SpringBoot整合Nginx实现反向代理、负载均衡与HTTPS配置

生产环境中，SpringBoot 一般不直接暴露端口给用户，前面都会加一层 Nginx。Nginx 负责反向代理、负载均衡、SSL 证书、静态资源缓存等。

一、反向代理

基本配置：

server {
    listen 80;
    server_name api.example.com;
    location / {
        proxy_pass http://127.0.0.1:9090;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

二、负载均衡

upstream seckill_backend {
    # weight 越大，分配到的请求越多
    server 192.168.1.101:9090 weight=3;
    server 192.168.1.102:9090 weight=2;
    server 192.168.1.103:9090 weight=1;
}
server {
    listen 80;
    location / {
        proxy_pass http://seckill_backend;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
    }
}

三、HTTPS

sudo apt install certbot python3-certbot-nginx -y
sudo certbot --nginx -d api.example.com

server {
    listen 443 ssl;
    server_name api.example.com;
    ssl_certificate /etc/letsencrypt/live/api.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api.example.com/privkey.pem;
    location / {
        proxy_pass http://127.0.0.1:9090;
    }
}

四、WebSocket 支持

location /ws {
    proxy_pass http://127.0.0.1:9090;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_read_timeout 300s;
}

五、静态资源缓存

location /static/ {
    root /opt/app/;
    expires 7d;
    add_header Cache-Control "public, immutable";
}

六、安全与限流

# 限制同一 IP 每秒最多 10 个请求
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
server {
    location /api/ {
        limit_req zone=api_limit burst=20 nodelay;
        proxy_pass http://127.0.0.1:9090;
    }
}