@abtnode/router-provider 1.16.43-beta-20250424-125523-08a65a5c → 1.16.43-beta-20250427-132304-6da95c55

package/lib/nginx/index.js

@@ -4,6 +4,7 @@ const { NginxConfFile } = require('nginx-conf');
 const fs = require('fs-extra');
 const os = require('os');
 const fg = require('fast-glob');
+const semver = require('semver');
 const path = require('path');
 const shelljs = require('shelljs');
 const kill = require('fkill');
@@ -22,6 +23,8 @@ const {
   USER_AVATAR_PATH_PREFIX,
   LOG_RETAIN_IN_DAYS,
   ROUTER_CACHE_GROUPS,
+  GATEWAY_RATE_LIMIT_GLOBAL,
+  GATEWAY_RATE_LIMIT,
 } = require('@abtnode/constant');
 
 const promiseRetry = require('promise-retry');
@@ -121,6 +124,7 @@ class NginxProvider extends BaseProvider {
     this.capabilities = this._checkCapabilities();
 
     this.conf = null; // nginx `conf` object
+    this.requestLimit = null;
 
     logger.info('nginx provider config', {
       configDir,
@@ -206,6 +210,7 @@ class NginxProvider extends BaseProvider {
         this._addCommonResHeaders(conf.nginx.http, commonHeaders);
         this._addExposeServices(conf, services);
         if (requestLimit && requestLimit.enabled) {
+          this.requestLimit = requestLimit;
           this.addRequestLimiting(conf.nginx.http, requestLimit);
         }
         if (blockPolicy && blockPolicy?.enabled) {
@@ -273,6 +278,8 @@ class NginxProvider extends BaseProvider {
           this._addDefaultServer(conf, nodeInfo.port);
         }
 
+        this._addStubStatusLocation(conf);
+
         conf.flush();
       });
     });
@@ -366,7 +373,7 @@ class NginxProvider extends BaseProvider {
   _checkCapabilities() {
     const config = this.readNginxConfigParams();
 
-    const capabilities = ['http_v2', 'http_geoip'].reduce((acc, key) => {
+    const capabilities = ['http_v2', 'http_geoip', 'http_stub_status'].reduce((acc, key) => {
       const arg = `with-${key}_module`;
       const capability = camelCase(key);
 
@@ -393,6 +400,11 @@ class NginxProvider extends BaseProvider {
       capabilities.modsecurity = modulePaths.some((x) => toLower(x).includes('modsecurity'));
     }
 
+    const result = shelljs.exec(`${this.binPath} -v`, { silent: true });
+    if (result.code === 0) {
+      capabilities.version = semver.coerce((result.stderr || result.stdout).split('/').pop())?.version || '';
+    }
+
     return capabilities;
   }
 
@@ -791,14 +803,43 @@ class NginxProvider extends BaseProvider {
     location._add('add_header', 'X-Request-ID $request_id');
   }
 
+  _addStubStatusLocation(conf) {
+    if (!conf?.nginx?.http?.server) {
+      return;
+    }
+
+    if (!this.capabilities?.httpStubStatus) {
+      return;
+    }
+
+    const servers = Array.isArray(conf.nginx.http.server) ? conf.nginx.http.server : [conf.nginx.http.server];
+    const server = servers.find((x) => x.server_name._value === '127.0.0.1');
+    if (!server) {
+      return;
+    }
+
+    server._add('location', '/__nginx_status');
+    const location = this._getLastLocation(server);
+    location._add('stub_status', 'on');
+    location._add('access_log', 'off');
+    location._add('allow', '127.0.0.1');
+    location._add('deny', 'all');
+  }
+
   _getLastServer(conf) {
     return conf.nginx.http.server.length
       ? conf.nginx.http.server[conf.nginx.http.server.length - 1]
       : conf.nginx.http.server;
   }
 
-  _getLastLocation(serverConf) {
-    return serverConf.location.length ? serverConf.location[serverConf.location.length - 1] : serverConf.location;
+  _getLastLocation(server) {
+    const location = server.location.length ? server.location[server.location.length - 1] : server.location;
+    if (location && this.requestLimit?.enabled && !location.toString().includes('limit_req')) {
+      location._add('limit_req', `zone=ip_rate_limit burst=${this.requestLimit.burst} delay=10`);
+      location._add('limit_req', `zone=global_rate_limit burst=${this.requestLimit.burstGlobal} nodelay`);
+    }
+
+    return location;
   }
 
   _getLastStreamServer(conf) {
@@ -843,7 +884,7 @@ class NginxProvider extends BaseProvider {
     locations.forEach((x) => this._addReverseProxy({ server: httpsServerUnit, ...x, serverName, corsAllowedOrigins, commonHeaders, blockletDid })); // prettier-ignore
   }
 
-  _addHttpServerUnit({ conf, serverName, port }) {
+  _addHttpServerUnit({ conf, serverName, port = '' }) {
     let listen = port || this.httpPort;
     if (serverName === '_') {
       listen = `${listen} default_server`;
@@ -865,13 +906,24 @@ class NginxProvider extends BaseProvider {
     const crtPath = `${joinNginxPath(this.certDir, certificateFileName.replace('*', '-'))}.crt`;
     const keyPath = `${joinNginxPath(this.certDir, certificateFileName.replace('*', '-'))}.key`;
 
-    let listen = `${this.httpsPort} ssl ${this.capabilities.httpV2 ? 'http2' : ''}`.trim();
+    // Handle HTTP/2 configuration based on Nginx version
+    let listen = `${this.httpsPort} ssl`;
+    let http2Config = '';
+    if (this.capabilities.httpV2) {
+      if (this.capabilities.version && semver.gte(this.capabilities.version, '1.25.1')) {
+        http2Config = 'http2 on';
+      } else {
+        listen += ' http2';
+      }
+    }
     if (serverName === '_') {
       listen = `${listen} default_server`;
     }
-
     httpsServerUnit._add('server_name', serverName);
     httpsServerUnit._add('listen', listen);
+    if (http2Config) {
+      httpsServerUnit._add('http2', 'on');
+    }
     httpsServerUnit._add('ssl_certificate', crtPath);
     httpsServerUnit._add('ssl_certificate_key', keyPath);
     httpsServerUnit._add('include', 'includes/ssl');
@@ -958,8 +1010,34 @@ class NginxProvider extends BaseProvider {
   }
 
   addRequestLimiting(block, limit) {
-    block._add('limit_req_zone', `$binary_remote_addr zone=req_limit_per_ip:20m rate=${limit.rate || 5}r/s`);
-    block._add('limit_req', `zone=req_limit_per_ip burst=${limit.maxInstantRate || 30} delay=10`);
+    if (!limit?.enabled) {
+      return;
+    }
+
+    const resourceExts =
+      'jpg|jpeg|png|gif|webp|svg|ico|css|js|jsx|ts|tsx|mjs|woff|woff2|ttf|eot|otf|json|bmp|avif|wasm|xml|txt';
+
+    // limit by global
+    block._addVerbatimBlock(
+      'map $request_uri $global_rate_limit_key',
+      `${os.EOL}${[`~*\\.(${resourceExts})$ "";`, 'default global_rate_limit;'].join(os.EOL)}${os.EOL}`
+    );
+
+    // limit by ip
+    block._addVerbatimBlock(
+      'map $request_uri:$request_method $ip_rate_limit_key',
+      `${os.EOL}${[`~*\\.(${resourceExts})(\\?.*)?: "";`, `~*:(${limit.methods.join('|')})$ ip_rate_limit;`, 'default "";'].join(os.EOL)}${os.EOL}`
+    );
+
+    // link: https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_zone
+    block._add(
+      'limit_req_zone',
+      `$global_rate_limit_key zone=global_rate_limit:128k rate=${limit.global || GATEWAY_RATE_LIMIT_GLOBAL.min}r/s`
+    );
+    block._add(
+      'limit_req_zone',
+      `$ip_rate_limit_key zone=ip_rate_limit:5m rate=${limit.rate || GATEWAY_RATE_LIMIT.min}r/s`
+    );
     block._add('limit_req_status', 429);
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abtnode/router-provider",
-  "version": "1.16.43-beta-20250424-125523-08a65a5c",
+  "version": "1.16.43-beta-20250427-132304-6da95c55",
   "description": "Routing engine implementations for abt node",
   "author": "polunzh <polunzh@gmail.com>",
   "homepage": "https://github.com/ArcBlock/blocklet-server#readme",
@@ -32,10 +32,10 @@
     "url": "https://github.com/ArcBlock/blocklet-server/issues"
   },
   "dependencies": {
-    "@abtnode/constant": "1.16.43-beta-20250424-125523-08a65a5c",
-    "@abtnode/logger": "1.16.43-beta-20250424-125523-08a65a5c",
-    "@abtnode/router-templates": "1.16.43-beta-20250424-125523-08a65a5c",
-    "@abtnode/util": "1.16.43-beta-20250424-125523-08a65a5c",
+    "@abtnode/constant": "1.16.43-beta-20250427-132304-6da95c55",
+    "@abtnode/logger": "1.16.43-beta-20250427-132304-6da95c55",
+    "@abtnode/router-templates": "1.16.43-beta-20250427-132304-6da95c55",
+    "@abtnode/util": "1.16.43-beta-20250427-132304-6da95c55",
     "@arcblock/http-proxy": "^1.19.1",
     "@arcblock/is-valid-domain": "^1.0.5",
     "axios": "^1.7.9",
@@ -51,6 +51,7 @@
     "object-hash": "^3.0.0",
     "port-used": "^2.0.8",
     "promise-retry": "^2.0.1",
+    "semver": "^7.6.3",
     "shelljs": "^0.8.5",
     "tar": "^6.1.11",
     "ufo": "^1.5.3",
@@ -60,5 +61,5 @@
     "bluebird": "^3.7.2",
     "fs-extra": "^11.2.0"
   },
-  "gitHead": "499de9f28770298a819122ba16a7f2b3cc78c7ee"
+  "gitHead": "9df10dcb3135a528912241e7fc1ed54171bfeb03"
 }