Proxy 與 Reverse Proxy 完全解析：正向代理與反向代理 | Networking

# /etc/nginx/conf.d/app.conf

# 定義後端伺服器群組
upstream backend {
    server 10.0.0.1:3000;
    server 10.0.0.2:3000;
    server 10.0.0.3:3000;
}

# HTTP → HTTPS 重導向
server {
    listen 80;
    server_name app.example.com;

    return 301 https://$host$request_uri;
}

# HTTPS 伺服器
server {
    listen 443 ssl http2;
    server_name app.example.com;

    # SSL 憑證
    ssl_certificate     /etc/nginx/ssl/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/privkey.pem;

    # 反向代理：將所有請求轉發到後端
    location / {
        proxy_pass http://backend;
        proxy_http_version 1.1;
    }
}

location / {
    proxy_pass http://backend;

    # 傳遞客戶端真實 IP
    proxy_set_header X-Real-IP       $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    # 傳遞原始 Host
    proxy_set_header Host $host;

    # 傳遞原始協定（HTTP 或 HTTPS）
    proxy_set_header X-Forwarded-Proto $scheme;

    # 連線設定
    proxy_set_header Connection "";
    proxy_http_version 1.1;
}

# WebSocket 代理
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

upstream websocket_backend {
    server 10.0.0.1:8080;
    server 10.0.0.2:8080;
    ip_hash;  # WebSocket 需要 Sticky Session（固定會話）
}

server {
    listen 443 ssl;
    server_name ws.example.com;

    ssl_certificate     /etc/nginx/ssl/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/privkey.pem;

    location /ws {
        proxy_pass http://websocket_backend;

        # WebSocket 必要設定
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        # 標頭傳遞
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # 超時設定（WebSocket 是長連線）
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
    }
}

server {
    listen 443 ssl http2;
    server_name secure.example.com;

    # SSL 終止設定
    ssl_certificate     /etc/nginx/ssl/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    # HSTS（強制瀏覽器使用 HTTPS）
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;

    # 後端使用 HTTP（SSL 於 Nginx 終止）
    location / {
        proxy_pass http://backend;
        proxy_set_header X-Forwarded-Proto https;
    }
}

# 1. 輪詢（Round Robin）— Nginx 預設策略
#    依序將請求分配給每個後端伺服器
upstream backend_rr {
    server 10.0.0.1:3000;
    server 10.0.0.2:3000;
    server 10.0.0.3:3000;
}

# 2. 加權輪詢（Weighted Round Robin）
#    依權重比例分配流量，適合伺服器效能不同的情況
upstream backend_weighted {
    server 10.0.0.1:3000 weight=5;   # 50% 流量
    server 10.0.0.2:3000 weight=3;   # 30% 流量
    server 10.0.0.3:3000 weight=2;   # 20% 流量
}

# 3. IP Hash（同一客戶端固定到同一伺服器）
#    適合需要 Session 黏著的應用
upstream backend_iphash {
    ip_hash;
    server 10.0.0.1:3000;
    server 10.0.0.2:3000;
    server 10.0.0.3:3000;
}

# 4. 最少連線（Least Connections）
#    優先將請求分配給當前連線數最少的伺服器
upstream backend_least {
    least_conn;
    server 10.0.0.1:3000;
    server 10.0.0.2:3000;
    server 10.0.0.3:3000;
}

# 健康檢查配置
upstream backend_ha {
    server 10.0.0.1:3000 max_fails=3 fail_timeout=30s;
    server 10.0.0.2:3000 max_fails=3 fail_timeout=30s;
    server 10.0.0.3:3000 backup;  # 備用伺服器，僅在上方伺服器皆故障時啟用
}

# 定義快取區域
proxy_cache_path /var/cache/nginx
    levels=1:2                  # 目錄層級
    keys_zone=my_cache:10m      # 快取索引記憶體（10MB ≈ 80,000 keys）
    max_size=10g                # 最大磁碟空間
    inactive=60m                # 60 分鐘未存取則刪除
    use_temp_path=off;          # 直接寫入快取目錄

server {
    location /api/ {
        proxy_pass http://backend;

        # 啟用快取
        proxy_cache my_cache;
        proxy_cache_valid 200 10m;      # 200 回應快取 10 分鐘
        proxy_cache_valid 404 1m;       # 404 快取 1 分鐘

        # 後端故障時使用過期快取
        proxy_cache_use_stale error timeout updating http_500 http_502 http_503;

        # 自訂快取 key
        proxy_cache_key "$scheme$request_method$host$request_uri";

        # 回應中加入快取狀態標頭
        add_header X-Cache-Status $upstream_cache_status;
        # HIT     = 快取命中
        # MISS    = 快取未命中
        # EXPIRED = 快取過期（已回源取得新資料）
        # STALE   = 使用過期快取（後端故障時）

        # 不快取含認證標頭的請求
        proxy_no_cache $http_authorization;
        proxy_cache_bypass $http_authorization;
    }
}

# /etc/nginx/conf.d/production.conf

# 速率限制區域
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
limit_req_zone $binary_remote_addr zone=login_limit:10m rate=1r/s;

# 快取區域
proxy_cache_path /var/cache/nginx levels=1:2
    keys_zone=static_cache:10m max_size=1g
    inactive=60m use_temp_path=off;

# 後端伺服器群組
upstream api_backend {
    least_conn;
    server 10.0.0.1:3000 max_fails=3 fail_timeout=30s;
    server 10.0.0.2:3000 max_fails=3 fail_timeout=30s;
    server 10.0.0.3:3000 max_fails=3 fail_timeout=30s;
    keepalive 32;  # 保持後端連線池
}

server {
    listen 443 ssl http2;
    server_name app.example.com;

    # SSL 設定
    ssl_certificate     /etc/nginx/ssl/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;

    # 安全標頭
    add_header X-Frame-Options DENY always;
    add_header X-Content-Type-Options nosniff always;
    add_header X-XSS-Protection "1; mode=block" always;

    # gzip 壓縮
    gzip on;
    gzip_types text/plain text/css application/json application/javascript
               text/xml application/xml image/svg+xml;
    gzip_min_length 1000;

    # 靜態資源（啟用快取）
    location /static/ {
        proxy_pass http://api_backend;
        proxy_cache static_cache;
        proxy_cache_valid 200 1d;
        proxy_cache_valid 404 1m;
        add_header X-Cache-Status $upstream_cache_status;
    }

    # API 路由（速率限制）
    location /api/ {
        limit_req zone=api_limit burst=20 nodelay;

        proxy_pass http://api_backend;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # 超時設定
        proxy_connect_timeout 5s;
        proxy_read_timeout 30s;
        proxy_send_timeout 30s;

        # 後端錯誤頁面
        proxy_intercept_errors on;
        error_page 502 503 504 /50x.html;
    }

    # 登入路由（更嚴格的速率限制）
    location /api/auth/login {
        limit_req zone=login_limit burst=5 nodelay;
        proxy_pass http://api_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    # 健康檢查端點（不記錄日誌）
    location /health {
        access_log off;
        proxy_pass http://api_backend;
    }

    location = /50x.html {
        root /usr/share/nginx/html;
        internal;
    }
}

# Kubernetes Ingress 範例
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  annotations:
    # Nginx Ingress Controller 專用 annotation
    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
    nginx.ingress.kubernetes.io/rate-limit-rps: "10"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - app.example.com
    secretName: app-tls
  rules:
  - host: app.example.com
    http:
      paths:
      # /api 路徑導向 API 服務
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 3000
      # 其餘路徑導向前端服務
      - path: /
        pathType: Prefix
        backend:
          service:
            name: frontend-service
            port:
              number: 80