安全防护 - CDN加速与安全防护双重优化方案

# CDN缓存策略配置示例
# 静态资源（长期缓存）
location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff|woff2|ttf|svg|eot)$ {
    expires 365d;
    add_header Cache-Control "public, immutable, max-age=31536000";
    add_header Access-Control-Allow-Origin "*";
    
    # 安全头仍然保留
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
}

# 动态内容（短时间缓存）
location ~ \.php$ {
    # 设置较短的缓存时间
    expires 1h;
    add_header Cache-Control "public, max-age=3600, must-revalidate";
    
    # 安全防护头
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline';" always;
}

# API接口（根据认证状态缓存）
location /api/ {
    # 根据用户认证状态设置不同的缓存策略
    set $cache_control "no-cache, no-store, must-revalidate";
    
    if ($http_authorization = "") {
        # 未认证用户可以缓存短时间
        set $cache_control "public, max-age=60";
    }
    
    add_header Cache-Control $cache_control;
    
    # 安全头
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
}

# 多CDN智能DNS配置示例
# 使用DNS轮询或智能路由实现多CDN负载均衡

# 主CDN提供商（Cloudflare）
www.example.com.    300    IN    A        104.16.132.229
www.example.com.    300    IN    A        104.16.133.229

# 备份CDN提供商（Akamai）
www-backup.example.com.    300    IN    CNAME    g.akamai.net.

# 健康检查脚本（监控CDN可用性）
#!/bin/bash
# check_cdn_health.sh
CDN_PROVIDERS=("cloudflare" "akamai" "fastly")
PRIMARY_CDN="cloudflare"

check_cdn() {
    local cdn=$1
    local test_url=""
    
    case $cdn in
        "cloudflare") test_url="https://www.example.com/cdn-health-check" ;;
        "akamai") test_url="https://www-backup.example.com/cdn-health-check" ;;
        "fastly") test_url="https://www-fallback.example.com/cdn-health-check" ;;
    esac
    
    # 发送请求检查CDN健康状态
    response=$(curl -s -o /dev/null -w "%{http_code}" -H "Cache-Control: no-cache" "$test_url")
    
    if [ "$response" = "200" ]; then
        echo "$cdn: HEALTHY"
        return 0
    else
        echo "$cdn: UNHEALTHY (Status: $response)"
        return 1
    fi
}

# 主CDN健康检查
if ! check_cdn "$PRIMARY_CDN"; then
    echo "Primary CDN ($PRIMARY_CDN) is down, switching to backup..."
    
    # 切换到备份CDN（通过API或脚本更新DNS）
    # 这里可以调用DNS服务商的API更新记录
    # aws route53 change-resource-record-sets ...
    # cloudflare api v4 ...
fi

# CDN节点全球监控脚本
import requests
import time
from datetime import datetime

# 全球CDN节点列表
CDN_NODES = [
    {"name": "北美-东部", "url": "https://us-east-1.cdn.example.com/health", "region": "na-east"},
    {"name": "北美-西部", "url": "https://us-west-1.cdn.example.com/health", "region": "na-west"},
    {"name": "欧洲-法兰克福", "url": "https://eu-central-1.cdn.example.com/health", "region": "eu-central"},
    {"name": "欧洲-伦敦", "url": "https://eu-west-2.cdn.example.com/health", "region": "eu-west"},
    {"name": "亚洲-新加坡", "url": "https://ap-southeast-1.cdn.example.com/health", "region": "ap-southeast"},
    {"name": "亚洲-东京", "url": "https://ap-northeast-1.cdn.example.com/health", "region": "ap-northeast"},
    {"name": "大洋洲-悉尼", "url": "https://ap-southeast-2.cdn.example.com/health", "region": "ap-southeast-2"},
    {"name": "南美-圣保罗", "url": "https://sa-east-1.cdn.example.com/health", "region": "sa-east"},
]

def check_node_health(node):
    """检查单个CDN节点健康状态"""
    try:
        start_time = time.time()
        
        # 发送健康检查请求
        response = requests.get(
            node["url"],
            headers={"User-Agent": "CDN-Health-Check/1.0"},
            timeout=5
        )
        
        response_time = (time.time() - start_time) * 1000  # 转换为毫秒
        
        if response.status_code == 200:
            health_data = response.json()
            return {
                "node": node["name"],
                "status": "healthy",
                "response_time": f"{response_time:.2f}ms",
                "region": node["region"],
                "timestamp": datetime.now().isoformat()
            }
        else:
            return {
                "node": node["name"],
                "status": "unhealthy",
                "error": f"HTTP {response.status_code}",
                "region": node["region"],
                "timestamp": datetime.now().isoformat()
            }
    except requests.exceptions.Timeout:
        return {
            "node": node["name"],
            "status": "unhealthy",
            "error": "请求超时",
            "region": node["region"],
            "timestamp": datetime.now().isoformat()
        }
    except Exception as e:
        return {
            "node": node["name"],
            "status": "unhealthy",
            "error": str(e),
            "region": node["region"],
            "timestamp": datetime.now().isoformat()
        }

def monitor_all_nodes():
    """监控所有CDN节点"""
    print(f"[{datetime.now().strftime('%Y-%m-%d %H:%M:%S')}] CDN节点健康检查开始")
    print("-" * 60)
    
    results = []
    for node in CDN_NODES:
        result = check_node_health(node)
        results.append(result)
        
        # 输出结果
        status_icon = "✅" if result["status"] == "healthy" else "❌"
        print(f"{status_icon} {result['node']} ({result['region']}): {result['status']}")
        if result["status"] == "healthy":
            print(f"   响应时间: {result['response_time']}")
        else:
            print(f"   错误信息: {result['error']}")
    
    # 统计信息
    healthy_nodes = [r for r in results if r["status"] == "healthy"]
    unhealthy_nodes = [r for r in results if r["status"] == "unhealthy"]
    
    print("-" * 60)
    print(f"检查完成 | 总计: {len(results)} 个节点 | 健康: {len(healthy_nodes)} | 异常: {len(unhealthy_nodes)}")
    
    # 如果有异常节点，发送告警
    if unhealthy_nodes:
        send_alert(unhealthy_nodes)
    
    return results

if __name__ == "__main__":
    # 每5分钟执行一次健康检查
    while True:
        monitor_all_nodes()
        time.sleep(300)  # 300秒 = 5分钟

# nginx_security_full.conf
# 综合安全与性能优化配置

# 全局安全配置
http {
    # 隐藏Nginx版本信息
    server_tokens off;
    
    # 限制请求大小和缓冲区
    client_max_body_size 10m;
    client_body_buffer_size 128k;
    client_header_buffer_size 1k;
    large_client_header_buffers 4 8k;
    
    # 限制请求方法（只允许常用方法）
    limit_except GET POST HEAD PUT DELETE {
        deny all;
    }
    
    # 请求速率限制
    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
    limit_req_zone $binary_remote_addr zone=auth_limit:10m rate=3r/m;
    
    # 连接数限制
    limit_conn_zone $binary_remote_addr zone=addr:10m;
}

# 主服务器配置
server {
    listen 80;
    server_name example.com;
    
    # 强制HTTPS重定向
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.com;
    
    # SSL配置（见前文HTTPS部分）
    # ...
    
    # 根目录配置
    root /var/www/html;
    index index.php index.html index.htm;
    
    # 安全头配置
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Feature-Policy "camera 'none'; microphone 'none'; geolocation 'none';" always;
    
    # CSP内容安全策略
    add_header Content-Security-Policy "
        default-src 'self';
        script-src 'self' 'unsafe-inline' https://cdn.example.com;
        style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
        img-src 'self' data: https:;
        font-src 'self' https://fonts.gstatic.com;
        connect-src 'self' https://api.example.com;
        frame-ancestors 'self';
        base-uri 'self';
        form-action 'self';
    " always;
    
    # 防止MIME类型嗅探
    add_header X-Content-Type-Options "nosniff";
    
    # 禁止iframe嵌入
    add_header X-Frame-Options "DENY";
    
    # 静态文件缓存和安全
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff|woff2|ttf|svg|eot)$ {
        expires 365d;
        add_header Cache-Control "public, immutable, max-age=31536000";
        
        # 安全头（覆盖全局设置）
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-Frame-Options "SAMEORIGIN" always;
    }
    
    # API接口保护
    location /api/ {
        # 速率限制
        limit_req zone=api_limit burst=20 nodelay;
        
        # 连接数限制
        limit_conn addr 10;
        
        # 安全头
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-Frame-Options "DENY" always;
        
        # 代理到后端应用服务器
        proxy_pass http://backend_api;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # 代理超时设置
        proxy_connect_timeout 30s;
        proxy_read_timeout 30s;
        proxy_send_timeout 30s;
    }
    
    # 登录页面特殊保护
    location /login {
        # 更严格的速率限制
        limit_req zone=auth_limit burst=5 nodelay;
        
        # 额外的安全头
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-Frame-Options "DENY" always;
        
        # 禁用缓存
        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate";
        expires 0;
    }
    
    # 敏感文件保护
    location ~ /\. {
        deny all;
    }
    
    location ~ /(config|database|log)/ {
        deny all;
    }
    
    # 默认错误页面
    error_page 403 /403.html;
    error_page 404 /404.html;
    error_page 500 502 503 504 /50x.html;
    
    location = /50x.html {
        root /usr/share/nginx/html;
    }
}

# Prometheus告警规则配置（prometheus_rules.yml）
groups:
  - name: cdn_alerts
    rules:
      # CDN命中率过低告警
      - alert: CDN缓存命中率过低
        expr: (sum(rate(cdn_cache_hits_total[5m])) / sum(rate(cdn_requests_total[5m]))) * 100 < 85
        for: 5m
        labels:
          severity: warning
          service: cdn
        annotations:
          summary: "CDN缓存命中率低于85%"
          description: "当前CDN缓存命中率: {{ $value }}%。可能需要调整缓存策略或检查源站响应头。"
      
      # 响应时间异常告警
      - alert: CDN响应时间过高
        expr: histogram_quantile(0.95, rate(cdn_response_time_seconds_bucket[5m])) > 0.5
        for: 5m
        labels:
          severity: warning
          service: cdn
        annotations:
          summary: "CDN P95响应时间超过500ms"
          description: "当前P95响应时间: {{ $value }}秒。可能原因：源站响应慢、网络拥塞或CDN节点异常。"
      
      # 5xx错误率过高告警
      - alert: CDN错误率过高
        expr: (sum(rate(cdn_5xx_responses_total[5m])) / sum(rate(cdn_requests_total[5m]))) * 100 > 1
        for: 2m
        labels:
          severity: critical
          service: cdn
        annotations:
          summary: "CDN 5xx错误率超过1%"
          description: "当前5xx错误率: {{ $value }}%。可能原因：源站故障、配置错误或DDoS攻击。"
      
      # DDoS攻击检测告警
      - alert: 疑似DDoS攻击
        expr: sum(rate(cdn_requests_total[1m])) / avg_over_time(cdn_requests_total[10m:1m]) > 3
        for: 1m
        labels:
          severity: critical
          service: cdn_security
        annotations:
          summary: "检测到疑似DDoS攻击"
          description: "请求量突增，当前速率是基线值的 {{ $value }} 倍。正在自动启用防护措施。"
      
      # WAF拦截突增告警
      - alert: WAF拦截次数突增
        expr: sum(rate(waf_blocked_requests_total[5m])) / avg_over_time(waf_blocked_requests_total[30m:5m]) > 10
        for: 2m
        labels:
          severity: warning
          service: waf
        annotations:
          summary: "WAF拦截次数异常增加"
          description: "WAF拦截次数是基线值的 {{ $value }} 倍。可能正在遭受针对性攻击。"

# Alertmanager配置（alertmanager.yml）
global:
  smtp_smarthost: 'smtp.example.com:587'
  smtp_from: 'alerts@example.com'
  smtp_auth_username: 'alerts@example.com'
  smtp_auth_password: 'password'

route:
  group_by: ['alertname', 'service']
  group_wait: 30s
  group_interval: 5m
  repeat_interval: 12h
  receiver: 'default-receiver'
  
  routes:
    - match:
        severity: critical
      receiver: 'critical-alerts'
      group_wait: 10s
      repeat_interval: 5m
    
    - match:
        service: cdn_security
      receiver: 'security-team'
      group_wait: 10s

receivers:
  - name: 'default-receiver'
    email_configs:
      - to: 'ops-team@example.com'
        headers:
          Subject: '{{ template "email.default.subject" . }}'
  
  - name: 'critical-alerts'
    email_configs:
      - to: 'ops-team@example.com'
      - to: 'oncall-engineer@example.com'
    webhook_configs:
      - url: 'https://chat.example.com/hooks/alerts'
        send_resolved: true
  
  - name: 'security-team'
    email_configs:
      - to: 'security-team@example.com'
    webhook_configs:
      - url: 'https://security-chat.example.com/hooks/alerts'
      - url: 'https://api.slack.com/services/security-alerts'

# 金融平台CDN安全配置要点
# 1. 全站强制HTTPS + HSTS
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# 2. 严格的CSP策略
add_header Content-Security-Policy "
    default-src 'none';
    script-src 'self' 'unsafe-inline' 'unsafe-eval' https://trusted.cdn.com;
    style-src 'self' 'unsafe-inline';
    img-src 'self' data: https://static.example.com;
    font-src 'self' https://fonts.example.com;
    connect-src 'self' https://api.example.com;
    frame-ancestors 'none';
    base-uri 'self';
    form-action 'self';
" always;

# 3. 敏感操作二次验证
location ~ ^/(transfer|withdraw|payment) {
    # 额外的安全头
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    
    # 严格的速率限制
    limit_req zone=sensitive_limit burst=3 nodelay;
    
    # 禁用缓存
    add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate";
    expires 0;
}

# 4. API接口保护
location /api/v1/ {
    # API密钥验证
    if ($http_x_api_key != 'your-secure-api-key') {
        return 403;
    }
    
    # 请求签名验证
    # ... 实现请求签名验证逻辑
    
    # 记录详细的访问日志
    access_log /var/log/nginx/api_access.log json_combined;
}

# 5. 实时监控与审计
# 所有敏感操作记录完整日志
log_format security_log '$remote_addr - $remote_user [$time_local] '
                       '"$request" $status $body_bytes_sent '
                       '"$http_referer" "$http_user_agent" '
                       '"$http_x_forwarded_for" "$request_time" '
                       '"$upstream_response_time" "$scheme"';

location ~ ^/(api|admin|dashboard) {
    access_log /var/log/nginx/security.log security_log;
}