Nginx反向代理的超时配置指南

location /api/ {
    proxy_pass http://backend-servers;
    proxy_connect_timeout 120s;  # ❌ 危险！
}

# application.yml
server:
  connection-timeout: 30000  # 30秒

// delayedconnectioncontroller.java
@restcontroller
@requestmapping("/debug")
public class delayedconnectioncontroller {
    private static final logger log = loggerfactory.getlogger(delayedconnectioncontroller.class);
    /**
     * 模拟后端服务在 accept() 之前人为延迟（模拟服务启动中、负载过高无法 accept）
     * 注意：这不是 http 延迟，而是 tcp 层的 accept() 阻塞！
     */
    @getmapping("/slow-accept")
    public responseentity<string> slowaccept(
            @requestparam(defaultvalue = "5000") long delayms) {
        // 记录日志，便于与 nginx access_log 关联
        log.info("received /slow-accept request. will delay accept for {}ms", delayms);
        try {
            // 模拟内核队列满或进程忙，导致 accept() 被阻塞
            thread.sleep(delayms);
        } catch (interruptedexception e) {
            thread.currentthread().interrupt();
            return responseentity.status(500).body("interrupted");
        }
        return responseentity.ok("accepted after " + delayms + "ms");
    }
    /**
     * 模拟服务完全不可达（不监听端口），用于测试 connection refused
     */
    @getmapping("/unreachable")
    public responseentity<string> unreachable() {
        // 此 endpoint 不做任何事，仅作占位
        // 真正的“不可达”需在部署时关闭该端口或防火墙拦截
        return responseentity.ok("this endpoint is for unreachable test only.");
    }
}

# nginx-test.conf —— 用于本地 curl 测试
events {
    worker_connections 1024;
}
http {
    include       mime.types;
    default_type  application/octet-stream;
    # 日志格式增强，包含 upstream connect time
    log_format main '$remote_addr - $remote_user [$time_local] '
                     '"$request" $status $body_bytes_sent '
                     '"$http_referer" "$http_user_agent" '
                     'rt=$request_time uct="$upstream_connect_time" '
                     'uht="$upstream_header_time" udt="$upstream_response_time"';
    access_log logs/access.log main;
    upstream slow-backend {
        server 127.0.0.1:8080; # spring boot 默认端口
        # 不配置 backup 或 down，确保只打到这一台
    }
    # === 测试路径 a：proxy_connect_timeout=3s ===
    server {
        listen 8081;
        server_name localhost;
        location /api/slow-3s/ {
            proxy_pass http://slow-backend;
            proxy_connect_timeout 3s;
            proxy_send_timeout 30s;
            proxy_read_timeout 30s;
            proxy_set_header host $host;
            proxy_set_header x-real-ip $remote_addr;
        }
    }
    # === 测试路径 b：proxy_connect_timeout=10s ===
    server {
        listen 8082;
        server_name localhost;
        location /api/slow-10s/ {
            proxy_pass http://slow-backend;
            proxy_connect_timeout 10s;
            proxy_send_timeout 30s;
            proxy_read_timeout 30s;
            proxy_set_header host $host;
            proxy_set_header x-real-ip $remote_addr;
        }
    }
}

java -jar demo.jar --server.port=8080

nginx -c /path/to/nginx-test.conf -p $(pwd) -g "daemon off;"

# 测试 3s timeout：后端延迟 5s → 必然超时
curl -v "http://localhost:8081/api/slow-3s/slow-accept?delayms=5000"
# expected: http/1.1 504 gateway time-out, total time ≈ 3.01s

# 测试 10s timeout：后端延迟 5s → 成功
curl -v "http://localhost:8082/api/slow-10s/slow-accept?delayms=5000"
# expected: http/1.1 200 ok, total time ≈ 5.02s (spring boot sleep + 网络)

127.0.0.1 - - [15/jul/2024:10:22:33 +0000] "get /api/slow-3s/slow-accept?delayms=5000 http/1.1" 504 568 "-" "curl/7.81.0" rt=3.002 uct="3.001" uht="-" udt="-"
127.0.0.1 - - [15/jul/2024:10:22:41 +0000] "get /api/slow-10s/slow-accept?delayms=5000 http/1.1" 200 32 "-" "curl/7.81.0" rt=5.015 uct="0.001" uht="5.012" udt="5.014"

# application.yml
spring:
  cloud:
    gateway:
      httpclient:
        connect-timeout: 5000     # ✅ 对应 nginx proxy_connect_timeout
        response-timeout: 30000   # ✅ 对应 nginx proxy_read_timeout

# 边缘 nginx（只负责入口）
upstream scg-cluster {
    server 10.10.20.100:8080; # scg 实例
    server 10.10.20.101:8080;
}
server {
    listen 443 ssl;
    server_name api.example.com;
    # scg 响应快，我们只需确保它自己不挂
    proxy_connect_timeout 2s;   # ✅ scg 自身健康检查间隔通常为 5s，2s 安全
    proxy_send_timeout  15s;
    proxy_read_timeout  15s;
    location / {
        proxy_pass https://scg-cluster;
        # ... 其他 header 设置
    }
}

upstream order-service {
    ip_hash; # 简单会话保持
    server 172.16.10.10:8080 max_fails=2 fail_timeout=10s;
    server 172.16.10.11:8080 max_fails=2 fail_timeout=10s;
    keepalive 32; # 启用连接池
}
server {
    listen 80;
    server_name order-api.example.com;
    location /api/v1/orders/ {
        # 👇 核心超时组合
        proxy_connect_timeout 4s;
        proxy_send_timeout    15s;
        proxy_read_timeout    15s;
        # 👇 智能重试（仅对连接错误和 5xx）
        proxy_next_upstream error timeout http_502 http_503 http_504;
        proxy_next_upstream_tries 3;
        proxy_next_upstream_timeout 12s; # 3×4s = 12s，留 3s buffer
        # 👇 缓冲优化
        proxy_buffering on;
        proxy_buffer_size 4k;
        proxy_buffers 8 16k;
        proxy_busy_buffers_size 32k;
        proxy_max_temp_file_size 0;
        # 👇 透传关键头
        proxy_set_header host $host;
        proxy_set_header x-real-ip $remote_addr;
        proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
        proxy_set_header x-forwarded-proto $scheme;
        proxy_pass http://order-service;
    }
}

server {
    listen 127.0.0.1:8088;
    location /nginx_status {
        stub_status on;
        access_log off;
        allow 127.0.0.1;
        deny all;
    }
}

active connections: 291
server accepts handled requests
 16630948 16630948 31070465
reading: 6 writing: 179 waiting: 106

-- 在 kibana 或 grafana loki 中查询
{job="nginx"} |= "504" | logfmt | uct!="" | uct > "5.0"

@component
public class tcpacceptmetrics {
    private final timer acceptdelaytimer;
    public tcpacceptmetrics(meterregistry registry) {
        this.acceptdelaytimer = timer.builder("tcp.accept.delay")
                .description("time spent before accept() returns")
                .register(registry);
    }
    public void recordacceptdelay(long millis) {
        acceptdelaytimer.record(millis, timeunit.milliseconds);
    }
}

@getmapping("/slow-accept")
public responseentity<string> slowaccept(@requestparam long delayms) {
    tcpacceptmetrics.recordacceptdelay(delayms); // ← 记录延迟
    try { thread.sleep(delayms); } catch (interruptedexception e) { ... }
    return responseentity.ok("...");
}

# 使用 openresty + lua-resty-upstream-healthcheck
http {
    upstream dynamic-backend {
        server 0.0.0.0:1; # placeholder
        balancer_by_lua_block {
            local balancer = require "ngx.balancer"
            local host = ngx.ctx.upstream_host or "default"
            local port = ngx.ctx.upstream_port or 8080
            local ok, err = balancer.set_current_peer(host, port)
            if not ok then
                ngx.log(ngx.err, "failed to set peer: ", err)
                return ngx.exit(500)
            end
        }
    }
    init_by_lua_block {
        -- 预加载延迟探测结果（从 redis 或 consul 获取）
        local redis = require "resty.redis"
        local red = redis:new()
        red:set_timeout(1000)
        local ok, err = red:connect("127.0.0.1", 6379)
        if ok then
            local delay = tonumber(red:get("rtt:backend-us")) or 5000
            ngx.shared.delay_cache:set("us", delay, 30) -- 缓存30秒
        end
    }
    server {
        location /api/ {
            # 根据请求头或 geoip 动态选择延迟阈值
            set $timeout_val 3000;
            if ($http_x_region = "apac") {
                set $timeout_val 8000;
            }
            if ($http_x_region = "us") {
                set $timeout_val 3000;
            }
            proxy_connect_timeout $timeout_val;
            proxy_pass http://dynamic-backend;
        }
    }
}

kind: configmap
apiversion: v1
metadata:
  name: nginx-configuration
  namespace: ingress-nginx
data:
  proxy-connect-timeout: "3"
  proxy-send-timeout: "15"
  proxy-read-timeout: "15"