}

limit_req_zone $binary_remote_addr zone=api_limit:10m rate=5r/s;

server {
    listen 80;
    server_name api.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    http2 on;
    server_name api.example.com;

    ssl_certificate     /etc/nginx/certs/api.example.com.crt;
    ssl_certificate_key /etc/nginx/certs/api.example.com.key;
    ssl_protocols       TLSv1.2 TLSv1.3;

    location / {
        limit_req zone=api_limit burst=10 nodelay;

        proxy_pass http://gateway_cluster;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_connect_timeout 5s;
        proxy_read_timeout   60s;
        proxy_send_timeout   60s;
    }

    location ~* \.(css|js|png|jpg|svg|ico|woff2?)$ {
        expires 7d;
        add_header Cache-Control "public, max-age=604800";
    }
}

# 先测配置语法（务必先做！配错会直接挂服务）
nginx -t

# 平滑重载（不中断连接）
nginx -s reload
# 容器里：
docker exec <nginx容器> nginx -t && docker exec <nginx容器> nginx -s reload

# 1. 语法检查（必做）
nginx -t
# nginx: configuration file /etc/nginx/nginx.conf test is successful

# 2. 平滑重载
nginx -s reload

# 3. 验证代理链路
curl -s -o /dev/null -w '%{http_code}' https://api.example.com/api/ping
# 200 = 链路通

# 4. 验证转发头
curl -s -I https://api.example.com/ | grep -i x-forwarded

# 5. 观察错误日志（重载后 1 分钟）
tail -20 /var/log/nginx/error.log
# 没有新的 warn/error 就对了