谷咕云计算

推薦架構：
彈性公網IP（EIP） -> 負載均衡CLB -> CVM代理叢集
                    ↓
                安全組（放行特定埠）

# /etc/nginx/conf.d/proxy.conf
server {
    listen 80;
    server_name proxy.example.com;
    
    location / {
        proxy_pass http://backend_server_pool;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        
        # 連線超時控制
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 120s;
    }
}

upstream backend_server_pool {
    server 10.0.1.5:8080 weight=5;  # 內網CVM地址
    server 10.0.1.6:8080 weight=3;
    keepalive 32;  # 長連線最佳化
}

# 申請免費證書
curl https://get.acme.sh | sh
acme.sh --issue -d proxy.example.com --webroot /var/www/html

# 自動更新配置
acme.sh --install-cert -d proxy.example.com \
--key-file /etc/nginx/ssl/proxy.key \
--fullchain-file /etc/nginx/ssl/proxy.crt \
--reloadcmd "systemctl reload nginx"

# 統計TCP重傳率
nstat -z | grep -E 'TcpRetransSegs|TcpOutSegs'
ss -itp | grep retrans

# /etc/sysctl.conf
net.ipv4.tcp_syn_retries = 3
net.ipv4.tcp_keepalive_time = 600
net.core.somaxconn = 65535

# 使用騰訊雲API動態更換EIP
import tencentcloud

client = tencentcloud.EipClient()
def rotate_eip():
    old_eip = client.describe_addresses()['AddressSet'][0]
    client.unbind_eip(old_eip['AddressId'])
    new_eip = client.allocate_address()['AddressSet'][0]
    client.bind_eip(new_eip['AddressId'], instance_id)

推薦架構：
主代理節點（固定IP） -> 子代理叢集（動態IP池）
                ↓
            使用Redis管理IP可用狀態

# 隨機化請求頭
headers = {
    'User-Agent': random.choice(user_agent_list),
    'Accept-Encoding': 'gzip, deflate, br',
    'X-Forwarded-For': fake_ip_generator()
}

# 使用CLS日誌服務收集代理日誌
log_format proxy_log '$remote_addr - $remote_user [$time_local] '
                     '"$request" $status $body_bytes_sent '
                     '"$http_referer" "$http_user_agent" '
                     '$upstream_addr $request_time';
                     
access_log /var/log/nginx/proxy.log proxy_log;

# 使用雲監控CMS設定報警規則
tcli monitor CreateAlarmPolicy \
--PolicyName "ProxyHealthCheck" \
--Conditions '[{
    "MetricName":"ResponseTime",
    "CalcType":">=",
    "Threshold":5000,
    "ContinuePeriod":3
}]' \
--ReceiverGroups "運維應急小組"

# 調整擁塞控制演算法
sysctl -w net.ipv4.tcp_congestion_control=bbr

# 提升連線追蹤表容量
sysctl -w net.netfilter.nf_conntrack_max=1000000
sysctl -w net.netfilter.nf_conntrack_tcp_timeout_established=86400

# 基於GEOIP分流
map $geoip_country_code $backend_pool {
    default     backend_global;
    CN          backend_cn;
    US          backend_us;
}

tcpdump -i eth0 -G 3600 -w /captures/proxy-%Y%m%d%H.pcap