Proxy qatlamlari va reverse-marshrutlash

Qisqacha xulosa

Proksi-qatlam - platformaning «old shinasi»: u TLSni yakunlaydi, mijozlarni tasdiqlaydi, trafikni taqsimlaydi, cho’qqilarni tekislaydi va chiqarishni xavfsiz qiladi (kanareykalar, blue-green). Kamolotning minimal to’plami: proksi-rollarni aniq stratifikatsiya qilish, determinizatsiya qilish qoidalari, taymaut/retraylarni nazorat qilish, kesh + rate-limit, kuzatish va avtomatlashtirish.

Proksi taksonomiyasi

Forward proxy - mijozlar/xizmatlarning tashqariga chiqadigan trafigi (egress), filtrlar/oynalar, DLP.
Reverse proxy - tashqi so’rovlarni qabul qiladi va orqa tomonlarga yo’naltiradi (bizning asosiy diqqat).

Prod-konturdagi qatlamlar:

1. Edge/CDN/WAF (Anycast, bot-filtrlar, kesh)

2. L7 Ingress/API-gateway (marshrut, autentifikatsiya, siyosatlar)

3. Servis qatlami/Mesh (sidecar) east-west, mTLS va retraylar uchun

4. Egress-gateway chiquvchi integratsiyalar uchun (PSP, sheriklar)

Yo’naltirish (L4/L7) va algoritmlar

L4 (TCP/UDP, passthrough TLS): HTTP tushunmasdan minimal kechikish.
L7 (HTTP/1. 1, HTTP/2, HTTP/3/gRPC): host/path/header/cookie qoidalari, transformatsiya, WAF, kesh.

Algoritmlar:

Round-robin/Least-connections/EWMA - umumiy holatlar.
Consistent-hash (cookie/identifikator boʻyicha) - sticky-sessiyalar va kesh-lokalligi.
Header-/Geo-/Latency-based - hududlar/provayderlar bo’yicha maqsadli, tezkor PoP.
Canary/Weighted - bosqichma-bosqich rollout (5 → 25 → 50 → 100%).
Shadow/Mirroring - javoblarga ta’sir qilmaydigan yangi xizmatga trafikning nusxasi.

So’rovlar/javoblarni transformatsiya qilish

URL rewrite/redirect: yoʻllarni birxillashtirish, versiyalash (’/v1/→/svc/v1/’).
Sarlavhalar:’X-Forwarded-For/Proto/Host’ni normallashtiring,’traceparent ’/’ x-request-id’ni qo’shing, ortiqcha filtrlang.
CORS/CSRF: gateway’da markazlashtiring, har bir xizmatda moslamalarni ko’paytirmang.
Compression/Decompression: Brotli/gzip, turlari boʻyicha nazorat.
Body-limits va slowloris/oversized headers himoyasi.

Autentifikatsiya va xavfsizlik

TLS 1. 3 + OCSP stapling + HSTS tashqi jabhalarda.
mTLS: ma’murlar, operatsion API, sheriklik kanallari.
OAuth2/OIDC: gateway (token introspection/JWT-verify) orqali avtorizatsiya → claims uchun upstream.
Xizmatlararo va sheriklik integratsiyalari uchun API-kalitlar/imzolar (HMAC).
WAF/bot-filtrlar: signatura + xulq-atvor qoidalari, greypass/kapcha.
CSP/X-Frame-Options/Referrer-Policy - xavfsizlik sarlavhalari.

Ishonchlilik: retrai/taymautlar/SV

Taymautlar: L4/L7 uchun connect/read/write, yagona siyosat (masalan,’connect 500ms’,’read 3-5s’API uchun).
Retralar: faqat idempotent (’GET/HEAD’), vaqt/miqdor bo’yicha limit,’retry-budget’.
Circuit-breaker: bir vaqtning o’zida so’rovlar/xatolar, tezda rad etish va tanazzulga yo’l qo’yish.
Outlier detection: «yomon» nusxalarni puldan chiqarish.
Backoff + jitter: «podani» yaratmaslik uchun.

Kesh va trafikni boshqarish

L7 keshi: statika/yarim dinamika (kataloglar, konfiglar),’s-maxage’+’stale-while-revalidate’.
Rate-limit/Quota: IP/ASN/device/cookie bo’yicha, taqsimlangan hisoblagich (Redis/Rate-service).
Sticky-sessiyalar: cookie/consistent-hash; failover va qayta yopishtirishni hisobga oling.
Request collapsing (dedupe): origin bir xil GETlarni «boʻron» dan himoya qilish.

Protokollar va xususiyatlar

HTTP/2: multiplekslash, ustuvorliklar; ’ALPN: h2’ tuting.
HTTP/3/QUIC: yo’qotishga/jitterga chidamlilik; UDP/443 oching, MTU/PMTUDni kuzatib boring.
gRPC: health-checks, streaming, deadlines; proksi’grpc-status’ni qoʻllab-quvvatlashi kerak.
WebSocket/SSE: long-lived konnektlari, savodli idle-taymautlar va limitlar.

Kuzatish darajasi va SLO

Metriklar:

L4/L7: `p50/p95/p99`, ошибки (`4xx/5xx/Grpc-codes`), `open_conns`, `CPS/RPS`, `retry_rate`.
TLS: versiya/shifrlar, p95 handshake, resumption.
Marshrutlash: route/cluster, outlier-ejections bo’yicha ulushlar.
Rate-limit/WAF: ishga tushirish/FP-rate.
Loglar: kirish (PIIsiz), marshrutlash sabablari, trassirovka sarlavhalari.
Treyslar:’traceparent ’/B3, semplash.

SLO (misollar):

p95 TTFB API ≤ 250-300 ms; L7 ≤ 0 xatosi. 5%.
Kanareykalarning muvaffaqiyati (metrik degradatsiyasiz) ≥ 99% uchirish.
FP-rate WAF ≤ 0. 1%.

Namunaviy konfigiglar

Nginx (reverse proxy, HTTP/2, kanareyka, siqish)

nginx map $http_x_canary $upstream_pool {
default "stable";
~^1$ "canary";
}

upstream api_stable { zone zst 64k; server 10. 0. 1. 10:8443; server 10. 0. 1. 11:8443; keepalive 256; }
upstream api_canary { zone zcn 64k; server 10. 0. 2. 10:8443; keepalive 64; }

server {
listen 443 ssl http2 reuseport;
server_name api. example. com;

ssl_protocols TLSv1. 2 TLSv1. 3;
ssl_stapling on; ssl_stapling_verify on;
add_header Strict-Transport-Security "max-age=31536000" always;

basic limits/protection client_max_body_size 10m;
sendfile on; brotli on; gzip on;

location / {
proxy_http_version 1. 1;
proxy_set_header Host $host;
proxy_set_header X-Request-Id $request_id;
proxy_set_header X-Forwarded-Proto https;
proxy_connect_timeout 500ms;
proxy_read_timeout 5s;
proxy_next_upstream error timeout http_502 http_503 http_504;
proxy_next_upstream_tries 1; # Retrays are limited to proxy_pass https://api_$upstream_pool;
}
}

HAProxy (JWT-verify + mTLS + rate-limit)

haproxy frontend fe_https bind:443 ssl crt /etc/haproxy/certs/ alpn h2,http/1. 1 http-request set-header X-Request-Id %[unique-id]
http-request lua. jwt_verify # external verification script JWT stick-table type ip size 1m expire 10m store http_req_rate (10s)
http-request deny if { src_http_req_rate(10s) gt 100 }

default_backend be_api

backend be_api balance roundrobin option httpchk GET /healthz server s1 10. 0. 1. 10:8443 check ssl verify required ca-file /etc/haproxy/ca. pem server s2 10. 0. 1. 11:8443 check ssl verify required ca-file /etc/haproxy/ca. pem

Envoy (JWT + weighted routes + outlier detection)

yaml static_resources:
listeners:
- name: https address: { socket_address: { address: 0. 0. 0. 0, port_value: 443 } }
filter_chains:
- filters:
- name: envoy. filters. network. http_connection_manager typed_config:
"@type": type. googleapis. com/envoy. extensions. filters. network. http_connection_manager. v3. HttpConnectionManager stat_prefix: ingress route_config:
virtual_hosts:
- name: api domains: ["api. example. com"]
routes:
- match: { prefix: "/" }
route:
weighted_clusters:
clusters:
- { name: api-stable, weight: 95 }
- { name: api-canary, weight: 5 }
http_filters:
- name: envoy. filters. http. jwt_authn typed_config: { "@type": type. googleapis. com/envoy. extensions. filters. http. jwt_authn. v3. JwtAuthentication }
- name: envoy. filters. http. router clusters:
- name: api-stable connect_timeout: 0. 5s type: STRICT_DNS lb_policy: ROUND_ROBIN outlier_detection: { consecutive_5xx: 3, interval: 2s, base_ejection_time: 30s }
transport_socket:
name: envoy. transport_sockets. tls
- name: api-canary connect_timeout: 0. 5s type: STRICT_DNS lb_policy: ROUND_ROBIN transport_socket:
name: envoy. transport_sockets. tls

Traefik (rule-based yo’nalishlar, kontseptsiya)

yaml http:
routers:
api:
rule: "Host(`api. example. com`) && PathPrefix(`/v1/`)"
service: api-svc tls: { certResolver: letsencrypt }
services:
api-svc:
loadBalancer:
servers:
- url: "https://10. 0. 1. 10:8443"
- url: "https://10. 0. 1. 11:8443"

Proksi quvvati

Connection pooling va keepalive to backendlar, instansiya uchun konnektlar limiti.
Reuseport, pin CPU/IRQ, yetarli soket buferlari.
TLS: ECDSA + qisqa zanjirlar, resumption ≥ 70%, HTTP/2/3 kiritilgan.
«Issiq» javoblar uchun proksidagi kesh (shu jumladan 304-validatsiyalar).
Warm-up: choʻqqilar oldidan DNS/TLS/konnektlarni isitish.

DR va nosozlikka chidamlilik

Degradatsiya uzellarini avtotransport qilish (’outlier-ejection’).
Health-checks L4/L7 (HTTP body-marker versiyasi).
Fail-open/Fail-closed - to’lov/tanqidiy yo’llar uchun ongli ravishda tanlang.
Yangi xizmatga oʻtishdan oldin shadow rejimi.
Runbooks: «klasterning qulashi», «rederlar halqasi», «konnektlarning oqishi», «retray bo’roni».

Joriy etish chek-varaqasi

Stratifikatsiya: Edge → Ingress/API-GW → Mesh/Egress, mas’uliyatning roli va chegaralari.
Yoʻnaltirish siyosati: host/path/header/weight, canary/blue-green, shadow.
Xavfsizlik: TLS 1. 3, sezgir yo’llar uchun mTLS, JWT/OAuth2, WAF.
Taymautlar/retrajlar/SV: yagona qiymatlar, idempotentlik, retry-budget.
Kesh/Rate-limit/Request-collapsing.
Kuzatish darajasi: metriklar/loglar/treyslar, correlation identifikatorlari.
SLO: p95/xatolar/resurslar; perimetr uzilishlariga alertlar.
IaC/GitOps: repozitoriyadagi proksi konfigi, kanar relizlari, tezkor rollback.
Testlar: e2e-yo’nalishlar, chaos-stsenariylar, tadbir oldidan yuklash.

Tipik xatolar

Rollarni ajratmagan «sehrli» proksi kombayn → murakkab RCA va yuqori blast radiusi.
Idempotent boʻlmagan soʻrovlar uchun retrajlar → tranzaksiyalarning dublikatlari.
Sarlavhalar/URL → cache-poisoning va tugmalar notoʻgʻri.
Sticky-seanslar rejasiz failover → degradatsiya instansiyasida yopishish.
’traceparent ’/’ x-request-id’ → mavjud emas.
Proksi darajasida qattiq 301/302 → «loop» va API versiyalari nazoratini yoʻqotish.

iGaming/fintech uchun o’ziga xos

To’lovlar/PSP: mTLS bilan ajratilgan egress-gateway, qat’iy taymautlar, idempotent kalitlar, IP/ASN oq ro’yxatlari.
Piki (o’yinlar/turnirlar): canary/weighted, botlar uchun kulrang yo’nalishlar, agressiv GET kesh, originni «bo’ron» dan himoya qilish.
Tartibga solish/loglash: siyosat versiyalari va yo’nalish sabablarini audit-loglarda qayd eting; PII ni minimallashtiring.
Kontent provayderlari: kesh lokalligi va teng taqsimlanishi uchun provayder kaliti bo’yicha consistent-hash.

Mini-pleybuklar

1) Kanar API relizi

1. ’api-canary’ ga 5% og’irlikni kiritish; 2) r95/xato monitoringi; 3) ulushni kengaytirish; 4) degradatsiyada avtootkat.

2) Degradatsiya tugunini shoshilinch olib tashlash

1. Outlier-ejection yoki qo’lda’drain’; 2) keshning puli va xitini tekshirish; 3) hodisadan keyingi RCA.

3) Funksiyani oynalash

1. Javoblarga ta’sir qilmasdan shadowni yoqish; 2) javoblarning metrikasi/diffini solishtirish; 3) o’zgartirish to’g "risida qaror qabul qilish.

4) Retray bo’roni

1. retry-budget/vaqtinchalik limitlar kamaytirilsin; 2) request-collapsing kiritilsin; 3) lokal zaglushki/kesh; 4) originni barqarorlashtirish.

Jami

Yaxshi ishlab chiqilgan proksi qatlami - bu rollarni ajratish, determinizatsiya yo’nalishi, ishonchli siyosat (taymautlar/retrailar/SV), xavfsizlik (mTLS/JWT/WAF) va kuzatish qobiliyati. Konfiguratsiyalarni IaC-ga oʻrnating, kanareykalar va shadolardan foydalaning, SLOni oʻlchang va platformaniz hatto eng issiq pik soatlarda ham oʻlchanishi, oldindan aytilishi va himoyalanishi mumkin.