perf(deploy): 边缘 nginx 承压调优与连接池/PG 参数（P0-2/P0-3）

- 主配置 nginx.conf 进镜像（worker_connections 16384 + rlimit 65536 + gzip
  + 带上游耗时的访问日志）：官方默认 1024×4=4096 连接硬顶是 1w 并发第一道墙
- admin.conf：upstream keepalive 64（proxy_http 1.1 + Connection ""）、
  /public/ /v2-api/ 限流 50r/s burst 200（429）、代理超时 5s/30s、
  /uploads/ /assets/ 30d 缓存头；admin.v2.conf 的 /v2/h5/ 哈希产物长缓存
- compose：PG 显式参数（statement_timeout=10s/max_connections=200/
  shared_buffers=512MB）、DATABASE_URL connection_limit=50&pool_timeout=3
  （单位秒，勿写毫秒；勿加 statement_cache_size=0）、admin ulimits nofile 65536
- 部署注意：主配置走镜像须 rebuild；PG 参数重启前按全局约束 pg_dump+快照存档

deploy/admin.Dockerfile

@@ -17,6 +17,9 @@ COPY apps/admin apps/admin
 RUN pnpm --filter @inkreach/admin exec vite build
 
 FROM nginx:1.27-alpine
+# 性能整改 P0-2：替换官方主配置（worker_connections 1024 → 16384、gzip、访问日志）；
+# conf.d（admin.conf / admin.v2.conf）仍按服务挂载/拷贝
+COPY deploy/nginx/nginx.conf /etc/nginx/nginx.conf
 COPY --from=build /app/apps/admin/dist /usr/share/nginx/html/v2/admin
 COPY deploy/nginx/admin.conf /etc/nginx/conf.d/default.conf
 COPY deploy/h5 /usr/share/nginx/html/v2/h5

deploy/docker-compose.yml

@@ -9,6 +9,20 @@ services:
   v2-postgres:
     image: postgres:16-alpine
     restart: unless-stopped
+    # 性能整改 P0-3（plans/refactor/public-capacity-10k-refactor.md）：
+    # - statement_timeout=10s：慢查询不无限期占住连接（池排队由此可控）；
+    # - max_connections=200：为未来 api 副本/同步 worker 预留（单 api 池 50）；
+    # - shared_buffers/effective_cache_size：14GB 内存机的工作集调优（数据 ~几十 MB，512MB 充裕）。
+    # 部署注意（全局约束 §1）：改参数需重启容器（秒级中断）——先 pg_dump -Fc + 配置快照
+    # 落 deploy/backups/<时间戳>/ 再低峰 force-recreate。
+    command:
+      [
+        "postgres",
+        "-c", "statement_timeout=10000",
+        "-c", "max_connections=200",
+        "-c", "shared_buffers=512MB",
+        "-c", "effective_cache_size=1536MB",
+      ]
     environment:
       POSTGRES_USER: inkreach
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
@@ -32,7 +46,10 @@ services:
     environment:
       NODE_ENV: production
       PORT: 3001
-      DATABASE_URL: postgresql://inkreach:${POSTGRES_PASSWORD}@v2-postgres:5432/inkreach
+      # 性能整改 P0-3：池上限 50 < PG max_connections 200（同步/运维连接留余量）；
+      # pool_timeout 单位是秒（Prisma 默认 10）——池耗尽 3s 快速失败而非挂 10s。
+      # 不要加 statement_cache_size=0（pgbouncer 专用，直连禁 prepared statement 反而拖慢）。
+      DATABASE_URL: postgresql://inkreach:${POSTGRES_PASSWORD}@v2-postgres:5432/inkreach?connection_limit=50&pool_timeout=3
       JWT_SECRET: ${JWT_SECRET}
       CORS_ORIGINS: "*"
       # 激活 product-family 聚合公开读路径
@@ -65,6 +82,11 @@ services:
     ports:
       - "80:80"
       - "443:443"
+    # 性能整改 P0-2：4 worker × 16384 连接 + 上游 keepalive 需要容器 fd 预算匹配
+    ulimits:
+      nofile:
+        soft: 65536
+        hard: 65536
     volumes:
       - ./nginx/admin.conf:/etc/nginx/conf.d/default.conf:ro
       - ./certbot/www:/var/www/certbot:ro

deploy/nginx/admin.conf

@@ -1,3 +1,15 @@
+# 上游长连接池（性能整改 P0-2）：与 v2-api 复用连接，消除每请求 TCP 建连；
+# keepalive 连接需配合 proxy_http_version 1.1 + proxy_set_header Connection ""
+upstream v2_api {
+    server v2-api:3001;
+    keepalive 64;
+}
+
+# 防洪峰兜底限流（app 层 120 req/min/IP 更严，这里只挡瞬时洪峰/扫描；
+# 默认 503 会误判服务故障，显式 429）
+limit_req_zone $binary_remote_addr zone=public_api:10m rate=50r/s;
+limit_req_status 429;
+
 server {
     listen 80;
     server_name official.inkreach.cc;
@@ -27,6 +39,7 @@ server {
 
     root /usr/share/nginx/html;
 
+    # ACME challenge for cert renewals
     location /.well-known/acme-challenge/ {
         root /var/www/certbot;
     }
@@ -60,22 +73,32 @@ server {
     }
 
     location /v2-api/ {
-        proxy_pass http://v2-api:3001/;
+        proxy_pass http://v2_api/;
         proxy_http_version 1.1;
+        proxy_set_header Connection "";
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_connect_timeout 5s;
+        proxy_read_timeout 30s;
+        proxy_send_timeout 30s;
+        limit_req zone=public_api burst=200 nodelay;
     }
 
     # H5 历史构建的 API 基址是同源相对路径 /public/*（BASE_URL="/"），直通 v2 api（路径原样透传）
     location /public/ {
-        proxy_pass http://v2-api:3001;
+        proxy_pass http://v2_api;
         proxy_http_version 1.1;
+        proxy_set_header Connection "";
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_connect_timeout 5s;
+        proxy_read_timeout 30s;
+        proxy_send_timeout 30s;
+        limit_req zone=public_api burst=200 nodelay;
     }
 
     location = /h5 {
@@ -86,16 +109,25 @@ server {
         try_files $uri $uri/ /h5/index.html;
     }
 
-    # Uploaded files served by the API
+    # Uploaded files served by the API.
+    # 缓存头注意：若运营有「同名替换图片」操作请改短 max-age 或改用版本化 URL
     location /uploads/ {
-        proxy_pass http://v2-api:3001/uploads/;
+        proxy_pass http://v2_api/uploads/;
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
         proxy_set_header Host $host;
+        expires 30d;
+        add_header Cache-Control "public";
     }
 
-    # Static product assets served by the API
+    # Static product assets served by the API（哈希文件名，可长缓存）
     location /assets/ {
-        proxy_pass http://v2-api:3001/assets/;
+        proxy_pass http://v2_api/assets/;
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
         proxy_set_header Host $host;
+        expires 30d;
+        add_header Cache-Control "public";
     }
 
     # Website placeholder until the public site is deployed

deploy/nginx/admin.v2.conf

@@ -25,8 +25,14 @@ server {
         add_header Cache-Control "no-cache";
     }
 
+    # v2 版 H5（构建时 router.base 必须为 /v2/h5/，产物放 /usr/share/nginx/html/v2/h5）
+    # 性能整改 P0-2：哈希文件名的构建产物长缓存，index.html 永远 no-cache（上面精确匹配优先）
     location /v2/h5/ {
         try_files $uri $uri/ /v2/h5/index.html;
+        location ~* ^/v2/h5/(static|assets|img|fonts?)/ {
+            expires 30d;
+            add_header Cache-Control "public";
+        }
     }
 
     location / {

deploy/nginx/nginx.conf

@@ -0,0 +1,44 @@
+# 边缘 nginx 主配置（性能整改 P0-2，plans/refactor/public-capacity-10k-refactor.md）
+# 由 deploy/admin.Dockerfile COPY 进镜像替换官方默认——官方默认 worker_connections 1024
+# × 4 worker = 4096 连接硬顶，扛不住 1w 并发口径；events{} 只存在于主配置，conf.d 覆盖不了。
+# 注意：admin 与 v2-admin 共用本 Dockerfile，两侧都会得到本主配置（upstream/gzip 对
+# v2-admin 无害；worker_connections 抬升对静态服务同样受益）。
+user  nginx;
+worker_processes  auto;
+# 每 worker 连接预算上限（4 × 16384 客户端连接 + 上游 keepalive 连接）
+worker_rlimit_nofile 65536;
+
+error_log  /var/log/nginx/error.log warn;
+pid        /var/run/nginx.pid;
+
+events {
+    worker_connections 16384;
+    multi_accept on;
+}
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    # 1w 并发下无访问日志无从排障：带上游耗时的结构化日志（rt=总耗时 urt=上游耗时）
+    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                    '$status $body_bytes_sent "$http_referer" "$http_user_agent" '
+                    'rt=$request_time uct=$upstream_connect_time urt=$upstream_response_time';
+    access_log  /var/log/nginx/access.log main;
+
+    sendfile      on;
+    tcp_nopush    on;
+    tcp_nodelay   on;
+    keepalive_timeout 65;
+    types_hash_max_size 2048;
+
+    # 压缩：API JSON（详情含 ~11KB price_matrix）与 SPA 静态资源，带宽降 5~10x
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 5;
+    gzip_min_length 1024;
+    gzip_types application/json application/javascript text/css text/plain text/xml image/svg+xml;
+
+    include /etc/nginx/conf.d/*.conf;
+}