【Nginx】OpenResty 高性能网关：Nginx 核心执行阶段与 Lua 指令实战

+-------------------------------------------------------------+
|               Master 启动与配置重新加载 (Reload)               |
|                     init_by_lua                             |
+-------------------------------------------------------------+
                              |
+-------------------------------------------------------------+
|                 Worker 进程启动与初始化                      |
|                  init_worker_by_lua                         |
+-------------------------------------------------------------+
                              |
           [ 客户端 HTTP 请求接入 (Client Request) ]
                              |
+-------------------------------------------------------------+
| 1. SSL 握手阶段: ssl_certificate_by_lua                      |
| 2. 变量赋值阶段: set_by_lua                                  |
| 3. URL 重写阶段: rewrite_by_lua                              |
| 4. 权限控制阶段: access_by_lua                               |
| 5. 内容生成阶段: content_by_lua                              |
| 6. 响应头过滤阶段: header_filter_by_lua                      |
| 7. 响应体过滤阶段: body_filter_by_lua                        |
| 8. 日志记录阶段: log_by_lua                                  |
+-------------------------------------------------------------+

# 在 nginx.conf 的 http 块中配置
http {
    # 声明一块名为 shared_data 的共享内存字典 (所有 Worker 共享)
    lua_shared_dict shared_data 10m;

    # 预加载核心模块并初始化
    init_by_lua_file /etc/nginx/lua/init.lua;

    server {
        listen 80;
        location /test_init {
            default_type text/plain;
            content_by_lua_file /etc/nginx/lua/test_init.lua;
        }
    }
}

-- 预加载常用核心 C/Lua 模块，避免每个 Worker 首次请求时重复加载
local cjson = require("cjson")

-- 规范：初始化跨 Worker 共享内存字典
local shared_data = ngx.shared.shared_data
shared_data:set("visit_count", 0)

local shared_data = ngx.shared.shared_data

-- 原子递增访问计数
local newval, err = shared_data:incr("visit_count", 1)

ngx.say("Shared Memory Counter: ", newval)

http {
    # 任务队列容量与并发上限调优
    lua_max_pending_timers 1024;
    lua_max_running_timers 256;

    init_worker_by_lua_file /etc/nginx/lua/init_worker.lua;
}

local delay = 5 -- 每隔 5 秒轮询一次
local check_heartbeat

check_heartbeat = function(premature)
    -- premature 为 true 表示 Nginx 正在退出或平滑重载
    if premature then
        ngx.log(ngx.INFO, "Worker shutting down, timer stopped.")
        return
    end

    -- 仅允许第 0 号 Worker 执行定时任务，避免多 Worker 重复执行
    if ngx.worker.id() ~= 0 then
        return
    end

    ngx.log(ngx.INFO, "Executing periodic background heartbeat check...")

    -- 重新注册下一次定时器 (实现递归循环)
    local ok, err = ngx.timer.at(delay, check_heartbeat)
    if not ok then
        ngx.log(ngx.ERR, "Failed to create next heartbeat timer: ", err)
    end
end

-- 立即注册第一次定时器 (0 秒延迟)
local ok, err = ngx.timer.at(0, check_heartbeat)
if not ok then
    ngx.log(ngx.ERR, "Failed to startup worker heartbeat: ", err)
end

server {
    listen 80;

    location /goods/detail {
        set $target_backend "";

        # 利用 Lua 执行复杂的条件运算，返回计算后的变量值
        set_by_lua $target_backend '
            local uri_args = ngx.req.get_uri_args()
            local sku_id = uri_args["sku_id"] or ""
            local is_gray = ngx.var.cookie_gray_user == "true"

            -- 如果命中灰度 Cookie 或者是 8 位特定类目商品，转发至新架构
            if is_gray or string.match(sku_id, "^99%d%d%d%d%d%d$") then
                return "backend_v2"
            else
                return "backend_legacy"
            end
        ';

        proxy_pass http://$target_backend;
    }
}

-- 检查客户端必须携带特定签名，否则重定向到登录网关
local args = ngx.req.get_uri_args()
if not args["token"] then
    return ngx.redirect("https://auth.example.com/login?redirect=" .. ngx.var.request_uri, 302)
end

-- 案例：重置 URI 并重写 Query 参数
ngx.req.set_uri("/internal_api/v2", false)
ngx.req.set_uri_args({ version = "2.0", source = "mobile" })

location /api/protected/ {
    access_by_lua_block {
        local headers = ngx.req.get_headers()
        local token = headers["Authorization"]

        -- 1. 鉴权校验：Token 缺失直接阻断并返回 401
        if not token or token == "" then
            ngx.status = ngx.HTTP_UNAUTHORIZED
            ngx.header.content_type = "application/json; charset=utf-8"
            ngx.say('{"code": 401, "message": "Missing Authorization Token"}')
            return ngx.exit(ngx.HTTP_OK)
        end

        -- 2. 快速拦截恶意攻击参数
        local args = ngx.req.get_uri_args()
        if args["sql"] or args["script"] then
            ngx.log(ngx.WARN, "Potential injection attack detected from: ", ngx.var.remote_addr)
            return ngx.exit(ngx.HTTP_FORBIDDEN)
        end
    }

    proxy_pass http://backend_business;
}