基本架构

Jun 2, 2023 at 3:28:07 AM

Cloudflare

位于最外层，服务用户，扛攻击。

需要一个专用的 Cloudflare 账号，一开始可以就先用 free tier 把服务调通。后续如果需要更细致的 cache 规则设定，可能会需要升级到 $200 每月的 business tier。

NGINX

Lua 规则将 Cloudflare 发送过来的 request header 中的 .bit 域名提取出来发送给 IPFS 后端。

目前 *.bit.v2ex.pro 的完整 NGINX 配置：

upstream bit_gateway_backend {
    server 127.0.0.1:8080;
    keepalive 4;
}

server {
    listen 80;
    listen [::]:80;
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    include /etc/nginx/ssl/bit.v2ex.pro.conf;

    server_name bit.v2ex.pro;
    server_name *.bit.v2ex.pro;
    access_log /var/log/nginx/bit.v2ex.pro.log;

    location / {
        set_by_lua_block $bit {
                local http_host = ngx.var.http_host
                local bit_domain, err = ngx.re.match(http_host, "([a-zA-Z0-9-]+\\.bit)(\\.v2ex\\.pro)")
                if bit_domain then
                    return bit_domain[1]
                else
                    return nil
                end
        }
        set $cache_key $scheme$bit$uri$is_args$args;
        proxy_cache_key $cache_key;
        proxy_pass_header Server;
        proxy_http_version 1.1;

        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Scheme $scheme;
        proxy_set_header Via "Planetable";
        proxy_set_header Host $bit;

        proxy_cache_revalidate on;
        proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504;
        proxy_cache_valid 200 60s;
        proxy_cache_background_update on;

        proxy_cache awesome;

        add_header CDN-Cache-Control "public, max-age=60, stale-while-revalidate=8640000";
        add_header Cache-Control "public, max-age=600, stale-while-revalidate=8640000";

        proxy_pass http://bit_gateway_backend;
    }
}