프록시(Proxy)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

upstream backend {
    server backend1.example.com:80;
    server backend2.example.com:80;
    server backend3.example.com:80;
}

server {
    listen 80;
    server_name example.com;
    
    location / {
        proxy_pass http://backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # 캐싱 설정
        proxy_cache my_cache;
        proxy_cache_valid 200 1h;
        
        # 타임아웃 설정
        proxy_connect_timeout 5s;
        proxy_send_timeout 10s;
        proxy_read_timeout 10s;
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

global
    daemon
    maxconn 4096

defaults
    mode http
    timeout connect 5s
    timeout client 10s
    timeout server 10s

frontend web_frontend
    bind *:80
    bind *:443 ssl crt /etc/ssl/crt/certificate.pem
    redirect scheme https if !{ ssl_fc }
    default_backend web_servers

backend web_servers
    balance roundrobin
    option httpchk GET /health
    server web1 192.168.1.10:8080 check
    server web2 192.168.1.11:8080 check
    server web3 192.168.1.12:8080 check

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

const http = require('http');
const httpProxy = require('http-proxy-middleware');
const express = require('express');

const app = express();

// 프록시 미들웨어 설정
const proxyOptions = {
    target: 'http://backend-server:3000',
    changeOrigin: true,
    pathRewrite: {
        '^/api': '/api/v1'
    },
    onProxyReq: (proxyReq, req, res) => {
        // 요청 헤더 수정
        proxyReq.setHeader('X-Forwarded-For', req.ip);
    },
    onProxyRes: (proxyRes, req, res) => {
        // 응답 헤더 수정
        proxyRes.headers['X-Proxy-By'] = 'MyProxy';
    }
};

app.use('/api', httpProxy(proxyOptions));

app.listen(8080, () => {
    console.log('프록시 서버가 8080 포트에서 실행 중입니다.');
});

1

[내부 네트워크] → [포워드 프록시] → [방화벽] → [인터넷]

1

[클라이언트] → [부서별 프록시] → [중앙 프록시] → [인터넷]

1

[클라이언트] →(인식하지 못함)→ [투명 프록시] → [인터넷]

1

[인터넷] → [방화벽] → [리버스 프록시] → [웹 서버 팜]

1

[클라이언트] → [API 게이트웨이(리버스 프록시)] → [다양한 마이크로서비스]

1

[클라이언트] → [CDN/엣지] → [지역 로드 밸런서] → [애플리케이션 프록시] → [백엔드]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

# Squid 기본 구성 예시
http_port 3128

# 액세스 제어
acl localnet src 10.0.0.0/8
acl allowed_sites dstdomain .example.com .google.com
http_access allow localnet allowed_sites
http_access deny all

# 캐싱 설정
cache_dir ufs /var/spool/squid 100 16 256
cache_mem 256 MB
maximum_object_size 10 MB

# 로깅
access_log /var/log/squid/access.log squid

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

# Nginx 리버스 프록시 구성 예시
http {
    upstream backend_servers {
        server backend1.example.com:8080;
        server backend2.example.com:8080;
        server backend3.example.com:8080;
    }

    server {
        listen 80;
        server_name example.com;

        location / {
            proxy_pass http://backend_servers;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # 캐싱 설정
        location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
            proxy_pass http://backend_servers;
            proxy_cache mycache;
            proxy_cache_valid 200 302 1h;
            proxy_cache_valid 404 1m;
            expires 1h;
        }
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

const express = require('express');
const { createProxyMiddleware } = require('http-proxy-middleware');

const app = express();

// 인증 처리 미들웨어
app.use((req, res, next) => {
  const token = req.headers['authorization'];
  if (!token || token !== 'Bearer VALID_TOKEN') {
    return res.status(401).send('Unauthorized');
  }
  next();
});

// 주문 API 프록시
app.use('/api/order', createProxyMiddleware({
  target: 'http://localhost:5001',
  changeOrigin: true,
  pathRewrite: { '^/api/order': '' }
}));

// 결제 API 프록시
app.use('/api/pay', createProxyMiddleware({
  target: 'http://localhost:5002',
  changeOrigin: true,
  pathRewrite: { '^/api/pay': '' }
}));

app.listen(3000, () => {
  console.log('Proxy 서버 실행 중: http://localhost:3000');
});

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

import http.server
import socketserver

PORT = 8080

class SimpleProxy(http.server.SimpleHTTPRequestHandler):
    def do_GET(self):
        # 간단히 요청 로그 기록
        print(f"요청 URI: {self.path}")

        # 외부 서버에 요청 중계(여기서는 하드코딩 예시)
        self.send_response(200)
        self.send_header('Content-type','text/html')
        self.end_headers()
        response = f"이 요청은 프록시를 거쳤습니다.요청 URI: {self.path}"
        self.wfile.write(response.encode())

with socketserver.TCPServer(("", PORT), SimpleProxy) as httpd:
    print(f"프록시 서버 구동 (포트: {PORT})")
    httpd.serve_forever()

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155

# Python Flask 기반 간단한 프록시 서버
from flask import Flask, request, Response
import requests
import random
import time
from functools import wraps

app = Flask(__name__)

# 백엔드 서버 목록
BACKEND_SERVERS = [
    'http://backend1:8080',
    'http://backend2:8080',
    'http://backend3:8080'
]

# 서버 헬스 체크 상태
server_health = {server: True for server in BACKEND_SERVERS}

# 간단한 캐시 구현
cache = {}
CACHE_TTL = 300  # 5분

def health_check():
    """백엔드 서버 헬스 체크"""
    for server in BACKEND_SERVERS:
        try:
            response = requests.get(f"{server}/health", timeout=5)
            server_health[server] = response.status_code == 200
        except:
            server_health[server] = False

def get_healthy_server():
    """헬스한 서버 선택 (라운드 로빈)"""
    healthy_servers = [s for s in BACKEND_SERVERS if server_health[s]]
    if not healthy_servers:
        return None
    return random.choice(healthy_servers)

def cache_key(request):
    """캐시 키 생성"""
    return f"{request.method}:{request.path}:{request.query_string.decode()}"

def with_cache(ttl=CACHE_TTL):
    """캐싱 데코레이터"""
    def decorator(func):
        @wraps(func)
        def wrapper(*args, **kwargs):
            if request.method == 'GET':
                key = cache_key(request)
                cached_data = cache.get(key)
                if cached_data and time.time() - cached_data['timestamp'] < ttl:
                    return cached_data['response']
            
            response = func(*args, **kwargs)
            
            if request.method == 'GET' and response.status_code == 200:
                cache[cache_key(request)] = {
                    'response': response,
                    'timestamp': time.time()
                }
            
            return response
        return wrapper
    return decorator

@app.before_request
def before_request():
    """요청 전처리 - 보안 헤더 및 로깅"""
    # 클라이언트 IP 추가
    if 'X-Forwarded-For' not in request.headers:
        request.environ['HTTP_X_FORWARDED_FOR'] = request.remote_addr
    
    # 요청 로깅
    app.logger.info(f"Request: {request.method} {request.path} from {request.remote_addr}")

@app.route('/', defaults={'path': ''})
@app.route('/<path:path>', methods=['GET', 'POST', 'PUT', 'DELETE'])
@with_cache(ttl=300)  # 5분 캐싱
def proxy(path):
    """메인 프록시 함수"""
    # 헬스한 백엔드 서버 선택
    backend = get_healthy_server()
    if not backend:
        return Response("No healthy backend servers", status=503)
    
    # 요청 URL 구성
    url = f"{backend}/{path}"
    if request.query_string:
        url += f"?{request.query_string.decode()}"
    
    # 헤더 처리
    headers = dict(request.headers)
    headers['X-Forwarded-For'] = request.environ.get('HTTP_X_FORWARDED_FOR', request.remote_addr)
    headers['X-Forwarded-Proto'] = request.scheme
    headers['X-Proxy-By'] = 'MyProxy/1.0'
    
    try:
        # 백엔드로 요청 전달
        response = requests.request(
            method=request.method,
            url=url,
            data=request.get_data(),
            headers=headers,
            timeout=30,
            allow_redirects=False
        )
        
        # 응답 헤더 처리
        excluded_headers = ['content-encoding', 'content-length', 'transfer-encoding', 'connection']
        response_headers = [(k, v) for k, v in response.headers.items() 
                          if k.lower() not in excluded_headers]
        
        # 보안 헤더 추가
        response_headers.extend([
            ('X-Content-Type-Options', 'nosniff'),
            ('X-Frame-Options', 'DENY'),
            ('X-XSS-Protection', '1; mode=block')
        ])
        
        return Response(
            response=response.content,
            status=response.status_code,
            headers=response_headers
        )
        
    except requests.exceptions.RequestException as e:
        app.logger.error(f"Backend request failed: {e}")
        return Response("Backend request failed", status=502)

@app.route('/proxy/health')
def proxy_health():
    """프록시 서버 헬스 체크"""
    health_check()  # 백엔드 서버 상태 업데이트
    healthy_count = sum(server_health.values())
    return {
        'status': 'healthy' if healthy_count > 0 else 'unhealthy',
        'backend_servers': server_health,
        'cache_size': len(cache)
    }

@app.route('/proxy/stats')
def proxy_stats():
    """프록시 서버 통계"""
    return {
        'backend_servers': BACKEND_SERVERS,
        'server_health': server_health,
        'cache_entries': len(cache),
        'healthy_servers': sum(server_health.values())
    }

if __name__ == '__main__':
    # 백엔드 서버 헬스 체크 초기화
    health_check()
    app.run(host='0.0.0.0', port=8080, debug=False)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

upstream backend_servers {
    server backend1.internal:8080;
    server backend2.internal:8080;

    keepalive 32;  # 최대 32개 커넥션 유지
}

server {
    location /api/ {
        proxy_pass http://backend_servers;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m inactive=60m use_temp_path=off;

server {
    location /static/ {
        proxy_cache my_cache;
        proxy_pass http://backend;
        proxy_cache_valid 200 302 10m;
        proxy_cache_valid 404 1m;
        add_header X-Cache-Status $upstream_cache_status;
    }
}

1
2
3
4
5
6
7
8
9

frontend http_in
    bind *:80
    default_backend servers

backend servers
    balance roundrobin
    option httpchk GET /healthz
    server s1 10.0.0.2:80 check
    server s2 10.0.0.3:80 check

1
2
3
4
5

upstream api_backend {
    least_conn;  # 가장 적은 연결 수 서버에 분산
    server api1.internal:8000;
    server api2.internal:8000;
}

1
2
3
4

gzip on;
gzip_types text/plain text/css application/json application/javascript text/xml application/xml;
gzip_min_length 1024;
gzip_comp_level 5;

1

proxy_cache_path /data/nginx/cache levels=1:2 keys_zone=my_zone:50m max_size=500m inactive=30m use_temp_path=off;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

# 캐시 예시 with aioredis
import aioredis

redis = await aioredis.from_url("redis://localhost")

@router.get("/data")
async def get_data():
    cached = await redis.get("my:data")
    if cached:
        return JSONResponse(content=json.loads(cached))

    result = await slow_query()
    await redis.set("my:data", json.dumps(result), ex=300)
    return result

1
2
3
4
5
6
7

ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_session_tickets on;

ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1.2 TLSv1.3;