Nginx 高并发调优与 TLS 1.3 实践¶

# /etc/nginx/nginx.conf

# 1. 自动检测并启动与 CPU 物理核心数相等的 Worker 进程
worker_processes auto;
worker_cpu_affinity auto;

# 2. 突破默认文件描述符限制
worker_rlimit_nofile 1048576;

events {
    # 采用 Linux 最高效的 epoll 多路复用模型
    use epoll;

    # 单个 worker 进程允许的最大并发连接数 (默认 1024 太小)
    worker_connections 65535;

    # 允许单个 worker 一次性 accept 接收全量就绪的新连接
    multi_accept on;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    # 3. 磁盘与网络传输黑魔法优化
    sendfile        on;      # 开启 Linux 零拷贝 sendfile()
    tcp_nopush      on;      # 仅在 sendfile 开启时生效：将 HTTP 响应头与数据整合为一个满包发送
    tcp_nodelay     on;      # 禁用 Nagle 算法，小数据包即刻发送，降低 API 响应延迟

    # 4. 超时时间调优
    keepalive_timeout  65;
    client_header_timeout 15;
    client_body_timeout 15;
    send_timeout 15;

    # 5. 【TLS 1.3 极速加密与握手优化】
    ssl_protocols TLSv1.2 TLSv1.3; # 淘汰不安全的 TLS 1.0 / 1.1
    ssl_prefer_server_ciphers off; # TLS 1.3 推荐由客户端与服务端自动协商最优强套件
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;

    # 会话缓存：使用 50MB 共享内存缓存 SSL Session，大幅降低 RSA/ECC 解密 CPU 消耗
    ssl_session_cache shared:SSL:50m;
    ssl_session_timeout 1d;
    ssl_session_tickets on; # 启用 Session Tickets 客户端无状态恢复

    # 开启 OCSP Stapling (在线证书状态装订)，消除客户端向 CA 验证证书吊销状态的网络延迟
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 1.1.1.1 valid=300s;
    resolver_timeout 5s;

    # 6. 【上游微服务长连接池化 (Upstream Keepalive)】
    upstream backend_api_cluster {
        server 10.0.1.10:8080 weight=5 max_fails=3 fail_timeout=10s;
        server 10.0.1.11:8080 weight=5 max_fails=3 fail_timeout=10s;

        # 维持与后端上游微服务的 HTTP/1.1 空闲长连接数 (杜绝每次转发都重新发起 TCP 三次握手!)
        keepalive 128;
    }

    server {
        listen 443 ssl http2 reuseport; # 开启 HTTP/2 与 SO_REUSEPORT 内核负载均衡
        server_name api.enterprise.org;

        ssl_certificate     /etc/ssl/certs/fullchain.pem;
        ssl_certificate_key /etc/ssl/certs/privkey.pem;

        location / {
            proxy_pass http://backend_api_cluster;

            # 必须显式配置 HTTP/1.1 并清空 Connection 头部，以激活 upstream keepalive 长连接
            proxy_http_version 1.1;
            proxy_set_header Connection "";

            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }
}