Gin Nginx反向代理与负载均衡

Nginx 作为反向代理和负载均衡器，是 Gin 应用生产部署的标准架构。

基础反向代理

Nginx 配置

nginx

# /etc/nginx/conf.d/gin-api.conf
server {
    listen 80;
    server_name api.example.com;

    location / {
        proxy_pass http://localhost:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Gin 获取真实 IP

func GetRealIP(c *gin.Context) string {
    // 优先从 X-Real-IP 获取
    ip := c.GetHeader("X-Real-IP")
    if ip != "" {
        return ip
    }

    // 从 X-Forwarded-For 获取第一个 IP
    forwarded := c.GetHeader("X-Forwarded-For")
    if forwarded != "" {
        ips := strings.Split(forwarded, ",")
        return strings.TrimSpace(ips[0])
    }

    return c.ClientIP()
}

func IPMiddleware() gin.HandlerFunc {
    return func(c *gin.Context) {
        c.Set("real_ip", GetRealIP(c))
        c.Next()
    }
}

负载均衡配置

多实例配置

nginx

# 负载均衡配置
upstream gin_backend {
    # 负载均衡策略（默认轮询）
    server 127.0.0.1:8081;
    server 127.0.0.1:8082;
    server 127.0.0.1:8083;

    # 健康检查（需要 nginx-plus 或第三方模块）
    # keepalive 32;  # 保持连接数
}

server {
    listen 80;
    server_name api.example.com;

    location / {
        proxy_pass http://gin_backend;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

负载均衡策略

nginx

# 轮询（默认）
upstream gin_backend {
    server 192.168.1.1:8080;
    server 192.168.1.2:8080;
}

# 权重轮询
upstream gin_backend {
    server 192.168.1.1:8080 weight=5;  # 5倍流量
    server 192.168.1.2:8080 weight=1;
}

# IP 哈希（同一IP请求同一服务器）
upstream gin_backend {
    ip_hash;
    server 192.168.1.1:8080;
    server 192.168.1.2:8080;
}

# 最少连接（请求发给连接最少的服务器）
upstream gin_backend {
    least_conn;
    server 192.168.1.1:8080;
    server 192.168.1.2:8080;
}

# 响应时间（需要第三方模块）
upstream gin_backend {
    fair;
    server 192.168.1.1:8080;
    server 192.168.1.2:8080;
}

备用服务器配置

nginx

upstream gin_backend {
    server 192.168.1.1:8080;
    server 192.168.1.2:8080 backup;  # 仅在其他服务器不可用时启用
    server 192.168.1.3:8080 down;    # 标记为不可用
}

SSL/TLS 配置

HTTPS 配置

nginx

server {
    listen 443 ssl http2;
    server_name api.example.com;

    # SSL 证书
    ssl_certificate /etc/nginx/ssl/api.example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/api.example.com.key;

    # SSL 配置
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;

    # HSTS
    add_header Strict-Transport-Security "max-age=31536000" always;

    location / {
        proxy_pass http://gin_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

# HTTP 重定向到 HTTPS
server {
    listen 80;
    server_name api.example.com;
    return 301 https://$server_name$request_uri;
}

性能优化配置

连接优化

nginx

upstream gin_backend {
    server 127.0.0.1:8080;
    keepalive 64;  # 保持 64 个长连接
}

server {
    location / {
        proxy_pass http://gin_backend;
        proxy_http_version 1.1;         # HTTP 1.1 支持长连接
        proxy_set_header Connection ""; # 清除 Connection 头

        # 连接超时
        proxy_connect_timeout 3s;
        proxy_send_timeout 10s;
        proxy_read_timeout 10s;
    }
}

缓冲配置

nginx

server {
    location / {
        proxy_pass http://gin_backend;

        # 请求缓冲
        proxy_request_buffering off;  # 大文件上传关闭缓冲

        # 响应缓冲
        proxy_buffering on;
        proxy_buffer_size 4k;
        proxy_buffers 8 16k;
        proxy_busy_buffers_size 32k;

        # 临时文件路径
        proxy_temp_path /var/nginx/proxy_temp;
    }
}

限流配置

nginx

# 定义限流区域
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=100r/s;

server {
    location /api/ {
        limit_req zone=api_limit burst=200 nodelay;

        proxy_pass http://gin_backend;
    }
}

# 连接数限制
limit_conn_zone $binary_remote_addr zone=conn_limit:10m;

server {
    location /api/ {
        limit_conn conn_limit 50;  # 单IP最多50连接
        proxy_pass http://gin_backend;
    }
}

WebSocket 支持

nginx

server {
    location /ws/ {
        proxy_pass http://gin_backend;
        proxy_http_version 1.1;

        # WebSocket 协议升级
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # WebSocket 超时
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
    }
}

健康检查

被动健康检查

nginx

upstream gin_backend {
    server 192.168.1.1:8080 max_fails=3 fail_timeout=30s;
    server 192.168.1.2:8080 max_fails=3 fail_timeout=30s;
}

# max_fails: 失败次数阈值
# fail_timeout: 失败后暂停时间

Gin 健康接口

func HealthHandler(c *gin.Context) {
    // 检查数据库连接
    if err := db.Ping(); err != nil {
        c.JSON(500, gin.H{"status": "unhealthy", "reason": "database"})
        return
    }

    // 检查 Redis 连接
    if err := redis.Ping(); err != nil {
        c.JSON(500, gin.H{"status": "unhealthy", "reason": "redis"})
        return
    }

    c.JSON(200, gin.H{"status": "healthy"})
}

请求日志

Nginx 日志格式

nginx

log_format gin_api '$remote_addr - $remote_user [$time_local] '
                   '"$request" $status $body_bytes_sent '
                   '"$http_referer" "$http_user_agent" '
                   '$request_time $upstream_response_time '
                   '$upstream_addr $upstream_status';

access_log /var/log/nginx/gin-api.log gin_api;

静态文件处理

nginx

server {
    location /static/ {
        alias /var/www/static/;
        expires 30d;
        add_header Cache-Control "public, immutable";
    }

    location / {
        proxy_pass http://gin_backend;
    }
}

跨域配置

nginx

server {
    location /api/ {
        # CORS 头
        add_header Access-Control-Allow-Origin $http_origin;
        add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS";
        add_header Access-Control-Allow-Headers "Content-Type, Authorization";
        add_header Access-Control-Allow-Credentials true;

        # 处理预检请求
        if ($request_method = OPTIONS) {
            add_header Content-Length 0;
            add_header Content-Type text/plain;
            return 204;
        }

        proxy_pass http://gin_backend;
    }
}

负载均衡策略对比

策略	说明	适用场景
轮询	默认，均匀分配	无状态服务
权重	按权重分配	服务器性能不同
IP哈希	同IP同服务器	需会话保持
最少连接	选连接少的	长连接场景

注意：生产环境必须配置 SSL 和健康检查。

要点总结

反向代理：proxy_pass 转发请求，设置代理头
负载均衡：upstream 定义服务器池，多种策略
SSL 配置：HTTPS 强制，证书配置
连接优化：keepalive、HTTP 1.1、超时设置
限流配置：limit_req_zone 防止过载
健康检查：max_fails + fail_timeout 监控服务状态

📝 发现内容有误？点击此处直接编辑