Nginx外置缓存匿名location的使用

# 方式1：try_files（最常用）
try_files $uri @cache_backend;
# 方式2：error_page（降级专用）
error_page 590 =200 @redis_fallback;
# 方式3：rewrite + last（条件跳转）
rewrite ^/api/v1/(.*)$ @legacy_cache last;

http {
    lua_shared_dict l1_cache 100m;
    server {
        listen 80;
        # ========== 入口：统一缓存网关 ==========
        location /api/ {
            content_by_lua_block {
                local key = ngx.var.scheme .. ":" .. ngx.var.host .. ngx.var.uri
                -- L1: 本地共享字典
                local val = ngx.shared.l1_cache:get(key)
                if val then
                    ngx.header["X-Cache"] = "L1-HIT"
                    ngx.say(val)
                    return
                end
                -- L2/L3: 委托给匿名location处理
                local res = ngx.location.capture("@cache_lookup", { share_all_vars = true })
                if res.status == 200 then
                    ngx.header["X-Cache"] = res.header["X-Cache"] or "L2-HIT"
                    ngx.say(res.body)
                else
                    ngx.status = res.status
                    ngx.say(res.body)
                end
            }
        }
        # ========== L2: Redis查询（匿名location）==========
        location @cache_lookup {
            internal;
            content_by_lua_block {
                local cache = require "cache_handler"
                local key = ngx.var.scheme .. ":" .. ngx.var.host .. ngx.var.uri
                local data, err = cache.get(key)
                if data then
                    ngx.header["X-Cache"] = "L2-HIT"
                    ngx.say(cjson.encode(data))
                    return
                end
                if err == "REDIS_UNAVAILABLE" then
                    -- 触发降级到L3
                    return ngx.exec("@cache_backend")  -- ⭐ 内部跳转，非子请求
                end
                -- MISS：也跳转回源
                return ngx.exec("@cache_backend")
            }
        }
        # ========== L3: 回源（匿名location）==========
        location @cache_backend {
            internal;
            proxy_pass http://backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            # 回源成功后回填缓存的逻辑放在post_action或Lua header_filter中
            header_filter_by_lua_block {
                if ngx.status == 200 then
                    ngx.ctx.cache_key = ngx.var.scheme .. ":" .. ngx.var.host .. ngx.var.uri
                    ngx.ctx.should_cache = true
                end
            }
            body_filter_by_lua_block {
                if ngx.ctx.should_cache and ngx.arg[2] then  -- EOF
                    local cache = require "cache_handler"
                    cache.set(ngx.ctx.cache_key, ngx.arg[1], 300)
                end
            }
        }
        # ========== 降级兜底（匿名location）==========
        location @cache_static_fallback {
            internal;
            default_type application/json;
            add_header X-Cache-Degraded "full-failure" always;
            return 503 '{"code":503,"msg":"service temporarily unavailable"}';
        }
    }
}

# ❌ 错误：期望客户端Header自动传到匿名location
location @cache_backend {
    proxy_set_header X-User-ID $http_x_user_id;  # 可能为空！
}
# ✅ 正确：在主location中捕获，通过变量传递
location /api/ {
    set $saved_user_id $http_x_user_id;
    content_by_lua_block { ... ngx.exec("@cache_backend") ... }
}
location @cache_backend {
    proxy_set_header X-User-ID $saved_user_id;  # 可靠
}

local res = ngx.location.capture("@cache_lookup", {
    share_all_vars = true,
    ctx = { user_id = ngx.req.get_headers()["X-User-ID"] },  -- 通过ctx传递
})

location @cache_backend {
    internal;                          # 第1层：禁止外部访问
    # 第2层：即使internal失效，也拒绝非预期来源
    if ($http_x_internal_token != "your-secret") {
        return 403;
    }
    # 第3层：限制方法
    limit_except GET HEAD {
        deny all;
    }
    # 第4层：开启审计日志
    access_log /var/log/nginx/internal_access.log combined;
    proxy_pass http://backend;
}

# 为匿名location单独配置日志
log_format internal '$remote_addr [$time_local] "@$location_name" '
                    '$status $body_bytes_sent $request_time';
server {
    location @cache_backend {
        internal;
        access_log /var/log/nginx/cache_internal.log internal;
        # ...
    }
}

location @cache_lookup {
    internal;
    add_header X-Internal-Path "lookup" always;
    # ...
}
location @cache_backend {
    internal;
    add_header X-Internal-Path "backend" always;
    # ...
}

# 验证匿名location确实不可外部访问
curl -v http://localhost/@cache_backend
# 期望：404 Not Found
# 通过正常入口触发，检查内部Header
curl -sI http://localhost/api/config | grep X-Internal
# 查看内部日志
tail -f /var/log/nginx/cache_internal.log