第十二章：把前面能力串起来 —— 一份完整可落地的城市总闸口配置

worker_processes auto;

events {
    worker_connections 2048;
}

http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile      on;
    keepalive_timeout 65;

    log_format main escape=json
        '{'
            '"time":"$time_iso8601",'
            '"remote_addr":"$remote_addr",'
            '"request":"$request",'
            '"status":$status,'
            '"request_time":$request_time,'
            '"upstream_addr":"$upstream_addr",'
            '"upstream_status":"$upstream_status",'
            '"upstream_response_time":"$upstream_response_time"'
        '}';

    access_log /var/log/nginx/access.log main;
    error_log  /var/log/nginx/error.log warn;

    proxy_cache_path /var/cache/nginx/content
                     levels=1:2
                     keys_zone=content_cache:50m
                     max_size=1g
                     inactive=30m
                     use_temp_path=off;

    upstream api_backend {
        least_conn;
        server 127.0.0.1:3001 max_fails=3 fail_timeout=10s;
        server 127.0.0.1:3002 max_fails=3 fail_timeout=10s;
        keepalive 32;
    }

    server {
        listen 80;
        server_name example.com www.example.com;

        return 301 https://$host$request_uri;
    }

    server {
        listen 443 ssl;
        server_name example.com www.example.com;

        ssl_certificate     /etc/nginx/certs/example.com.fullchain.pem;
        ssl_certificate_key /etc/nginx/certs/example.com.key;

        root /srv/www/app;
        index index.html;

        location = /healthz {
            default_type text/plain;
            return 200 "ok\n";
        }

        location ^~ /assets/ {
            try_files $uri =404;
            expires 30d;
            add_header Cache-Control "public, immutable";
        }

        location /content/ {
            proxy_cache content_cache;
            proxy_cache_methods GET HEAD;
            proxy_cache_valid 200 10m;
            proxy_cache_valid 404 1m;
            add_header X-Cache-Status $upstream_cache_status always;

            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;

            proxy_pass http://api_backend;
        }

        location /api/ {
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;

            proxy_connect_timeout 5s;
            proxy_send_timeout 30s;
            proxy_read_timeout 30s;

            proxy_pass http://api_backend/;
        }

        location / {
            try_files $uri $uri/ /index.html;
        }
    }
}

公网流量
   |
   v
80 端口闸门 ------> 强制跳 HTTPS
   |
   v
443 端口主闸门
   |
   +--> /healthz      -> 直接返回
   +--> /assets/      -> 静态资源仓库
   +--> /content/     -> 先查缓存，再去内容后端
   +--> /api/         -> 代理到 API 集群
   +--> /             -> 前端 SPA 入口