From 9f856858e28a54b0f19474d67322b2753981b058 Mon Sep 17 00:00:00 2001 From: yeuimu <2197651308@qq.com> Date: Thu, 3 Sep 2026 03:40:28 +0800 Subject: [PATCH] =?UTF-8?q?perf(deploy):=20=E8=BE=B9=E7=BC=98=20nginx=20?= =?UTF-8?q?=E6=89=BF=E5=8E=8B=E8=B0=83=E4=BC=98=E4=B8=8E=E8=BF=9E=E6=8E=A5?= =?UTF-8?q?=E6=B1=A0/PG=20=E5=8F=82=E6=95=B0=EF=BC=88P0-2/P0-3=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 主配置 nginx.conf 进镜像（worker_connections 16384 + rlimit 65536 + gzip + 带上游耗时的访问日志）：官方默认 1024×4=4096 连接硬顶是 1w 并发第一道墙 - admin.conf：upstream keepalive 64（proxy_http 1.1 + Connection ""）、 /public/ /v2-api/ 限流 50r/s burst 200（429）、代理超时 5s/30s、 /uploads/ /assets/ 30d 缓存头；admin.v2.conf 的 /v2/h5/ 哈希产物长缓存 - compose：PG 显式参数（statement_timeout=10s/max_connections=200/ shared_buffers=512MB）、DATABASE_URL connection_limit=50&pool_timeout=3 （单位秒，勿写毫秒；勿加 statement_cache_size=0）、admin ulimits nofile 65536 - 部署注意：主配置走镜像须 rebuild；PG 参数重启前按全局约束 pg_dump+快照存档 --- deploy/admin.Dockerfile | 3 +++ deploy/docker-compose.yml | 24 ++++++++++++++++++++- deploy/nginx/admin.conf | 44 ++++++++++++++++++++++++++++++++------ deploy/nginx/admin.v2.conf | 6 ++++++ deploy/nginx/nginx.conf | 44 ++++++++++++++++++++++++++++++++++++++ 5 files changed, 114 insertions(+), 7 deletions(-) create mode 100644 deploy/nginx/nginx.conf diff --git a/deploy/admin.Dockerfile b/deploy/admin.Dockerfile index 2e25a75..d04597c 100644 --- a/deploy/admin.Dockerfile +++ b/deploy/admin.Dockerfile @@ -17,6 +17,9 @@ COPY apps/admin apps/admin RUN pnpm --filter @inkreach/admin exec vite build FROM nginx:1.27-alpine +# 性能整改 P0-2：替换官方主配置（worker_connections 1024 → 16384、gzip、访问日志）； +# conf.d（admin.conf / admin.v2.conf）仍按服务挂载/拷贝 +COPY deploy/nginx/nginx.conf /etc/nginx/nginx.conf COPY --from=build /app/apps/admin/dist /usr/share/nginx/html/v2/admin COPY deploy/nginx/admin.conf /etc/nginx/conf.d/default.conf COPY deploy/h5 /usr/share/nginx/html/v2/h5 diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml index 9b04a89..a44fdcc 100644 --- a/deploy/docker-compose.yml +++ b/deploy/docker-compose.yml @@ -9,6 +9,20 @@ services: v2-postgres: image: postgres:16-alpine restart: unless-stopped + # 性能整改 P0-3（plans/refactor/public-capacity-10k-refactor.md）： + # - statement_timeout=10s：慢查询不无限期占住连接（池排队由此可控）； + # - max_connections=200：为未来 api 副本/同步 worker 预留（单 api 池 50）； + # - shared_buffers/effective_cache_size：14GB 内存机的工作集调优（数据 ~几十 MB，512MB 充裕）。 + # 部署注意（全局约束 §1）：改参数需重启容器（秒级中断）——先 pg_dump -Fc + 配置快照 + # 落 deploy/backups/<时间戳>/ 再低峰 force-recreate。 + command: + [ + "postgres", + "-c", "statement_timeout=10000", + "-c", "max_connections=200", + "-c", "shared_buffers=512MB", + "-c", "effective_cache_size=1536MB", + ] environment: POSTGRES_USER: inkreach POSTGRES_PASSWORD: ${POSTGRES_PASSWORD} @@ -32,7 +46,10 @@ services: environment: NODE_ENV: production PORT: 3001 - DATABASE_URL: postgresql://inkreach:${POSTGRES_PASSWORD}@v2-postgres:5432/inkreach + # 性能整改 P0-3：池上限 50 < PG max_connections 200（同步/运维连接留余量）； + # pool_timeout 单位是秒（Prisma 默认 10）——池耗尽 3s 快速失败而非挂 10s。 + # 不要加 statement_cache_size=0（pgbouncer 专用，直连禁 prepared statement 反而拖慢）。 + DATABASE_URL: postgresql://inkreach:${POSTGRES_PASSWORD}@v2-postgres:5432/inkreach?connection_limit=50&pool_timeout=3 JWT_SECRET: ${JWT_SECRET} CORS_ORIGINS: "*" # 激活 product-family 聚合公开读路径 @@ -65,6 +82,11 @@ services: ports: - "80:80" - "443:443" + # 性能整改 P0-2：4 worker × 16384 连接 + 上游 keepalive 需要容器 fd 预算匹配 + ulimits: + nofile: + soft: 65536 + hard: 65536 volumes: - ./nginx/admin.conf:/etc/nginx/conf.d/default.conf:ro - ./certbot/www:/var/www/certbot:ro diff --git a/deploy/nginx/admin.conf b/deploy/nginx/admin.conf index a77f5ac..9eeadcb 100644 --- a/deploy/nginx/admin.conf +++ b/deploy/nginx/admin.conf @@ -1,3 +1,15 @@ +# 上游长连接池（性能整改 P0-2）：与 v2-api 复用连接，消除每请求 TCP 建连； +# keepalive 连接需配合 proxy_http_version 1.1 + proxy_set_header Connection "" +upstream v2_api { + server v2-api:3001; + keepalive 64; +} + +# 防洪峰兜底限流（app 层 120 req/min/IP 更严，这里只挡瞬时洪峰/扫描； +# 默认 503 会误判服务故障，显式 429） +limit_req_zone $binary_remote_addr zone=public_api:10m rate=50r/s; +limit_req_status 429; + server { listen 80; server_name official.inkreach.cc; @@ -27,6 +39,7 @@ server { root /usr/share/nginx/html; + # ACME challenge for cert renewals location /.well-known/acme-challenge/ { root /var/www/certbot; } @@ -60,22 +73,32 @@ server { } location /v2-api/ { - proxy_pass http://v2-api:3001/; + proxy_pass http://v2_api/; proxy_http_version 1.1; + proxy_set_header Connection ""; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; + proxy_connect_timeout 5s; + proxy_read_timeout 30s; + proxy_send_timeout 30s; + limit_req zone=public_api burst=200 nodelay; } # H5 历史构建的 API 基址是同源相对路径 /public/*（BASE_URL="/"），直通 v2 api（路径原样透传） location /public/ { - proxy_pass http://v2-api:3001; + proxy_pass http://v2_api; proxy_http_version 1.1; + proxy_set_header Connection ""; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; + proxy_connect_timeout 5s; + proxy_read_timeout 30s; + proxy_send_timeout 30s; + limit_req zone=public_api burst=200 nodelay; } location = /h5 { @@ -86,16 +109,25 @@ server { try_files $uri $uri/ /h5/index.html; } - # Uploaded files served by the API + # Uploaded files served by the API. + # 缓存头注意：若运营有「同名替换图片」操作请改短 max-age 或改用版本化 URL location /uploads/ { - proxy_pass http://v2-api:3001/uploads/; + proxy_pass http://v2_api/uploads/; + proxy_http_version 1.1; + proxy_set_header Connection ""; proxy_set_header Host $host; + expires 30d; + add_header Cache-Control "public"; } - # Static product assets served by the API + # Static product assets served by the API（哈希文件名，可长缓存） location /assets/ { - proxy_pass http://v2-api:3001/assets/; + proxy_pass http://v2_api/assets/; + proxy_http_version 1.1; + proxy_set_header Connection ""; proxy_set_header Host $host; + expires 30d; + add_header Cache-Control "public"; } # Website placeholder until the public site is deployed diff --git a/deploy/nginx/admin.v2.conf b/deploy/nginx/admin.v2.conf index cc68c0a..1858cd2 100644 --- a/deploy/nginx/admin.v2.conf +++ b/deploy/nginx/admin.v2.conf @@ -25,8 +25,14 @@ server { add_header Cache-Control "no-cache"; } + # v2 版 H5（构建时 router.base 必须为 /v2/h5/，产物放 /usr/share/nginx/html/v2/h5） + # 性能整改 P0-2：哈希文件名的构建产物长缓存，index.html 永远 no-cache（上面精确匹配优先） location /v2/h5/ { try_files $uri $uri/ /v2/h5/index.html; + location ~* ^/v2/h5/(static|assets|img|fonts?)/ { + expires 30d; + add_header Cache-Control "public"; + } } location / { diff --git a/deploy/nginx/nginx.conf b/deploy/nginx/nginx.conf new file mode 100644 index 0000000..5041079 --- /dev/null +++ b/deploy/nginx/nginx.conf @@ -0,0 +1,44 @@ +# 边缘 nginx 主配置（性能整改 P0-2，plans/refactor/public-capacity-10k-refactor.md） +# 由 deploy/admin.Dockerfile COPY 进镜像替换官方默认——官方默认 worker_connections 1024 +# × 4 worker = 4096 连接硬顶，扛不住 1w 并发口径；events{} 只存在于主配置，conf.d 覆盖不了。 +# 注意：admin 与 v2-admin 共用本 Dockerfile，两侧都会得到本主配置（upstream/gzip 对 +# v2-admin 无害；worker_connections 抬升对静态服务同样受益）。 +user nginx; +worker_processes auto; +# 每 worker 连接预算上限（4 × 16384 客户端连接 + 上游 keepalive 连接） +worker_rlimit_nofile 65536; + +error_log /var/log/nginx/error.log warn; +pid /var/run/nginx.pid; + +events { + worker_connections 16384; + multi_accept on; +} + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + # 1w 并发下无访问日志无从排障：带上游耗时的结构化日志（rt=总耗时 urt=上游耗时） + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" "$http_user_agent" ' + 'rt=$request_time uct=$upstream_connect_time urt=$upstream_response_time'; + access_log /var/log/nginx/access.log main; + + sendfile on; + tcp_nopush on; + tcp_nodelay on; + keepalive_timeout 65; + types_hash_max_size 2048; + + # 压缩：API JSON（详情含 ~11KB price_matrix）与 SPA 静态资源，带宽降 5~10x + gzip on; + gzip_vary on; + gzip_proxied any; + gzip_comp_level 5; + gzip_min_length 1024; + gzip_types application/json application/javascript text/css text/plain text/xml image/svg+xml; + + include /etc/nginx/conf.d/*.conf; +}