多租户虚拟主机与配置生成

server {
    listen 443 ssl;
    http2 on;

    # 通配匹配任意子域
    server_name ~^(?<tenant>[a-z0-9-]+)\.app\.example\.com$;

    ssl_certificate     /etc/nginx/certs/wildcard-app.crt;
    ssl_certificate_key /etc/nginx/certs/wildcard-app.key;

    # 用捕获的租户名做路由
    set $backend "tenant-${tenant}-svc.default.svc.cluster.local:8080";

    location / {
        proxy_pass http://$backend;
        proxy_set_header Host $host;
        proxy_set_header X-Tenant $tenant;
    }
}

resolver kube-dns.kube-system.svc.cluster.local valid=10s;
resolver_timeout 5s;

# NGINX 1.15.9+：证书路径可用变量
server {
    listen 443 ssl;
    server_name ~^(?<tenant>[a-z0-9-]+)\.example\.com$;

    ssl_certificate     /etc/nginx/certs/$tenant/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/$tenant/privkey.pem;

    ssl_certificate_cache max=1000 inactive=1h;   # 证书缓存，避免每次握手读盘
}

# ACME HTTP-01 校验路径必须优先于业务路由
server {
    listen 80;
    server_name ~^(?<tenant>[a-z0-9-]+)\.example\.com$;

    location ^~ /.well-known/acme-challenge/ {
        root /var/www/acme;
        default_type "text/plain";
        try_files $uri =404;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

# 证书续期后直接覆盖文件（原子替换）
cat new_fullchain.pem > /etc/nginx/certs/acme/fullchain.pem.tmp
mv /etc/nginx/certs/acme/fullchain.pem.tmp /etc/nginx/certs/acme/fullchain.pem

# 用指纹做路径，续期即换路径，配合 map 决定当前路径
fingerprint=$(openssl x509 -in cert.pem -noout -fingerprint -sha256 | cut -d= -f2 | tr -d ':')

# 每租户独立目录，权限 700，属主为 nginx worker 用户
install -d -m 700 -o www-data -g www-data /etc/nginx/certs/$tenant
install -m 600 -o www-data -g www-data key.pem /etc/nginx/certs/$tenant/

{# templates/tenant.conf.j2 #}
server {
    listen 443 ssl;
    http2 on;
    server_name {{ tenant.domain }};

    ssl_certificate     {{ tenant.cert_path }};
    ssl_certificate_key {{ tenant.key_path }};
    ssl_protocols TLSv1.2 TLSv1.3;

    {% if tenant.rate_limit %}
    limit_req zone=tenant_{{ tenant.id }} burst={{ tenant.burst }} nodelay;
    {% endif %}

    location / {
        proxy_pass http://{{ tenant.upstream }};
        proxy_set_header Host $host;
        proxy_set_header X-Tenant-Id "{{ tenant.id }}";
        proxy_read_timeout {{ tenant.timeout | default(60) }}s;
    }

    access_log /var/log/nginx/{{ tenant.id }}.access.log main;
}

import re

TENANT_RE = re.compile(r'^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$')

def validate_tenant(t: dict) -> None:
    if not TENANT_RE.match(t['name']):
        raise ValueError(f"invalid tenant name: {t['name']}")
    if not t['domain'].endswith('.example.com') and not t.get('custom_domain'):
        raise ValueError("domain not allowed")
    if not (1 <= t.get('burst', 1) <= 10000):
        raise ValueError("burst out of range")

#!/usr/bin/env bash
set -euo pipefail

CONF_DIR=/etc/nginx/conf.d/tenants

# 1. 生成到临时目录，不直接覆盖线上
./generate-config --out "$CONF_DIR.new"

# 2. 语法校验（用临时配置，不影响线上）
nginx -t -c /etc/nginx/nginx.conf -g "include $CONF_DIR.new/*.conf;"

# 3. 语义校验：检查上游可达性、证书文件存在且未过期
./validate-config --dir "$CONF_DIR.new"

# 4. 原子切换
mv "$CONF_DIR" "$CONF_DIR.old"
mv "$CONF_DIR.new" "$CONF_DIR"

# 5. reload，失败则回滚
if ! nginx -s reload; then
    mv "$CONF_DIR.old" "$CONF_DIR"
    nginx -s reload
    exit 1
fi

import time, threading

class ReloadScheduler:
    def __init__(self, interval=10):
        self.interval = interval
        self._timer = None
        self._lock = threading.Lock()

    def schedule(self):
        with self._lock:
            if self._timer is not None:
                self._timer.cancel()
            self._timer = threading.Timer(self.interval, self._do_reload)
            self._timer.start()

    def _do_reload(self):
        with self._lock:
            self._timer = None
        subprocess.run(["nginx", "-s", "reload"], check=True)

worker_shutdown_timeout 30s;

#!/usr/bin/env bash
# 用 flock 保证同一时刻只有一次 reload
exec 9>/var/lock/nginx-reload.lock
flock -n 9 || { echo "reload in progress, skipping"; exit 0; }
nginx -s reload

http {
    # 每租户一个限流 zone
    limit_req_zone $tenant_key zone=tenant_default:10m rate=100r/s;
    limit_conn_zone $tenant_key zone=tenant_conn:10m;

    map $host $tenant_key {
        default                    $host;
        ~^(?<t>[a-z0-9-]+)\.example\.com$  $t;
    }

    server {
        listen 443 ssl;
        server_name ~^(?<tenant>[a-z0-9-]+)\.example\.com$;

        limit_req  zone=tenant_default burst=200 nodelay;
        limit_conn zone=tenant_conn 50;

        location / {
            proxy_pass http://$backend;
        }
    }
}