手搓 CC 与 DDoS 攻击的防护 WAF 系统

┌─────────────────────────────────────────────────────────────┐
│                   管理控制层 (Management Plane)                  │
├─────────────────────────────────────────────────────────────┤
│  规则管理 │ 监控告警 │ 策略配置 │ 日志分析 │ 报表展示           │
└─────────────────────────────────────────────────────────────┘
                               │
┌─────────────────────────────────────────────────────────────┐
│                   安全检测层 (Security Detection)              │
├─────────────────────────────────────────────────────────────┤
│  Nginx OpenResty │  Lua WAF模块 │  实时流量分析 │  威胁情报集成  │
└─────────────────────────────────────────────────────────────┘
                               │
┌─────────────────────────────────────────────────────────────┐
│                   数据处理层 (Data Processing)                │
├─────────────────────────────────────────────────────────────┤
│  Java防护引擎 │  规则匹配 │  AI行为分析 │  决策执行           │
└─────────────────────────────────────────────────────────────┘
                               │
┌─────────────────────────────────────────────────────────────┐
│                   持久化层 (Persistence Layer)                │
├─────────────────────────────────────────────────────────────┤
│  MySQL规则库 │  Redis缓存 │  攻击日志 │  会话管理           │
└─────────────────────────────────────────────────────────────┘

@Component
public class SecurityDetectionPipeline {
    
    public CompletableFuture<DetectionResult> processRequest(HttpRequest request) {
        return CompletableFuture.supplyAsync(() -> {
            // 阶段1：请求预处理与规范化
            RequestContext context = preprocessRequest(request);
            
            // 阶段2：并行执行多维度检测
            CompletableFuture<Boolean> ipCheck = checkIPReputation(context);
            CompletableFuture<Boolean> behaviorAnalysis = analyzeUserBehavior(context);
            CompletableFuture<Boolean> ruleMatching = matchSecurityRules(context);
            
            // 阶段3：聚合检测结果并决策
            return CompletableFuture.allOf(ipCheck, behaviorAnalysis, ruleMatching)
                .thenApply(v -> {
                    boolean isMalicious = ipCheck.join() || behaviorAnalysis.join() || ruleMatching.join();
                    return new DetectionResult(isMalicious, context);
                });
        }, detectionExecutor);
    }
}

@Component
public class RequestContextPool {
    private final ObjectPool<RequestContext> pool;
    
    public RequestContextPool() {
        this.pool = new GenericObjectPool<>(new BasePooledObjectFactory<RequestContext>() {
            @Override
            public RequestContext create() {
                return new RequestContext();
            }
            
            @Override
            public void passivateObject(PooledObject<RequestContext> p) {
                p.getObject().reset();
            }
        });
        
        // 池化配置：初始100个对象，最大500个
        pool.setMaxTotal(500);
        pool.setMaxIdle(100);
        pool.setMinIdle(50);
    }
    
    public RequestContext borrowObject() throws Exception {
        return pool.borrowObject();
    }
}

# application.yml配置
spring:
  task:
    execution:
      detection:
        pool:
          core-size: 8
          max-size: 16
          queue-capacity: 1000
        thread-name-prefix: detection-
      io:
        pool:
          core-size: 16
          max-size: 32
          queue-capacity: 2000
        thread-name-prefix: io-

@Service
public class AsyncDetectionService {
    
    @Async("detectionTaskExecutor")
    public CompletableFuture<RuleMatchResult> matchRulesAsync(HttpRequest request) {
        return CompletableFuture.supplyAsync(() -> {
            // 并行执行多条规则匹配
            List<CompletableFuture<Boolean>> matchFutures = securityRules.stream()
                .map(rule -> CompletableFuture.supplyAsync(
                    () -> rule.match(request), ruleMatchExecutor))
                .collect(Collectors.toList());
            
            return CompletableFuture.allOf(matchFutures.toArray(new CompletableFuture[0]))
                .thenApply(v -> matchFutures.stream()
                    .map(CompletableFuture::join)
                    .filter(Boolean::booleanValue)
                    .findFirst()
                    .map(matched -> RuleMatchResult.block(matched))
                    .orElse(RuleMatchResult.pass()));
        }).exceptionally(ex -> {
            log.error("Rule matching failed", ex);
            return RuleMatchResult.pass(); // 失败时放行
        });
    }
}

# JVM启动参数
java -jar waf-engine.jar \
  -Xms4g -Xmx4g \
  -XX:+UseG1GC \
  -XX:MaxGCPauseMillis=200 \
  -XX:InitiatingHeapOccupancyPercent=35 \
  -XX:G1ReservePercent=15 \
  -XX:ParallelGCThreads=4 \
  -XX:ConcGCThreads=2 \
  -XX:MetaspaceSize=256m \
  -XX:MaxMetaspaceSize=512m \
  -XX:+DisableExplicitGC \
  -Djava.awt.headless=true

// 针对频繁创建的小对象使用栈分配
public class DetectionResult {
    private final boolean blocked;
    private final String reason;
    private final int score;
    
    // 使用值对象减少内存占用
    public static DetectionResult of(boolean blocked, String reason) {
        return new DetectionResult(blocked, reason, 0);
    }
}

// 大对象使用对象池
@Component
public class LargeObjectPool {
    private final SoftReference<byte[]> bufferPool = new SoftReference<>(new byte[1024 * 1024]);
}

spring:
  datasource:
    hikari:
      maximum-pool-size: 80
      minimum-idle: 20
      connection-timeout: 30000
      idle-timeout: 600000
      max-lifetime: 1800000
      leak-detection-threshold: 60000
      data-source-properties:
        cachePrepStmts: true
        prepStmtCacheSize: 300
        prepStmtCacheSqlLimit: 2048
        useServerPrepStmts: true
        useLocalSessionState: true

Optimal Pool Size = (Core count × disk I/O latency) / SQL执行时间
示例：16核心CPU，平均查询时间50ms → 16 × (50/10) = 80

@Component
public class ConnectionPoolMonitor {
    @Scheduled(fixedRate = 30000)
    public void monitorAndAdjust() {
        HikariDataSource dataSource = (HikariDataSource) dataSource;
        HikariPoolMXBean poolMXBean = dataSource.getHikariPoolMXBean();
        
        // 动态调整连接池大小
        if (poolMXBean.getActiveConnections() > poolMXBean.getTotalConnections() * 0.8) {
            dataSource.setMaximumPoolSize(dataSource.getMaximumPoolSize() + 10);
        }
    }
}

spring:
  redis:
    lettuce:
      pool:
        max-active: 20
        max-idle: 10
        min-idle: 5
        max-wait: 2000ms
      shutdown-timeout: 100ms

@Service
public class RedisPipelineService {
    
    public void batchIncrement(List<String> keys) {
        redisTemplate.executePipelined(new RedisCallback<Object>() {
            @Override
            public Object doInRedis(RedisConnection connection) {
                for (String key : keys) {
                    connection.incr(key.getBytes());
                }
                return null;
            }
        });
    }
}

@Component
public class MultiLevelCacheService {
    private final LoadingCache<String, Object> localCache;
    
    public MultiLevelCacheService() {
        this.localCache = Caffeine.newBuilder()
            .maximumSize(10000)
            .expireAfterWrite(5, TimeUnit.MINUTES)
            .refreshAfterWrite(1, TimeUnit.MINUTES)
            .recordStats()
            .build(this::loadFromRedis);
    }
    
    public <T> T getWithLocalCache(String key, Class<T> type) {
        try {
            Object value = localCache.get(key);
            return type.cast(value);
        } catch (Exception e) {
            return getFromRedis(key, type);
        }
    }
}

@Configuration
public class SentinelConfig {
    
    @PostConstruct
    public void initFlowRules() {
        List<FlowRule> rules = new ArrayList<>();
        
        // 规则匹配限流
        FlowRule ruleMatchRule = new FlowRule();
        ruleMatchRule.setResource("ruleMatch");
        ruleMatchRule.setGrade(RuleConstant.FLOW_GRADE_QPS);
        ruleMatchRule.setCount(1000);
        rules.add(ruleMatchRule);
        
        // 数据库访问限流
        FlowRule dbAccessRule = new FlowRule();
        dbAccessRule.setResource("dbAccess");
        dbAccessRule.setGrade(RuleConstant.FLOW_GRADE_THREAD);
        dbAccessRule.setCount(50);
        rules.add(dbAccessRule);
        
        FlowRuleManager.loadRules(rules);
    }
}

@Component
public class AdaptiveRateLimiter {
    private final AtomicLong requestCount = new AtomicLong(0);
    private final AtomicLong successCount = new AtomicLong(0);
    private volatile double currentRate = 1000; // 初始QPS
    
    public boolean tryAcquire() {
        long current = requestCount.incrementAndGet();
        long windowStart = System.currentTimeMillis() / 1000 * 1000;
        
        // 滑动窗口计数
        if (current % 100 == 0) {
            adjustRateBasedOnSuccessRatio();
        }
        
        return current % (1000 / (int) currentRate) == 0;
    }
    
    private void adjustRateBasedOnSuccessRatio() {
        double successRatio = (double) successCount.get() / requestCount.get();
        if (successRatio < 0.95) {
            currentRate = Math.max(100, currentRate * 0.9); // 降低10%
        } else if (successRatio > 0.99) {
            currentRate = Math.min(5000, currentRate * 1.1); // 提升10%
        }
    }
}

management:
  endpoints:
    web:
      exposure:
        include: health,metrics,info,threaddump
  endpoint:
    health:
      show-details: always
  metrics:
    export:
      prometheus:
        enabled: true

@Component
public class PerformanceMonitor {
    private final Timer requestTimer;
    private final Counter errorCounter;
    
    public PerformanceMonitor(MeterRegistry registry) {
        this.requestTimer = Timer.builder("waf.request.duration")
            .description("HTTP request handling duration")
            .register(registry);
        
        this.errorCounter = Counter.builder("waf.request.errors")
            .description("Number of request errors")
            .register(registry);
    }
    
    public <T> T monitor(Supplier<T> operation, String endpoint) {
        return requestTimer.record(() -> {
            try {
                return operation.get();
            } catch (Exception e) {
                errorCounter.increment();
                throw e;
            }
        });
    }
}

# GC日志配置
-Xlog:gc*:file=/opt/logs/gc-%t.log:time,uptime:filecount=10,filesize=100M
-XX:+HeapDumpOnOutOfMemoryError
-XX:HeapDumpPath=/opt/dump

# 多阶段构建减小镜像体积
FROM openjdk:21-jdk-slim as builder
WORKDIR /app
COPY . .
RUN ./gradlew build -x test

FROM openjdk:21-jre-slim
RUN addgroup -S waf && adduser -S waf -G waf
USER waf
COPY --from=builder /app/build/libs/*.jar app.jar
EXPOSE 8080
ENTRYPOINT ["java", "-jar", "/app.jar"]

# docker-compose资源配置
deploy:
  resources:
    limits:
      cpus: '0.75'
      memory: 1.5G
    reservations:
      cpus: '0.25'
      memory: 512M

http {
    lua_shared_dict ip_blacklist 10m;    # IP黑名单缓存
    lua_shared_dict cc_counter 50m;     # CC攻击计数器
    lua_shared_dict rule_cache 20m;     # 规则缓存
}

-- ip_filter.lua
local _M = {}
local blacklist = ngx.shared.ip_blacklist
local whitelist = ngx.shared.ip_whitelist

function _M.check_ip(client_ip)
    -- 优先检查白名单
    if whitelist:get(client_ip) then
        ngx.log(ngx.INFO, "IP in whitelist: ", client_ip)
        return true, "whitelist"
    end
    
    -- 检查黑名单
    if blacklist:get(client_ip) then
        ngx.log(ngx.WARN, "IP in blacklist: ", client_ip)
        ngx.exit(403)
    end
    
    return false, "normal"
end

-- 动态添加黑名单（CC攻击触发）
function _M.add_to_blacklist(ip, ttl)
    local success, err = blacklist:set(ip, true, ttl or 3600)
    if not success then
        ngx.log(ngx.ERR, "Failed to add IP to blacklist: ", err)
    end
    return success
end

local iputils = require "resty.iputils"
iputils.enable_lrucache()

local whitelist_cidr = {
    "192.168.1.0/24",
    "10.0.0.0/8"
}

local whitelist = iputils.parse_cidrs(whitelist_cidr)

function _M.check_cidr(client_ip)
    if iputils.ip_in_cidrs(client_ip, whitelist) then
        return true
    end
    return false
end

-- cc_protect.lua
local _M = {}
local counter_dict = ngx.shared.cc_counter

-- 滑动窗口计数算法
function _M.sliding_window_check(ip, uri, window_size, max_requests)
    local now = ngx.now()
    local window_key = ip .. ":" .. uri .. ":" .. math.floor(now / window_size)
    
    -- 原子递增计数器
    local current_count, err = counter_dict:incr(window_key, 1, 0, window_size * 2)
    if not current_count then
        ngx.log(ngx.ERR, "Counter increment failed: ", err)
        return false
    end
    
    -- 检查是否超限
    if current_count > max_requests then
        _M.add_to_blacklist(ip, 300)  -- 封禁5分钟
        ngx.log(ngx.WARN, "CC attack detected: ", ip, " count: ", current_count)
        return true
    end
    
    return false
end

-- 多时间窗口检测（1分钟/5分钟/1小时）
function _M.multi_window_check(ip, uri)
    local windows = {
        {60, 100},   -- 1分钟100次
        {300, 300},  -- 5分钟300次
        {3600, 1000} -- 1小时1000次
    }
    
    for _, config in ipairs(windows) do
        local window_size, max_requests = config[1], config[2]
        if _M.sliding_window_check(ip, uri, window_size, max_requests) then
            return true
        end
    end
    
    return false
end

function _M.token_bucket_check(ip, rate, capacity)
    local now = ngx.now()
    local tokens_key = ip .. ":tokens"
    last_time_key = ip .. ":last_time"
    
    local last_time = counter_dict:get(last_time_key) or now
    local tokens = counter_dict:get(tokens_key) or capacity
    
    -- 计算新增令牌
    local elapsed = now - last_time
    local new_tokens = tokens + elapsed * rate
    
    if new_tokens > capacity then
        new_tokens = capacity
    end
    
    if new_tokens < 1 then
        -- 令牌不足，触发限流
        return true
    end
    
    -- 消耗令牌并更新
    counter_dict:set(tokens_key, new_tokens - 1)
    counter_dict:set(last_time_key, now)
    
    return false
end

-- sql_injection_detect.lua
local _M = {}
local patterns = {
    "union%s+select",
    "insert%s+into",
    "drop%s+table",
    "exec%s*%(",
    "--%s*$"
}

function _M.detect_sql_injection(params)
    for key, value in pairs(params) do
        if type(value) == "string" then
            for _, pattern in ipairs(patterns) do
                if ngx.re.match(value, pattern, "i") then
                    ngx.log(ngx.WARN, "SQL injection detected: ", value)
                    return true
                end
            end
        end
    end
    return false
end

-- 参数规范化检查
function _M.param_sanity_check(args)
    for key, value in pairs(args) do
        -- 检查参数名合法性
        if not ngx.re.match(key, "^[a-zA-Z0-9_]+$") then
            return true
        end
        
        -- 检查参数值长度
        if type(value) == "string" and #value > 1000 then
            return true
        end
    end
    return false
end

-- xss_detect.lua
local _M = {}
local xss_patterns = {
    "<script[^>]*>",
    "javascript:",
    "onmouseover=",
    "onload=",
    "eval\\(.*\\)"
}

function _M.detect_xss(input)
    if not input then return false end
    
    for _, pattern in ipairs(xss_patterns) do
        if ngx.re.match(input, pattern, "i") then
            ngx.log(ngx.WARN, "XSS pattern detected: ", pattern)
            return true
        end
    end
    
    return false
end

/usr/local/nginx/conf/waf/
├── rules/
│   ├── sql.rules          # SQL注入规则
│   ├── xss.rules          # XSS攻击规则
│   ├── blackip.rules      # IP黑名单
│   └── whiteurl.rules     # URL白名单
├── config.lua             # 主配置文件
└── init.lua              # 初始化脚本

1001|SQL注入检测|union\s+select|block|high
1002|SQL注入检测|insert\s+into|block|high
1003|SQL注入检测|drop\s+table|block|high

-- rule_loader.lua
local _M = {}
local rule_cache = ngx.shared.rule_cache

function _M.load_rules(rule_type)
    local cache_key = "rules:" .. rule_type
    local rules = rule_cache:get(cache_key)
    
    if not rules then
        -- 从文件加载规则
        local rule_file = "/usr/local/nginx/conf/waf/rules/" .. rule_type .. ".rules"
        local file = io.open(rule_file, "r")
        
        if not file then
            ngx.log(ngx.ERR, "Rule file not found: ", rule_file)
            return {}
        end
        
        rules = {}
        for line in file:lines() do
            local id, desc, pattern, action, level = line:match("([^|]+)|([^|]+)|([^|]+)|([^|]+)|([^|]+)")
            if id and pattern then
                table.insert(rules, {
                    id = tonumber(id),
                    description = desc,
                    pattern = pattern,
                    action = action,
                    level = level
                })
            end
        end
        
        file:close()
        
        -- 缓存规则（5分钟过期）
        rule_cache:set(cache_key, rules, 300)
    end
    
    return rules
end

function _M.check_request(rules, request_data)
    for _, rule in ipairs(rules) do
        for field, value in pairs(request_data) do
            if type(value) == "string" and ngx.re.match(value, rule.pattern, "i") then
                return true, rule
            end
        end
    end
    return false, nil
end

http {
    # 优化共享字典分配策略
    lua_shared_dict ip_blacklist 10m;
    lua_shared_dict cc_counter 50m;
    lua_shared_dict rule_cache 20m;
    
    # Lua代码缓存
    lua_code_cache on;
    lua_package_path "/usr/local/nginx/lua/?.lua;;";
}

local _M = {}
local compiled_patterns = {}

function _M.compile_patterns(patterns)
    for i, pattern in ipairs(patterns) do
        compiled_patterns[i] = ngx.re.compile(pattern, "i")
    end
end

function _M.fast_match(input)
    for _, compiled_re in ipairs(compiled_patterns) do
        if compiled_re:match(input) then
            return true
        end
    end
    return false
end

local redis = require "resty.redis"
local red = redis:new()

red:set_timeout(1000)  -- 1秒超时

function _M.get_redis_connection()
    local ok, err = red:connect("127.0.0.1", 6379)
    if not ok then
        ngx.log(ngx.ERR, "Failed to connect to Redis: ", err)
        return nil
    end
    
    -- 连接池配置
    red:set_keepalive(10000, 100)  -- 10秒超时，100个连接
    return red
end

-- logger.lua
local _M = {}
local cjson = require "cjson"

function _M.log_security_event(event_type, client_ip, details)
    local log_entry = {
        timestamp = ngx.now(),
        event_type = event_type,
        client_ip = client_ip,
        request_uri = ngx.var.request_uri,
        user_agent = ngx.var.http_user_agent,
        details = details
    }
    
    local log_json = cjson.encode(log_entry)
    
    -- 写入文件日志
    ngx.log(ngx.WARN, log_json)
    
    -- 可选的Kafka发送（异步）
    local ok, err = ngx.timer.at(0, _M.send_to_kafka, log_json)
    if not ok then
        ngx.log(ngx.ERR, "Failed to create timer: ", err)
    end
end

function _M.send_to_kafka(premature, log_json)
    if premature then return end
    
    -- Kafka发送实现
    -- ...（省略具体实现）
end

-- metrics.lua
local _M = {}
local metrics_dict = ngx.shared.metrics

-- 定义监控指标
local metric_keys = {
    "requests_total",
    "blocked_requests",
    "sql_injection_blocked",
    "xss_attempts_blocked",
    "cc_attacks_blocked"
}

function _M.increment_metric(metric_name)
    local key = "metric:" .. metric_name
    metrics_dict:incr(key, 1, 0, 3600)  -- 1小时过期
end

function _M.get_metrics()
    local metrics = {}
    for _, key in ipairs(metric_keys) do
        local full_key = "metric:" .. key
        metrics[key] = metrics_dict:get(full_key) or 0
    end
    return metrics
end

-- circuit_breaker.lua
local _M = {}
local circuit_dict = ngx.shared.circuit_breaker

function _M.check_circuit_breaker(service_name)
    local state_key = service_name .. ":state"
    local failure_key = service_name .. ":failures"
    
    local state = circuit_dict:get(state_key) or "closed"
    local failures = circuit_dict:get(failure_key) or 0
    
    if state == "open" then
        -- 检查是否应该尝试恢复
        local last_failure = circuit_dict:get(service_name .. ":last_failure") or 0
        if ngx.now() - last_failure > 60 then  -- 1分钟后尝试半开
            circuit_dict:set(state_key, "half_open")
            return true
        end
        return false
    end
    
    return true
end

function _M.record_failure(service_name)
    local failure_key = service_name .. ":failures"
    local failures = circuit_dict:incr(failure_key, 1, 0, 300)
    
    if failures >= 10 then  -- 10次失败后熔断
        circuit_dict:set(service_name .. ":state", "open")
        circuit_dict:set(service_name .. ":last_failure", ngx.now())
    end
end

-- fallback.lua
local _M = {}

function _M.safe_waf_check()
    local ok, err = pcall(function()
        -- 执行正常的WAF检查
        require("ip_filter").check_ip(ngx.var.remote_addr)
        require("cc_protect").multi_window_check(ngx.var.remote_addr, ngx.var.uri)
    end)
    
    if not ok then
        ngx.log(ngx.ERR, "WAF check failed, falling back to basic mode: ", err)
        -- 基本IP检查（降级模式）
        _M.basic_ip_check(ngx.var.remote_addr)
    end
end

function _M.basic_ip_check(ip)
    -- 简化的IP检查逻辑
    local blacklist = {"1.1.1.1", "2.2.2.2"}  -- 静态黑名单
    for _, blocked_ip in ipairs(blacklist) do
        if ip == blocked_ip then
            ngx.exit(403)
        end
    end
end

version: '3.8'

services:
  # Nginx OpenResty WAF前端
  nginx-waf:
    image: openresty/openresty:1.21-alpine
    container_name: nginx-waf
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    networks:
      - data-plane
      - management
    volumes:
      - ./nginx/conf.d:/etc/nginx/conf.d:ro
      - ./nginx/lua:/etc/nginx/lua:ro
      - ./logs/nginx:/var/log/nginx
    environment:
      - NGINX_WORKER_PROCESSES=auto
      - NGINX_WORKER_CONNECTIONS=4096
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: '1.0'
        reservations:
          memory: 512M
          cpus: '0.5'

  # Java防护引擎
  waf-engine:
    image: openjdk:21-jre-slim
    container_name: waf-engine
    restart: unless-stopped
    networks:
      - management
      - backend
    volumes:
      - ./app/waf-engine.jar:/app.jar
      - ./logs/java:/opt/logs
    environment:
      - SPRING_PROFILES_ACTIVE=docker
      - JAVA_OPTS=-Xms2g -Xmx2g -XX:+UseG1GC -XX:MaxGCPauseMillis=200
      - REDIS_HOST=redis-cluster
      - DB_URL=jdbc:mysql://mysql-master:3306/waf_db
    depends_on:
      - mysql-master
      - redis-cluster
    deploy:
      replicas: 3
      resources:
        limits:
          memory: 3G
          cpus: '2.0'

  # Redis集群节点
  redis-cluster:
    image: redis:7.2-alpine
    container_name: redis-cluster
    restart: always
    networks:
      - backend
    volumes:
      - ./data/redis:/data
    command: >
      redis-server 
      --appendonly yes 
      --maxmemory 16gb 
      --maxmemory-policy allkeys-lfu 
      --io-threads 4
    deploy:
      resources:
        limits:
          memory: 2G
          cpus: '1.0'

  # MySQL主从集群
  mysql-master:
    image: mysql:8.0
    container_name: mysql-master
    restart: always
    networks:
      - backend
    volumes:
      - ./data/mysql:/var/lib/mysql
      - ./config/mysql:/etc/mysql/conf.d
    environment:
      - MYSQL_ROOT_PASSWORD=${DB_ROOT_PASSWORD}
      - MYSQL_DATABASE=waf_db
    command: >
      --server-id=1
      --log-bin=mysql-bin
      --binlog-format=ROW
      --innodb_buffer_pool_size=1G

  mysql-slave:
    image: mysql:8.0
    container_name: mysql-slave  
    restart: always
    networks:
      - backend
    volumes:
      - ./data/mysql-slave:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=${DB_ROOT_PASSWORD}
    command: >
      --server-id=2
      --relay-log=mysql-relay-bin
    depends_on:
      - mysql-master

  # 监控栈
  prometheus:
    image: prom/prometheus:latest
    ports: ["9090:9090"]
    networks:
      - monitoring
    volumes:
      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml

  grafana:
    image: grafana/grafana:latest
    ports: ["3000:3000"]
    networks:
      - monitoring
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD}

networks:
  data-plane:
    driver: host  # 使用host网络获得最佳性能
  management:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/24
  backend:
    driver: bridge
    ipam:
      config:
        - subnet: 172.21.0.0/24
  monitoring:
    driver: bridge

# Java应用Dockerfile
FROM openjdk:21-jdk as builder
WORKDIR /app
COPY . .
RUN ./gradlew bootJar

FROM openjdk:21-jre-slim
RUN addgroup -S waf && adduser -S waf -G waf
USER waf
COPY --from=builder /app/build/libs/waf-engine.jar /app.jar
EXPOSE 8080
ENTRYPOINT ["java", "-jar", "/app.jar"]

FROM openresty/openresty:1.21-alpine
RUN apk add --no-cache lua-resty-http lua-resty-redis
COPY nginx.conf /usr/local/openresty/nginx/conf/nginx.conf
COPY lua/ /etc/nginx/lua/
RUN mkdir -p /var/log/nginx && chown -R nginx:nginx /var/log/nginx
USER nginx

# 容器健康检查配置
healthcheck:
  test: ["CMD", "curl", "-f", " http://localhost:8080/actuator/health "]
  interval: 30s
  timeout: 10s
  retries: 3
  start_period: 40s

# Nginx健康检查
nginx-healthcheck:
  test: ["CMD", "nginx", "-t"]
  interval: 60s
  timeout: 10s
  start_period: 30s

volumes:
  - type: bind
    source: ./data/mysql
    target: /var/lib/mysql
    consistency: consistent
    
  - type: volume
    source: redis-data
    target: /data

FROM openjdk:21-jre-slim
RUN groupadd -r waf && useradd -r -g waf waf
USER waf

security_opt:
  - no-new-privileges:true
cap_drop:
  - ALL
cap_add:
  - NET_BIND_SERVICE
read_only: true

deploy:
  resources:
    limits:
      cpus: '2.0'
      memory: 4G
    reservations:
      cpus: '0.5'
      memory: 1G

JAVA_OPTS=-Xms2g -Xmx2g -XX:+UseG1GC -XX:MaxGCPauseMillis=200 -XX:ParallelGCThreads=4

# Prometheus配置
scrape_configs:
  - job_name: 'waf-java'
    static_configs:
      - targets: ['waf-engine:8080']
  - job_name: 'nginx'
    static_configs:
      - targets: ['nginx-waf:9145']

#!/bin/bash
# deploy_waf.sh

set -e

echo "开始部署WAF系统..."

# 环境检查
check_environment() {
    docker --version || { echo "Docker未安装"; exit 1; }
    docker compose version || { echo "Docker Compose未安装"; exit 1; }
}

# 配置生成
generate_config() {
    cp .env.example .env
    sed -i "s/DB_ROOT_PASSWORD=.*/DB_ROOT_PASSWORD=$(openssl rand -base64 32)/" .env
    sed -i "s/GRAFANA_PASSWORD=.*/GRAFANA_PASSWORD=$(openssl rand -base64 16)/" .env
}

# 服务启动
start_services() {
    docker compose up -d
    echo "等待服务启动..."
    sleep 60
    
    # 健康检查
    if docker compose ps | grep -q "Up"; then
        echo "✅ WAF系统部署成功"
        echo "📊 管理界面: https://your-server:9443 "
        echo "📈 监控面板: http://your-server:3000 "
    else
        echo "❌ 服务启动失败"
        docker compose logs
        exit 1
    fi
}

main() {
    check_environment
    generate_config
    start_services
}

main "$@"

# 服务状态检查
docker compose ps
docker compose logs -f nginx-waf

# 性能监控
docker stats --no-stream
docker exec nginx-waf nginx -t

# 备份操作
docker exec mysql-master mysqldump -u root -p$DB_ROOT_PASSWORD waf_db > backup.sql

upstream waf_cluster {
    server waf-node-1:8080 weight=3;
    server waf-node-2:8080 weight=3;
    server waf-node-3:8080 weight=2;
    server waf-node-4:8080 backup;
    keepalive 32;
}

# 滑动窗口限流
limit_req_zone $binary_remote_addr zone=cc_protection:10m rate=200r/m;

location /api/ {
    limit_req zone=cc_protection burst=50 nodelay;
    limit_req_status 429;
    
    # IP信誉检查
    access_by_lua_block {
        local ip_blacklist = ngx.shared.ip_blacklist
        if ip_blacklist:get(ngx.var.remote_addr) then
            ngx.exit(ngx.HTTP_FORBIDDEN)
        end
    }
}

healthcheck:
  test: ["CMD", "curl", "-f", " http://localhost:8080/health || exit 1"]
  interval: 30s
  timeout: 10s
  retries: 3
  start_period: 60s

- alert: ContainerUnhealthy
  expr: container_health_status{container_label_com_docker_compose_service="waf-engine"} == 0
  for: 1m
  labels: {severity: critical}
  annotations:
    summary: "WAF引擎容器健康检查失败"
    description: "容器 {{ $labels.name }} 连续1分钟健康检查失败，自动触发重启"

容器stdout/stderr → Promtail → Grafana Loki → Grafana仪表盘

安全指标:
  攻击拦截率: "≥99.9%"
  误报率: "≤0.1%"
  漏洞修复时间: "高危漏洞≤72小时"
  安全事件响应: "P0事件≤15分钟"