谷咕云计算

推荐架构：
弹性公网IP（EIP） -> 负载均衡CLB -> CVM代理集群
                    ↓
                安全组（放行特定端口）

# /etc/nginx/conf.d/proxy.conf
server {
    listen 80;
    server_name proxy.example.com;
    
    location / {
        proxy_pass http://backend_server_pool;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        
        # 连接超时控制
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 120s;
    }
}

upstream backend_server_pool {
    server 10.0.1.5:8080 weight=5;  # 内网CVM地址
    server 10.0.1.6:8080 weight=3;
    keepalive 32;  # 长连接优化
}

# 申请免费证书
curl https://get.acme.sh | sh
acme.sh --issue -d proxy.example.com --webroot /var/www/html

# 自动更新配置
acme.sh --install-cert -d proxy.example.com \
--key-file /etc/nginx/ssl/proxy.key \
--fullchain-file /etc/nginx/ssl/proxy.crt \
--reloadcmd "systemctl reload nginx"

# 统计TCP重传率
nstat -z | grep -E 'TcpRetransSegs|TcpOutSegs'
ss -itp | grep retrans

# /etc/sysctl.conf
net.ipv4.tcp_syn_retries = 3
net.ipv4.tcp_keepalive_time = 600
net.core.somaxconn = 65535

# 使用腾讯云API动态更换EIP
import tencentcloud

client = tencentcloud.EipClient()
def rotate_eip():
    old_eip = client.describe_addresses()['AddressSet'][0]
    client.unbind_eip(old_eip['AddressId'])
    new_eip = client.allocate_address()['AddressSet'][0]
    client.bind_eip(new_eip['AddressId'], instance_id)

推荐架构：
主代理节点（固定IP） -> 子代理集群（动态IP池）
                ↓
            使用Redis管理IP可用状态

# 随机化请求头
headers = {
    'User-Agent': random.choice(user_agent_list),
    'Accept-Encoding': 'gzip, deflate, br',
    'X-Forwarded-For': fake_ip_generator()
}

# 使用CLS日志服务收集代理日志
log_format proxy_log '$remote_addr - $remote_user [$time_local] '
                     '"$request" $status $body_bytes_sent '
                     '"$http_referer" "$http_user_agent" '
                     '$upstream_addr $request_time';
                     
access_log /var/log/nginx/proxy.log proxy_log;

# 使用云监控CMS设置报警规则
tcli monitor CreateAlarmPolicy \
--PolicyName "ProxyHealthCheck" \
--Conditions '[{
    "MetricName":"ResponseTime",
    "CalcType":">=",
    "Threshold":5000,
    "ContinuePeriod":3
}]' \
--ReceiverGroups "运维应急小组"

# 调整拥塞控制算法
sysctl -w net.ipv4.tcp_congestion_control=bbr

# 提升连接追踪表容量
sysctl -w net.netfilter.nf_conntrack_max=1000000
sysctl -w net.netfilter.nf_conntrack_tcp_timeout_established=86400

# 基于GEOIP分流
map $geoip_country_code $backend_pool {
    default     backend_global;
    CN          backend_cn;
    US          backend_us;
}

tcpdump -i eth0 -G 3600 -w /captures/proxy-%Y%m%d%H.pcap