perf(deploy): 边缘 nginx 承压调优与连接池/PG 参数（P0-2/P0-3）
- 主配置 nginx.conf 进镜像（worker_connections 16384 + rlimit 65536 + gzip + 带上游耗时的访问日志）：官方默认 1024×4=4096 连接硬顶是 1w 并发第一道墙 - admin.conf：upstream keepalive 64（proxy_http 1.1 + Connection ""）、 /public/ /v2-api/ 限流 50r/s burst 200（429）、代理超时 5s/30s、 /uploads/ /assets/ 30d 缓存头；admin.v2.conf 的 /v2/h5/ 哈希产物长缓存 - compose：PG 显式参数（statement_timeout=10s/max_connections=200/ shared_buffers=512MB）、DATABASE_URL connection_limit=50&pool_timeout=3 （单位秒，勿写毫秒；勿加 statement_cache_size=0）、admin ulimits nofile 65536 - 部署注意：主配置走镜像须 rebuild；PG 参数重启前按全局约束 pg_dump+快照存档
This commit is contained in:
yeuimu
+38
-6
@@ -1,3 +1,15 @@
|
||||
# 上游长连接池（性能整改 P0-2）：与 v2-api 复用连接，消除每请求 TCP 建连；
|
||||
# keepalive 连接需配合 proxy_http_version 1.1 + proxy_set_header Connection ""
|
||||
upstream v2_api {
|
||||
server v2-api:3001;
|
||||
keepalive 64;
|
||||
}
|
||||
|
||||
# 防洪峰兜底限流（app 层 120 req/min/IP 更严，这里只挡瞬时洪峰/扫描；
|
||||
# 默认 503 会误判服务故障，显式 429）
|
||||
limit_req_zone $binary_remote_addr zone=public_api:10m rate=50r/s;
|
||||
limit_req_status 429;
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name official.inkreach.cc;
|
||||
@@ -27,6 +39,7 @@ server {
|
||||
|
||||
root /usr/share/nginx/html;
|
||||
|
||||
# ACME challenge for cert renewals
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/certbot;
|
||||
}
|
||||
@@ -60,22 +73,32 @@ server {
|
||||
}
|
||||
|
||||
location /v2-api/ {
|
||||
proxy_pass http://v2-api:3001/;
|
||||
proxy_pass http://v2_api/;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Connection "";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_connect_timeout 5s;
|
||||
proxy_read_timeout 30s;
|
||||
proxy_send_timeout 30s;
|
||||
limit_req zone=public_api burst=200 nodelay;
|
||||
}
|
||||
|
||||
# H5 历史构建的 API 基址是同源相对路径 /public/*（BASE_URL="/"），直通 v2 api（路径原样透传）
|
||||
location /public/ {
|
||||
proxy_pass http://v2-api:3001;
|
||||
proxy_pass http://v2_api;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Connection "";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_connect_timeout 5s;
|
||||
proxy_read_timeout 30s;
|
||||
proxy_send_timeout 30s;
|
||||
limit_req zone=public_api burst=200 nodelay;
|
||||
}
|
||||
|
||||
location = /h5 {
|
||||
@@ -86,16 +109,25 @@ server {
|
||||
try_files $uri $uri/ /h5/index.html;
|
||||
}
|
||||
|
||||
# Uploaded files served by the API
|
||||
# Uploaded files served by the API.
|
||||
# 缓存头注意：若运营有「同名替换图片」操作请改短 max-age 或改用版本化 URL
|
||||
location /uploads/ {
|
||||
proxy_pass http://v2-api:3001/uploads/;
|
||||
proxy_pass http://v2_api/uploads/;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Connection "";
|
||||
proxy_set_header Host $host;
|
||||
expires 30d;
|
||||
add_header Cache-Control "public";
|
||||
}
|
||||
|
||||
# Static product assets served by the API
|
||||
# Static product assets served by the API（哈希文件名，可长缓存）
|
||||
location /assets/ {
|
||||
proxy_pass http://v2-api:3001/assets/;
|
||||
proxy_pass http://v2_api/assets/;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Connection "";
|
||||
proxy_set_header Host $host;
|
||||
expires 30d;
|
||||
add_header Cache-Control "public";
|
||||
}
|
||||
|
||||
# Website placeholder until the public site is deployed
|
||||
|
||||
@@ -25,8 +25,14 @@ server {
|
||||
add_header Cache-Control "no-cache";
|
||||
}
|
||||
|
||||
# v2 版 H5（构建时 router.base 必须为 /v2/h5/，产物放 /usr/share/nginx/html/v2/h5）
|
||||
# 性能整改 P0-2：哈希文件名的构建产物长缓存，index.html 永远 no-cache（上面精确匹配优先）
|
||||
location /v2/h5/ {
|
||||
try_files $uri $uri/ /v2/h5/index.html;
|
||||
location ~* ^/v2/h5/(static|assets|img|fonts?)/ {
|
||||
expires 30d;
|
||||
add_header Cache-Control "public";
|
||||
}
|
||||
}
|
||||
|
||||
location / {
|
||||
|
||||
@@ -0,0 +1,44 @@
|
||||
# 边缘 nginx 主配置（性能整改 P0-2，plans/refactor/public-capacity-10k-refactor.md）
|
||||
# 由 deploy/admin.Dockerfile COPY 进镜像替换官方默认——官方默认 worker_connections 1024
|
||||
# × 4 worker = 4096 连接硬顶，扛不住 1w 并发口径；events{} 只存在于主配置，conf.d 覆盖不了。
|
||||
# 注意：admin 与 v2-admin 共用本 Dockerfile，两侧都会得到本主配置（upstream/gzip 对
|
||||
# v2-admin 无害；worker_connections 抬升对静态服务同样受益）。
|
||||
user nginx;
|
||||
worker_processes auto;
|
||||
# 每 worker 连接预算上限（4 × 16384 客户端连接 + 上游 keepalive 连接）
|
||||
worker_rlimit_nofile 65536;
|
||||
|
||||
error_log /var/log/nginx/error.log warn;
|
||||
pid /var/run/nginx.pid;
|
||||
|
||||
events {
|
||||
worker_connections 16384;
|
||||
multi_accept on;
|
||||
}
|
||||
|
||||
http {
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
# 1w 并发下无访问日志无从排障：带上游耗时的结构化日志（rt=总耗时 urt=上游耗时）
|
||||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||
'$status $body_bytes_sent "$http_referer" "$http_user_agent" '
|
||||
'rt=$request_time uct=$upstream_connect_time urt=$upstream_response_time';
|
||||
access_log /var/log/nginx/access.log main;
|
||||
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
tcp_nodelay on;
|
||||
keepalive_timeout 65;
|
||||
types_hash_max_size 2048;
|
||||
|
||||
# 压缩：API JSON（详情含 ~11KB price_matrix）与 SPA 静态资源，带宽降 5~10x
|
||||
gzip on;
|
||||
gzip_vary on;
|
||||
gzip_proxied any;
|
||||
gzip_comp_level 5;
|
||||
gzip_min_length 1024;
|
||||
gzip_types application/json application/javascript text/css text/plain text/xml image/svg+xml;
|
||||
|
||||
include /etc/nginx/conf.d/*.conf;
|
||||
}
|
||||
Reference in New Issue
Block a user