Nginx反向代理的超时配置指南

location /api/ {
    proxy_pass http://backend-servers;
    proxy_connect_timeout 120s;  # ❌ 危险！
}

# application.yml
server:
  connection-timeout: 30000  # 30秒

// DelayedConnectionController.java
@RestController
@RequestMapping("/debug")
public class DelayedConnectionController {
    private static final Logger log = LoggerFactory.getLogger(DelayedConnectionController.class);
    /**
     * 模拟后端服务在 accept() 之前人为延迟（模拟服务启动中、负载过高无法 accept）
     * 注意：这不是 HTTP 延迟，而是 TCP 层的 accept() 阻塞！
     */
    @GetMapping("/slow-accept")
    public ResponseEntity<String> slowAccept(
            @RequestParam(defaultValue = "5000") long delayMs) {
        // 记录日志，便于与 Nginx access_log 关联
        log.info("Received /slow-accept request. Will delay accept for {}ms", delayMs);
        try {
            // 模拟内核队列满或进程忙，导致 accept() 被阻塞
            Thread.sleep(delayMs);
        } catch (InterruptedException e) {
            Thread.currentThread().interrupt();
            return ResponseEntity.status(500).body("Interrupted");
        }
        return ResponseEntity.ok("Accepted after " + delayMs + "ms");
    }
    /**
     * 模拟服务完全不可达（不监听端口），用于测试 connection refused
     */
    @GetMapping("/unreachable")
    public ResponseEntity<String> unreachable() {
        // 此 endpoint 不做任何事，仅作占位
        // 真正的“不可达”需在部署时关闭该端口或防火墙拦截
        return ResponseEntity.ok("This endpoint is for unreachable test only.");
    }
}

# nginx-test.conf —— 用于本地 curl 测试
events {
    worker_connections 1024;
}
http {
    include       mime.types;
    default_type  application/octet-stream;
    # 日志格式增强，包含 upstream connect time
    log_format main '$remote_addr - $remote_user [$time_local] '
                     '"$request" $status $body_bytes_sent '
                     '"$http_referer" "$http_user_agent" '
                     'rt=$request_time uct="$upstream_connect_time" '
                     'uht="$upstream_header_time" udt="$upstream_response_time"';
    access_log logs/access.log main;
    upstream slow-backend {
        server 127.0.0.1:8080; # Spring Boot 默认端口
        # 不配置 backup 或 down，确保只打到这一台
    }
    # === 测试路径 A：proxy_connect_timeout=3s ===
    server {
        listen 8081;
        server_name localhost;
        location /api/slow-3s/ {
            proxy_pass http://slow-backend;
            proxy_connect_timeout 3s;
            proxy_send_timeout 30s;
            proxy_read_timeout 30s;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }
    }
    # === 测试路径 B：proxy_connect_timeout=10s ===
    server {
        listen 8082;
        server_name localhost;
        location /api/slow-10s/ {
            proxy_pass http://slow-backend;
            proxy_connect_timeout 10s;
            proxy_send_timeout 30s;
            proxy_read_timeout 30s;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }
    }
}

java -jar demo.jar --server.port=8080

nginx -c /path/to/nginx-test.conf -p $(pwd) -g "daemon off;"

# 测试 3s timeout：后端延迟 5s → 必然超时
curl -v "http://localhost:8081/api/slow-3s/slow-accept?delayMs=5000"
# Expected: HTTP/1.1 504 Gateway Time-out, total time ≈ 3.01s

# 测试 10s timeout：后端延迟 5s → 成功
curl -v "http://localhost:8082/api/slow-10s/slow-accept?delayMs=5000"
# Expected: HTTP/1.1 200 OK, total time ≈ 5.02s (Spring Boot sleep + 网络)

127.0.0.1 - - [15/Jul/2024:10:22:33 +0000] "GET /api/slow-3s/slow-accept?delayMs=5000 HTTP/1.1" 504 568 "-" "curl/7.81.0" rt=3.002 uct="3.001" uht="-" udt="-"
127.0.0.1 - - [15/Jul/2024:10:22:41 +0000] "GET /api/slow-10s/slow-accept?delayMs=5000 HTTP/1.1" 200 32 "-" "curl/7.81.0" rt=5.015 uct="0.001" uht="5.012" udt="5.014"

# application.yml
spring:
  cloud:
    gateway:
      httpclient:
        connect-timeout: 5000     # ✅ 对应 Nginx proxy_connect_timeout
        response-timeout: 30000   # ✅ 对应 Nginx proxy_read_timeout

# 边缘 Nginx（只负责入口）
upstream scg-cluster {
    server 10.10.20.100:8080; # SCG 实例
    server 10.10.20.101:8080;
}
server {
    listen 443 ssl;
    server_name api.example.com;
    # SCG 响应快，我们只需确保它自己不挂
    proxy_connect_timeout 2s;   # ✅ SCG 自身健康检查间隔通常为 5s，2s 安全
    proxy_send_timeout  15s;
    proxy_read_timeout  15s;
    location / {
        proxy_pass https://scg-cluster;
        # ... 其他 header 设置
    }
}

upstream order-service {
    ip_hash; # 简单会话保持
    server 172.16.10.10:8080 max_fails=2 fail_timeout=10s;
    server 172.16.10.11:8080 max_fails=2 fail_timeout=10s;
    keepalive 32; # 启用连接池
}
server {
    listen 80;
    server_name order-api.example.com;
    location /api/v1/orders/ {
        # 👇 核心超时组合
        proxy_connect_timeout 4s;
        proxy_send_timeout    15s;
        proxy_read_timeout    15s;
        # 👇 智能重试（仅对连接错误和 5xx）
        proxy_next_upstream error timeout http_502 http_503 http_504;
        proxy_next_upstream_tries 3;
        proxy_next_upstream_timeout 12s; # 3×4s = 12s，留 3s buffer
        # 👇 缓冲优化
        proxy_buffering on;
        proxy_buffer_size 4k;
        proxy_buffers 8 16k;
        proxy_busy_buffers_size 32k;
        proxy_max_temp_file_size 0;
        # 👇 透传关键头
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://order-service;
    }
}

server {
    listen 127.0.0.1:8088;
    location /nginx_status {
        stub_status on;
        access_log off;
        allow 127.0.0.1;
        deny all;
    }
}

Active connections: 291
server accepts handled requests
 16630948 16630948 31070465
Reading: 6 Writing: 179 Waiting: 106

-- 在 Kibana 或 Grafana Loki 中查询
{job="nginx"} |= "504" | logfmt | uct!="" | uct > "5.0"

@Component
public class TcpAcceptMetrics {
    private final Timer acceptDelayTimer;
    public TcpAcceptMetrics(MeterRegistry registry) {
        this.acceptDelayTimer = Timer.builder("tcp.accept.delay")
                .description("Time spent before accept() returns")
                .register(registry);
    }
    public void recordAcceptDelay(long millis) {
        acceptDelayTimer.record(millis, TimeUnit.MILLISECONDS);
    }
}

@GetMapping("/slow-accept")
public ResponseEntity<String> slowAccept(@RequestParam long delayMs) {
    tcpAcceptMetrics.recordAcceptDelay(delayMs); // ← 记录延迟
    try { Thread.sleep(delayMs); } catch (InterruptedException e) { ... }
    return ResponseEntity.ok("...");
}

# 使用 OpenResty + lua-resty-upstream-healthcheck
http {
    upstream dynamic-backend {
        server 0.0.0.0:1; # placeholder
        balancer_by_lua_block {
            local balancer = require "ngx.balancer"
            local host = ngx.ctx.upstream_host or "default"
            local port = ngx.ctx.upstream_port or 8080
            local ok, err = balancer.set_current_peer(host, port)
            if not ok then
                ngx.log(ngx.ERR, "failed to set peer: ", err)
                return ngx.exit(500)
            end
        }
    }
    init_by_lua_block {
        -- 预加载延迟探测结果（从 Redis 或 Consul 获取）
        local redis = require "resty.redis"
        local red = redis:new()
        red:set_timeout(1000)
        local ok, err = red:connect("127.0.0.1", 6379)
        if ok then
            local delay = tonumber(red:get("rtt:backend-us")) or 5000
            ngx.shared.delay_cache:set("us", delay, 30) -- 缓存30秒
        end
    }
    server {
        location /api/ {
            # 根据请求头或 geoip 动态选择延迟阈值
            set $timeout_val 3000;
            if ($http_x_region = "apac") {
                set $timeout_val 8000;
            }
            if ($http_x_region = "us") {
                set $timeout_val 3000;
            }
            proxy_connect_timeout $timeout_val;
            proxy_pass http://dynamic-backend;
        }
    }
}

kind: ConfigMap
apiVersion: v1
metadata:
  name: nginx-configuration
  namespace: ingress-nginx
data:
  proxy-connect-timeout: "3"
  proxy-send-timeout: "15"
  proxy-read-timeout: "15"