⚖️ Reverse Proxy vs API Gateway vs Load Balancer

# NGINX Reverse Proxy Configuration
server {
    listen 80;
    server_name example.com;

    # SSL Termination
    listen 443 ssl;
    ssl_certificate /etc/nginx/ssl/cert.pem;
    ssl_certificate_key /etc/nginx/ssl/key.pem;

    # Caching static files
    location /static/ {
        proxy_cache my_cache;
        proxy_cache_valid 200 1d;
        proxy_pass http://backend_server;
    }

    # Forward tất cả request đến backend
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# Kong Declarative Configuration
_format_version: "3.0"

services:
  - name: users-service
    url: http://users-svc:3000
    routes:
      - name: users-route
        paths:
          - /api/v1/users
        strip_path: true

  - name: orders-service
    url: http://orders-svc:3001
    routes:
      - name: orders-route
        paths:
          - /api/v1/orders
        strip_path: true

plugins:
  # Rate Limiting toàn cục
  - name: rate-limiting
    config:
      minute: 100
      policy: local

  # JWT Authentication
  - name: jwt
    config:
      claims_to_verify:
        - exp

  # Request Logging
  - name: file-log
    config:
      path: /tmp/kong-requests.log

# NGINX Load Balancer Configuration
upstream backend_pool {
    # Thuật toán: Least Connections
    least_conn;

    server 10.0.0.1:3000 weight=3;   # Server mạnh, nhận nhiều hơn
    server 10.0.0.2:3000 weight=2;
    server 10.0.0.3:3000 weight=1;
    server 10.0.0.4:3000 backup;     # Backup server

    # Health check
    keepalive 32;
}

server {
    listen 80;

    location / {
        proxy_pass http://backend_pool;
        proxy_next_upstream error timeout http_500;
        proxy_connect_timeout 5s;
        proxy_read_timeout 60s;
    }
}

# HAProxy Load Balancer Configuration
frontend http_front
    bind *:80
    default_backend app_servers

    # L7 routing dựa trên path
    acl is_api path_beg /api
    use_backend api_servers if is_api

backend app_servers
    balance roundrobin
    option httpchk GET /health
    server web1 10.0.0.1:3000 check inter 5s fall 3 rise 2
    server web2 10.0.0.2:3000 check inter 5s fall 3 rise 2
    server web3 10.0.0.3:3000 check inter 5s fall 3 rise 2

backend api_servers
    balance leastconn
    option httpchk GET /api/health
    server api1 10.0.1.1:8080 check weight 100
    server api2 10.0.1.2:8080 check weight 100

# NGINX = Reverse Proxy + Load Balancer + Basic API Router
upstream web_servers {
    least_conn;
    server 10.0.0.1:3000;
    server 10.0.0.2:3000;
}

upstream api_servers {
    ip_hash;   # Sticky session cho API
    server 10.0.1.1:8080;
    server 10.0.1.2:8080;
}

server {
    listen 443 ssl http2;
    server_name example.com;

    # SSL Termination (Reverse Proxy)
    ssl_certificate /etc/ssl/cert.pem;
    ssl_certificate_key /etc/ssl/key.pem;

    # Gzip Compression (Reverse Proxy)
    gzip on;
    gzip_types text/plain application/json;

    # Static file caching (Reverse Proxy)
    location /static/ {
        alias /var/www/static/;
        expires 30d;
        add_header Cache-Control "public, immutable";
    }

    # API routing + Load Balancing
    location /api/ {
        proxy_pass http://api_servers;
        
        # Basic rate limiting
        limit_req zone=api burst=20 nodelay;
    }

    # Web app + Load Balancing
    location / {
        proxy_pass http://web_servers;
        proxy_set_header Host $host;
    }
}

# Layer 1: Cloud Load Balancer (AWS ALB)
# → Tự động tạo khi deploy Ingress Controller

# Layer 2: NGINX Ingress = Reverse Proxy + LB
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: main-ingress
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "60"
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - api.example.com
      secretName: tls-secret
  rules:
    - host: api.example.com
      http:
        paths:
          # Route tất cả /api/* đến API Gateway (Kong)
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: kong-proxy
                port:
                  number: 80
          # Route web app trực tiếp
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web-frontend
                port:
                  number: 80

# Layer 3: Kong API Gateway
# Rate Limiting Plugin
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: rate-limit-plugin
plugin: rate-limiting
config:
  minute: 100
  policy: redis
  redis_host: redis-svc
---
# JWT Auth Plugin
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: jwt-auth-plugin
plugin: jwt
config:
  claims_to_verify:
    - exp
  key_claim_name: iss