@abtnode/router-provider 1.16.43-beta-20250425-130658-8da18f4d → 1.16.43-beta-20250427-132304-6da95c55

package/lib/nginx/index.js

@@ -23,6 +23,8 @@ const {
   USER_AVATAR_PATH_PREFIX,
   LOG_RETAIN_IN_DAYS,
   ROUTER_CACHE_GROUPS,
+  GATEWAY_RATE_LIMIT_GLOBAL,
+  GATEWAY_RATE_LIMIT,
 } = require('@abtnode/constant');
 
 const promiseRetry = require('promise-retry');
@@ -122,6 +124,7 @@ class NginxProvider extends BaseProvider {
     this.capabilities = this._checkCapabilities();
 
     this.conf = null; // nginx `conf` object
+    this.requestLimit = null;
 
     logger.info('nginx provider config', {
       configDir,
@@ -207,6 +210,7 @@ class NginxProvider extends BaseProvider {
         this._addCommonResHeaders(conf.nginx.http, commonHeaders);
         this._addExposeServices(conf, services);
         if (requestLimit && requestLimit.enabled) {
+          this.requestLimit = requestLimit;
           this.addRequestLimiting(conf.nginx.http, requestLimit);
         }
         if (blockPolicy && blockPolicy?.enabled) {
@@ -274,6 +278,8 @@ class NginxProvider extends BaseProvider {
           this._addDefaultServer(conf, nodeInfo.port);
         }
 
+        this._addStubStatusLocation(conf);
+
         conf.flush();
       });
     });
@@ -367,7 +373,7 @@ class NginxProvider extends BaseProvider {
   _checkCapabilities() {
     const config = this.readNginxConfigParams();
 
-    const capabilities = ['http_v2', 'http_geoip'].reduce((acc, key) => {
+    const capabilities = ['http_v2', 'http_geoip', 'http_stub_status'].reduce((acc, key) => {
       const arg = `with-${key}_module`;
       const capability = camelCase(key);
 
@@ -797,14 +803,43 @@ class NginxProvider extends BaseProvider {
     location._add('add_header', 'X-Request-ID $request_id');
   }
 
+  _addStubStatusLocation(conf) {
+    if (!conf?.nginx?.http?.server) {
+      return;
+    }
+
+    if (!this.capabilities?.httpStubStatus) {
+      return;
+    }
+
+    const servers = Array.isArray(conf.nginx.http.server) ? conf.nginx.http.server : [conf.nginx.http.server];
+    const server = servers.find((x) => x.server_name._value === '127.0.0.1');
+    if (!server) {
+      return;
+    }
+
+    server._add('location', '/__nginx_status');
+    const location = this._getLastLocation(server);
+    location._add('stub_status', 'on');
+    location._add('access_log', 'off');
+    location._add('allow', '127.0.0.1');
+    location._add('deny', 'all');
+  }
+
   _getLastServer(conf) {
     return conf.nginx.http.server.length
       ? conf.nginx.http.server[conf.nginx.http.server.length - 1]
       : conf.nginx.http.server;
   }
 
-  _getLastLocation(serverConf) {
-    return serverConf.location.length ? serverConf.location[serverConf.location.length - 1] : serverConf.location;
+  _getLastLocation(server) {
+    const location = server.location.length ? server.location[server.location.length - 1] : server.location;
+    if (location && this.requestLimit?.enabled && !location.toString().includes('limit_req')) {
+      location._add('limit_req', `zone=ip_rate_limit burst=${this.requestLimit.burst} delay=10`);
+      location._add('limit_req', `zone=global_rate_limit burst=${this.requestLimit.burstGlobal} nodelay`);
+    }
+
+    return location;
   }
 
   _getLastStreamServer(conf) {
@@ -849,7 +884,7 @@ class NginxProvider extends BaseProvider {
     locations.forEach((x) => this._addReverseProxy({ server: httpsServerUnit, ...x, serverName, corsAllowedOrigins, commonHeaders, blockletDid })); // prettier-ignore
   }
 
-  _addHttpServerUnit({ conf, serverName, port }) {
+  _addHttpServerUnit({ conf, serverName, port = '' }) {
     let listen = port || this.httpPort;
     if (serverName === '_') {
       listen = `${listen} default_server`;
@@ -975,8 +1010,34 @@ class NginxProvider extends BaseProvider {
   }
 
   addRequestLimiting(block, limit) {
-    block._add('limit_req_zone', `$binary_remote_addr zone=req_limit_per_ip:20m rate=${limit.rate || 5}r/s`);
-    block._add('limit_req', `zone=req_limit_per_ip burst=${limit.maxInstantRate || 30} delay=10`);
+    if (!limit?.enabled) {
+      return;
+    }
+
+    const resourceExts =
+      'jpg|jpeg|png|gif|webp|svg|ico|css|js|jsx|ts|tsx|mjs|woff|woff2|ttf|eot|otf|json|bmp|avif|wasm|xml|txt';
+
+    // limit by global
+    block._addVerbatimBlock(
+      'map $request_uri $global_rate_limit_key',
+      `${os.EOL}${[`~*\\.(${resourceExts})$ "";`, 'default global_rate_limit;'].join(os.EOL)}${os.EOL}`
+    );
+
+    // limit by ip
+    block._addVerbatimBlock(
+      'map $request_uri:$request_method $ip_rate_limit_key',
+      `${os.EOL}${[`~*\\.(${resourceExts})(\\?.*)?: "";`, `~*:(${limit.methods.join('|')})$ ip_rate_limit;`, 'default "";'].join(os.EOL)}${os.EOL}`
+    );
+
+    // link: https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_zone
+    block._add(
+      'limit_req_zone',
+      `$global_rate_limit_key zone=global_rate_limit:128k rate=${limit.global || GATEWAY_RATE_LIMIT_GLOBAL.min}r/s`
+    );
+    block._add(
+      'limit_req_zone',
+      `$ip_rate_limit_key zone=ip_rate_limit:5m rate=${limit.rate || GATEWAY_RATE_LIMIT.min}r/s`
+    );
     block._add('limit_req_status', 429);
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abtnode/router-provider",
-  "version": "1.16.43-beta-20250425-130658-8da18f4d",
+  "version": "1.16.43-beta-20250427-132304-6da95c55",
   "description": "Routing engine implementations for abt node",
   "author": "polunzh <polunzh@gmail.com>",
   "homepage": "https://github.com/ArcBlock/blocklet-server#readme",
@@ -32,10 +32,10 @@
     "url": "https://github.com/ArcBlock/blocklet-server/issues"
   },
   "dependencies": {
-    "@abtnode/constant": "1.16.43-beta-20250425-130658-8da18f4d",
-    "@abtnode/logger": "1.16.43-beta-20250425-130658-8da18f4d",
-    "@abtnode/router-templates": "1.16.43-beta-20250425-130658-8da18f4d",
-    "@abtnode/util": "1.16.43-beta-20250425-130658-8da18f4d",
+    "@abtnode/constant": "1.16.43-beta-20250427-132304-6da95c55",
+    "@abtnode/logger": "1.16.43-beta-20250427-132304-6da95c55",
+    "@abtnode/router-templates": "1.16.43-beta-20250427-132304-6da95c55",
+    "@abtnode/util": "1.16.43-beta-20250427-132304-6da95c55",
     "@arcblock/http-proxy": "^1.19.1",
     "@arcblock/is-valid-domain": "^1.0.5",
     "axios": "^1.7.9",
@@ -61,5 +61,5 @@
     "bluebird": "^3.7.2",
     "fs-extra": "^11.2.0"
   },
-  "gitHead": "b5195a0290d5ced00bb716a709548b1a56356134"
+  "gitHead": "9df10dcb3135a528912241e7fc1ed54171bfeb03"
 }