性能优化 #

┌─────────────────────────────────────────────────────────────┐
│                    性能优化层次                              │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│    1. 系统层 - 内核参数、文件描述符                          │
│         ↓                                                   │
│    2. 网络层 - 连接池、超时设置                              │
│         ↓                                                   │
│    3. 应用层 - 压缩、缓存、并发                              │
│         ↓                                                   │
│    4. 存储层 - 磁盘 I/O、证书存储                            │
│                                                             │
└─────────────────────────────────────────────────────────────┘

# 查看当前限制
ulimit -n

# 临时修改
ulimit -n 65535

# 永久修改 - /etc/security/limits.conf
* soft nofile 65535
* hard nofile 65535

# /etc/sysctl.conf 或 /etc/sysctl.d/99-caddy.conf

# 网络优化
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 65535
net.ipv4.tcp_max_syn_backlog = 65535
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_keepalive_time = 1200
net.ipv4.tcp_keepalive_probes = 5
net.ipv4.tcp_keepalive_intvl = 30
net.ipv4.tcp_max_tw_buckets = 5000
net.ipv4.ip_local_port_range = 1024 65535

# 应用优化
fs.file-max = 2097152
fs.nr_open = 2097152

# 应用配置
sudo sysctl -p

# /etc/systemd/system/caddy.service.d/override.conf
[Service]
LimitNOFILE=1048576
LimitNPROC=512
LimitMEMLOCK=infinity

# 应用配置
sudo systemctl daemon-reload
sudo systemctl restart caddy

{
    # 服务器配置
    servers {
        # 最大头部大小
        max_header_size 16KB
        
        # 协议支持
        protocols h1 h2 h3
        
        # 日志
        logs {
            logger_name {
                output file /var/log/caddy/access.log
            }
        }
    }
    
    # 存储
    storage file_system {
        root /var/lib/caddy
    }
}

{
    servers {
        # 启用 HTTP/2 和 HTTP/3
        protocols h1 h2 h3
    }
}

example.com {
    # HTTP/3 (QUIC) 自动启用
    # 需要开放 UDP 443 端口
    respond "HTTP/3 enabled"
}

example.com {
    reverse_proxy localhost:3000 {
        transport http {
            # 连接池
            keepalive 90s
            keepalive_idle_conns 100
            keepalive_idle_conns_per_host 20
            
            # 超时
            dial_timeout 5s
            response_header_timeout 10s
        }
    }
}

example.com {
    root * /var/www/html
    file_server
    
    encode {
        # Gzip 中等压缩率
        gzip 6
        
        # Zstd 更好的压缩
        zstd 5
        
        # 最小压缩大小
        minimum_length 256
        
        # 排除已压缩格式
        except image/* video/* audio/* application/pdf application/zip
    }
}

example.com {
    root * /var/www/html
    
    file_server {
        # 启用预压缩
        precompressed
    }
    
    encode gzip zstd
}

example.com {
    root * /var/www/html
    file_server
    
    # 静态资源长期缓存
    @static path *.css *.js *.png *.jpg *.svg *.woff *.woff2
    header @static Cache-Control "public, max-age=31536000, immutable"
    
    # HTML 短期缓存
    @html path *.html
    header @html Cache-Control "public, max-age=3600"
}

example.com {
    reverse_proxy localhost:3000
    
    # 允许缓存
    header Cache-Control "public, max-age=3600, s-maxage=86400"
}

example.com {
    reverse_proxy localhost:3000 {
        transport http {
            # 连接池大小
            keepalive_idle_conns 200
            keepalive_idle_conns_per_host 50
            
            # 连接保持时间
            keepalive 120s
            
            # 最大连接数
            max_conns_per_host 0  # 0 表示无限制
        }
    }
}

example.com {
    tls {
        # TLS 会话复用默认启用
        protocols tls1.2 tls1.3
    }
    
    respond "TLS optimized"
}

# OCSP Stapling 默认启用
example.com {
    respond "OCSP Stapling enabled"
}

{
    # 全局 TLS 配置
    servers {
        protocols h1 h2 h3
    }
}

example.com {
    tls {
        protocols tls1.2 tls1.3
    }
}

{
    # 禁用不必要的功能
    admin off  # 如果不需要 API
    
    # 日志优化
    log {
        output file /var/log/caddy/access.log {
            roll_size 50mb
            roll_keep 5
        }
    }
}

example.com {
    # 最小化配置
    root * /var/www/html
    file_server
}

example.com {
    # 使用 JSON 格式（更紧凑）
    log {
        output file /var/log/caddy/access.log {
            roll_size 100mb
            roll_keep 10
        }
        format json
    }
    
    # 排除健康检查
    @health path /health
    log @health off
    
    respond "Hello"
}

{
    # 使用 SSD 存储
    storage file_system {
        root /var/lib/caddy  # 确保在 SSD 上
    }
}

example.com {
    log {
        output file /var/log/caddy/access.log {
            # 较大的轮转大小减少 I/O
            roll_size 100mb
            roll_keep 10
        }
    }
}

# 查看 Caddy 状态
curl localhost:2019/config/

# 查看连接状态
ss -tlnp | grep caddy

# 查看进程状态
ps aux | grep caddy

# 查看内存使用
top -p $(pgrep caddy)

# 使用 ab 测试
ab -n 10000 -c 100 https://example.com/

# 使用 wrk 测试
wrk -t12 -c400 -d30s https://example.com/

# 使用 hey 测试
hey -n 10000 -c 100 https://example.com/

# CPU 分析
curl localhost:2019/debug/pprof/profile?seconds=30 > cpu.prof
go tool pprof cpu.prof

# 内存分析
curl localhost:2019/debug/pprof/heap > mem.prof
go tool pprof mem.prof

# 协程分析
curl localhost:2019/debug/pprof/goroutine > goroutine.prof
go tool pprof goroutine.prof

{
    servers {
        max_header_size 16KB
        protocols h1 h2 h3
    }
}

example.com {
    root * /var/www/html
    file_server {
        precompressed
    }
    
    # 压缩
    encode {
        gzip 6
        zstd 5
        minimum_length 256
    }
    
    # 缓存
    @static path *.css *.js *.png *.jpg *.svg *.woff *.woff2
    header @static Cache-Control "public, max-age=31536000, immutable"
    
    @html path *.html
    header @html Cache-Control "public, max-age=3600"
    
    # 安全头部
    header {
        Strict-Transport-Security "max-age=31536000"
        X-Content-Type-Options "nosniff"
        -Server
    }
    
    # 日志
    log {
        output file /var/log/caddy/access.log {
            roll_size 100mb
            roll_keep 10
        }
        format json
    }
}

{
    servers {
        max_header_size 32KB
        protocols h1 h2 h3
    }
}

api.example.com {
    # 连接优化
    reverse_proxy localhost:3000 {
        transport http {
            keepalive 120s
            keepalive_idle_conns 200
            keepalive_idle_conns_per_host 50
            dial_timeout 5s
            response_header_timeout 10s
        }
    }
    
    # 压缩
    encode {
        gzip 4
        zstd 3
    }
    
    # 头部
    header {
        -Server
        X-Response-Time "{duration}"
    }
    
    # 日志
    log {
        output file /var/log/caddy/api.log {
            roll_size 100mb
            roll_keep 14
        }
        format json
    }
}

{
    servers {
        max_header_size 16KB
        protocols h1 h2 h3
    }
}

example.com {
    reverse_proxy {
        to server1:3000
        to server2:3000
        to server3:3000
        to server4:3000
        
        lb_policy least_conn
        
        health_uri /health
        health_interval 10s
        
        transport http {
            keepalive 90s
            keepalive_idle_conns 400
            keepalive_idle_conns_per_host 100
            dial_timeout 3s
        }
    }
    
    encode gzip zstd
    
    log {
        output file /var/log/caddy/lb.log {
            roll_size 100mb
        }
        format json
    }
}