Nginx反向代理WebSocket的配置详解与参数实战指南

# 【全局配置】定义连接升级变量的映射关系（必须放在 http {} 块内）
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

# 【上游配置】定义后端 websocket 服务集群
upstream ws_backend {
    server 127.0.0.1:8080 max_fails=3 fail_timeout=30s;
    keepalive 64;
}

server {
    listen 443 ssl;
    server_name ws.example.com;

    # ssl 配置（生产环境强制使用 wss）
    ssl_certificate     /etc/nginx/ssl/ws.example.com.pem;
    ssl_certificate_key /etc/nginx/ssl/ws.example.com.key;

    location /ws/ {
        proxy_pass http://ws_backend;

        # ========== 核心三要素（缺一不可）==========
        proxy_http_version 1.1;
        proxy_set_header upgrade $http_upgrade;
        proxy_set_header connection $connection_upgrade;

        # ========== 元数据透传 ==========
        proxy_set_header host $host;
        proxy_set_header x-real-ip $remote_addr;
        proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
        proxy_set_header x-forwarded-proto $scheme;

        # ========== 超时与缓冲控制 ==========
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
        proxy_buffering off;
        proxy_request_buffering off;
    }
}

# http 块中定义共享内存区域
limit_conn_zone $binary_remote_addr zone=ws_conn_limit:10m;

# location 块中应用限制
limit_conn ws_conn_limit 20;      # 单 ip 最多 20 个并发 ws 连接
limit_conn_status 503;            # 超限返回 503 service unavailable

# http 块中定义限速区域
limit_req_zone $binary_remote_addr zone=ws_req_limit:10m rate=10r/s;

# location 块中应用限速
limit_req zone=ws_req_limit burst=20 nodelay;

# 提升系统级文件描述符上限
fs.file-max = 1048576
fs.nr_open = 1048576

# 扩大本地端口范围，防止 nginx 连接上游时端口耗尽
net.ipv4.ip_local_port_range = 1024 65535

# 优化 tcp keepalive 作为应用层心跳的兜底
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_keepalive_intvl = 30
net.ipv4.tcp_keepalive_probes = 3