# =========================================================
# prometheus.ergesanbaishou.com —— 外层 NGINX 反代配置
# (监控三件套·① 的"无端口"入口;配套 K8S 侧见同目录 prometheus-ingress.yaml)
#
# 链路(独立 controller 专属入口,同 harbor 32588 模式):
#   浏览器 http://prometheus.ergesanbaishou.com/     ← 无端口!外层 nginx 监听 80
#     → 本文件(外层 NGINX,TLS 可在此终止)
#     → 10.18.170.34:30990(ingress-prometheus-nginx-controller 专属入口)
#     → Ingress(prometheus-ingress.yaml,class=prometheus-nginx)按 Host 分流
#     → svc prometheus-server(monitoring):80 → Pod:9090
#
# ★ 端口说明(最终采用:独立 controller,端口隔离):
#   本集群三套 controller 各管一段(kubectl -n ingress-nginx get svc 可见):
#     ingress-nginx-controller            31588/30443  共享款(k8s-web 等)
#     ingress-harbor-nginx-controller     32588/31443  harbor 专属
#     ingress-prometheus-nginx-controller 30990/30490  ★ Prometheus 专属(本链路)
#   ★ 前提(必须先做,否则 30990 不通):
#     helm 装 ingress-prometheus-nginx(class=prometheus-nginx,http 固定 30990),
#     且 prometheus-ingress.yaml 的 ingressClassName 已指 prometheus-nginx
#     (完整命令见 k8s-monitor.html 第 04 章 5.5 节)
#   若要回共享方案:upstream 改回 31588,Ingress 的 class 改回 nginx 再 apply
#
# 部署位置:外层 NGINX 机器的 /etc/nginx/conf.d/prometheus.ergesanbaishou.com.conf
#   ★ 文件名必须以 .conf 结尾!nginx 只 include conf.d/*.conf,
#     无后缀文件静默不加载,nginx -t 也不报错,表现为"默认欢迎页"(血泪教训)
#
# 用法三步(在外层 NGINX 机器上):
#   1) scp 本文件到 /etc/nginx/conf.d/prometheus.ergesanbaishou.com.conf
#   2) nginx -t && nginx -s reload        # 改完必做,否则不生效
#   3) 验证: curl -s http://127.0.0.1/-/healthy -H "Host: prometheus.ergesanbaishou.com"
#      期望: Prometheus is Healthy.
#
# hosts 解析变化:走外层后,prometheus.ergesanbaishou.com 要解析到
#   ★外层 NGINX 所在机器的 IP★(不再直连节点端口)
# =========================================================

upstream prometheus_ergesanbaishou {
    server 10.18.170.34:30990;     # ★ Prometheus 专属 controller 入口(同 harbor 32588 模式);
    keepalive 32;                   #   回共享方案则改 :31588(controller 共享入口)
}

# ---------- 80 版(先用这个,内网可用) ----------
server {
    listen 80;
    server_name prometheus.ergesanbaishou.com;

    access_log /var/log/nginx/prometheus.access.log;
    error_log  /var/log/nginx/prometheus.error.log;

    location / {
        proxy_pass http://prometheus_ergesanbaishou;

        # ★★★ 灵魂行:透传 Host,Ingress 全靠它分流,丢了必 404 ★★★
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket 支持(Prometheus UI 日志流/后续 Grafana live 也用得上)
        proxy_http_version 1.1;
        proxy_set_header Upgrade           $http_upgrade;
        proxy_set_header Connection        "upgrade";

        proxy_read_timeout 300s;           # 大范围 PromQL 查询可能慢,放宽
        proxy_send_timeout 300s;
    }
}

# =========================================================
# ---------- 443 升级段(有证书后启用:删上面 server 的 location,
#                        80 只留 301;取消本段注释;证书两行按实际路径改) ----------
#
# server {
#     listen 80;
#     server_name prometheus.ergesanbaishou.com;
#     return 301 https://$host$request_uri;
# }
# server {
#     listen       443 ssl;
#     server_name  prometheus.ergesanbaishou.com;
#
#     ssl_certificate     /etc/nginx/ssl/prometheus.ergesanbaishou.com.pem;
#     ssl_certificate_key /etc/nginx/ssl/prometheus.ergesanbaishou.com.key;
#     ssl_protocols       TLSv1.2 TLSv1.3;
#     ssl_session_cache   shared:SSL_prom:10m;
#
#     access_log /var/log/nginx/prometheus.access.log;
#     error_log  /var/log/nginx/prometheus.error.log;
#
#     location / {
#         proxy_pass http://prometheus_ergesanbaishou;
#         proxy_set_header Host              $host;
#         proxy_set_header X-Real-IP         $remote_addr;
#         proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
#         proxy_set_header X-Forwarded-Proto https;    # 固定 https,ingress 靠它识别原始协议
#         proxy_http_version 1.1;
#         proxy_set_header Upgrade           $http_upgrade;
#         proxy_set_header Connection        "upgrade";
#         proxy_read_timeout 300s;
#         proxy_send_timeout 300s;
#     }
# }
#
# 无正式证书先自签一把(浏览器提示不安全,内网可用;SAN 把三件套域名全带上,一把证书三处用):
#   mkdir -p /etc/nginx/ssl
#   openssl req -x509 -nodes -days 825 -newkey rsa:2048 \
#     -keyout /etc/nginx/ssl/prometheus.ergesanbaishou.com.key \
#     -out    /etc/nginx/ssl/prometheus.ergesanbaishou.com.pem \
#     -subj "/CN=prometheus.ergesanbaishou.com" \
#     -addext "subjectAltName=DNS:prometheus.ergesanbaishou.com,DNS:alertmanager.ergesanbaishou.com,DNS:grafana.ergesanbaishou.com"
#
# ★ 防重定向循环:TLS 已在外层终止,ingress 收到的全是 http ——
#   K8S 侧 Ingress 保持 ssl-redirect: "false"(prometheus-ingress.yaml 已写好),
#   否则 80↔443 无限 301
# =========================================================