回源鑑別與源站防護

server {
    listen 80;
    server_name origin.example.com;

    if ($http_x_origin_secret != "你的密鑰") {
        return 403;
    }

    # ... 你的正常配置
}

SetEnvIf X-Origin-Secret "^你的密鑰$" from_cdn
Require env from_cdn

<?php
if (($_SERVER['HTTP_X_ORIGIN_SECRET'] ?? '') !== '你的密鑰') {
    http_response_code(403);
    exit('Forbidden');
}

origin.example.com {
    @noSecret not header X-Origin-Secret "你的密鑰"
    respond @noSecret 403
    reverse_proxy 127.0.0.1:8080
}

GET https://cdn.taipei/api/public/origin-ips

curl -s https://cdn.taipei/api/public/origin-ips

1.2.3.4
5.6.7.8
9.10.11.12

curl -s "https://cdn.taipei/api/public/origin-ips?format=json"

{ "ips": ["1.2.3.4", "5.6.7.8", "9.10.11.12"], "count": 3 }

#!/bin/bash
set -euo pipefail

# 建立 / 確保 ipset 存在
ipset create furcdn hash:ip -exist
ipset create furcdn_new hash:ip -exist
ipset flush furcdn_new

# 拉取最新回源 IP 填入暫存集合
while read -r ip; do
  [ -n "$ip" ] && ipset add furcdn_new "$ip" -exist
done < <(curl -fsS https://cdn.taipei/api/public/origin-ips)

# 原子替換，避免同步空窗期把節點擋在外面
ipset swap furcdn_new furcdn

# 首次需掛一條規則（只放行 furcdn 集合 + 本機，其餘拒絕 80/443）
# iptables -A INPUT -p tcp -m multiport --dports 80,443 -m set --match-set furcdn src -j ACCEPT
# iptables -A INPUT -p tcp -m multiport --dports 80,443 -j DROP

#!/bin/bash
set -euo pipefail
OUT=/etc/nginx/furcdn-allow.conf
{
  curl -fsS https://cdn.taipei/api/public/origin-ips | sed 's/^/allow /; s/$/;/'
  echo "deny all;"
} > "$OUT.tmp" && mv "$OUT.tmp" "$OUT"
nginx -t && nginx -s reload

擇優(icmp) 源站2 12.3ms > 源站1 45.0ms ｜ 源站2 http://b → HTTP 200

# 讀取目前設定（GET /api/domains 回傳 { domains: [...] }，每筆含 originPolicy）
curl -s https://cdn.taipei/api/domains \
  -H "Cookie: furcdn_token=<session>" | jq '.domains[] | select(.id==123) | .originPolicy'

# 只改 strategy 等欄位（伺服器會淺合併既有設定後整體驗證）
curl -s -X PUT https://cdn.taipei/api/domains/123 \
  -H 'content-type: application/json' \
  -H 'Cookie: furcdn_token=<session>' \
  -d '{"originPolicy":{"strategy":"latency","probeMethod":"icmp","switchThresholdMs":20}}'

# 重置為全部預設
curl -s -X PUT https://cdn.taipei/api/domains/123 \
  -H 'content-type: application/json' \
  -H 'Cookie: furcdn_token=<session>' \
  -d '{"originPolicy":null}'

# 各節點最近一輪的探測結果（RTT / 丟包 / 該節點選中的源站）
curl -s https://cdn.taipei/api/domains/123/origin-probes \
  -H "Cookie: furcdn_token=<session>"

{
  "nodes": [
    {
      "nodeId": 7,
      "nodeName": "hk-1",
      "ts": 1735689600000,
      "origins": [
        { "url": "http://a.example", "method": "icmp", "rttMs": 12.3, "lossPct": 0, "ok": true, "selected": true, "ts": 1735689600000 },
        { "url": "http://b.example", "method": "icmp", "rttMs": 45.0, "lossPct": 0, "ok": true, "selected": false, "ts": 1735689600000 }
      ]
    }
  ]
}

# 啟用擇優（只改 strategy，其餘沿用預設）
furcdn domain origin policy set example.com --set strategy=latency

# 或等價的旗標寫法
furcdn domain update example.com --origin-strategy latency --probe-method icmp --switch-threshold 20

# 檢視生效中的完整設定（未自訂的欄位標為「預設」）
furcdn domain origin policy get example.com

# 調整單一源站：權重、備用、探測目標、不探測
furcdn domain origin set example.com --url http://b.example --backup --weight 3 --probe-host 1.2.3.4
furcdn domain origin set example.com --url http://c.example --latency-bias -50 --no-probe
furcdn domain origin list example.com

# 看各節點的探測結果（表格 / --json）
furcdn domain origin probes example.com

# 重置為全部預設
furcdn domain origin policy set example.com --reset