flowchart TB
    Client[客户端请求] --> APISIX[APISIX 网关]

    APISIX --> Init[初始化模块<br/>init.lua]
    APISIX --> Router[路由模块<br/>router.lua]
    APISIX --> Plugin[插件系统<br/>plugin.lua]

    Init --> Core[核心工具模块<br/>core/]
    Init --> Config[配置中心<br/>etcd/yaml]

    Router --> HTTPRoute[HTTP路由<br/>http/route.lua]
    Router --> StreamRoute[Stream路由<br/>stream/]

    HTTPRoute --> Match{路由匹配}
    Match -->|匹配成功| Service[服务对象]
    Match -->|匹配失败| NotFound[404响应]

    Service --> PluginExec[插件执行]
    PluginExec --> GlobalRules[全局规则]
    PluginExec --> RoutePlugins[路由插件]
    PluginExec --> ConsumerPlugins[消费者插件]

    PluginExec --> Upstream[上游选择<br/>upstream.lua]
    Upstream --> Discovery[服务发现<br/>discovery/]
    Upstream --> Balancer[负载均衡<br/>balancer.lua]

    Balancer --> PickNode{选择节点}
    PickNode --> HealthCheck[健康检查]
    PickNode --> Strategy[负载均衡策略]

    Strategy --> RoundRobin[轮询]
    Strategy --> CHash[一致性哈希]
    Strategy --> LeastConn[最少连接]
    Strategy --> EWMA[EWMA]

    PickNode --> Backend[后端服务]
    Backend --> Response[响应处理]
    Response --> Client

    Config --> Admin[Admin API<br/>admin/]
    Admin --> Routes[路由管理<br/>routes.lua]
    Admin --> Services[服务管理<br/>services.lua]
    Admin --> Upstreams[上游管理<br/>upstreams.lua]
    Admin --> SSL[证书管理<br/>ssl.lua]
    Admin --> Consumers[消费者管理<br/>consumers.lua]

    Plugin --> PluginLoader[插件加载器]
    Plugin --> PluginFilter[插件过滤器]
    Plugin --> PluginRunner[插件执行器]

    APISIX --> SSL_TLS[SSL/TLS处理<br/>ssl.lua]
    SSL_TLS --> ClientHello[Client Hello阶段]
    SSL_TLS --> SNI[SNI匹配]
    SSL_TLS --> MTLS[mTLS验证]

    APISIX --> Control[Control API<br/>control/]
    Control --> HealthStatus[健康检查]
    Control --> Schema[Schema查询]
    Control --> Config查询[配置查询]

    style APISIX fill:#4A90E2,color:#fff
    style Init fill:#E8F4F8
    style Router fill:#E8F4F8
    style Plugin fill:#E8F4F8
    style Upstream fill:#E8F4F8
    style Admin fill:#FFF4E6
    style SSL_TLS fill:#F0F0F0

sequenceDiagram
    autonumber
    participant Client as 客户端
    participant Nginx as Nginx/OpenResty
    participant Init as init.lua
    participant Router as 路由系统
    participant Plugin as 插件系统
    participant Upstream as 上游管理
    participant Balancer as 负载均衡器
    participant Backend as 后端服务

    Note over Client,Backend: === SSL/TLS 握手阶段 (HTTPS) ===
    Client->>Nginx: Client Hello (SNI)
    Nginx->>Init: ssl_client_hello_phase()
    Init->>Router: router_ssl.match_and_set(sni)
    Router-->>Init: 匹配SSL证书
    Init->>Init: 设置SSL协议和密码套件
    Init-->>Nginx: 证书就绪
    Nginx-->>Client: Server Hello + 证书

    Note over Client,Backend: === SSL 握手完成 ===
    Nginx->>Init: ssl_phase()
    Init->>Init: verify_https_client()<br/>验证客户端证书(mTLS)

    Note over Client,Backend: === HTTP 请求处理阶段 ===
    Client->>Nginx: HTTP Request<br/>GET /api/users?id=123
    Nginx->>Init: http_access_phase()

    Init->>Init: 创建 api_ctx 上下文
    Init->>Init: normalize URI<br/>处理尾部斜杠、servlet风格URI
    Init->>Init: handle_x_forwarded_headers()<br/>处理 X-Forwarded-* 头部

    Init->>Router: router_http.match(api_ctx)
    Router->>Router: radixtree匹配路由<br/>维度: URI+Method+Host+Vars
    Router-->>Init: matched_route

    alt 路由未匹配
        Init->>Plugin: run_global_rules()<br/>执行全局规则
        Init-->>Client: 404 Not Found
    end

    Init->>Init: 合并 plugin_config
    Init->>Init: 合并 service 配置
    Init->>Plugin: run_global_rules(global_rules)
    Plugin->>Plugin: 执行全局插件的 rewrite 和 access 阶段

    alt 使用 script (脚本路由)
        Init->>Plugin: script.run("access")
        Plugin-->>Init: 执行自定义脚本
    else 使用标准插件
        Init->>Plugin: plugin.filter(route)<br/>筛选激活的插件
        Plugin->>Plugin: 按优先级排序插件
        Plugin-->>Init: plugins 数组

        Init->>Plugin: plugin.run_plugin("rewrite", plugins)
        loop 遍历每个插件
            Plugin->>Plugin: 执行 plugin.rewrite(conf, api_ctx)
            Plugin->>Plugin: 可能修改请求 URI、参数、Header
        end

        alt 有 consumer (认证通过)
            Init->>Plugin: merge_consumer_route()<br/>合并消费者插件
            Init->>Plugin: run_plugin("rewrite_in_consumer")
        end

        Init->>Plugin: plugin.run_plugin("access", plugins)
        loop 遍历每个插件
            Plugin->>Plugin: 执行 plugin.access(conf, api_ctx)
            alt 插件返回错误码
                Plugin-->>Client: 4xx/5xx 响应 + body
            end
        end
    end

    Note over Init,Upstream: === 上游选择与负载均衡 ===
    Init->>Upstream: handle_upstream(api_ctx, route)

    alt 有 upstream_id
        Upstream->>Upstream: get_by_id(upstream_id)
    else 有 service_id
        Upstream->>Upstream: 从 service 获取 upstream
    else 直接配置 upstream
        Upstream->>Upstream: 使用 route.upstream
    end

    alt 服务发现
        Upstream->>Upstream: discovery.nodes(service_name)
        Upstream->>Upstream: 比较节点变更<br/>parse_domain_in_route()
    end

    Upstream->>Upstream: set_upstream_scheme(api_ctx)<br/>设置协议 (http/https/grpc/grpcs)
    Upstream->>Upstream: fill_node_info()<br/>填充端口和优先级
    Upstream->>Upstream: 初始化健康检查器

    alt 需要 mTLS 到上游
        Upstream->>Upstream: set_upstream_tls_client_param()<br/>设置客户端证书
    end

    Upstream->>Balancer: pick_server(route, api_ctx)
    Balancer->>Balancer: 获取或创建 server_picker

    alt 多节点负载均衡
        Balancer->>Balancer: fetch_health_nodes()<br/>过滤健康节点
        Balancer->>Balancer: 选择负载均衡策略<br/>(roundrobin/chash/ewma/least_conn)
        Balancer->>Balancer: picker.get(ctx)<br/>选择目标节点
    else 单节点
        Balancer->>Balancer: 直接返回唯一节点
    end

    Balancer-->>Init: picked_server {host, port}
    Init->>Init: set_upstream_headers()<br/>设置 upstream_host
    Init->>Plugin: common_phase("before_proxy")

    alt gRPC/gRPCs 协议
        Init->>Nginx: ngx.exec("@grpc_pass")
    else Dubbo 协议
        Init->>Nginx: ngx.exec("@dubbo_pass")
    end

    Note over Nginx,Backend: === Balancer 阶段 (每次重试都执行) ===
    Nginx->>Init: http_balancer_phase()
    Init->>Balancer: balancer.run(api_ctx)

    alt 首次请求
        Balancer->>Balancer: 使用 access 阶段已选节点
        Balancer->>Balancer: set_balancer_opts()<br/>设置超时、重试次数
    else 重试请求
        Balancer->>Balancer: 检查 retry_timeout 是否超时
        Balancer->>Balancer: 上报上次失败到健康检查器
        Balancer->>Balancer: pick_server() 重新选择节点
        Balancer->>Plugin: 重新执行 before_proxy 插件
    end

    Balancer->>Balancer: set_current_peer(server)<br/>设置连接池和 Keepalive
    Balancer->>Backend: 代理请求到 host:port

    Backend-->>Nginx: 响应 (状态码 + Header + Body)

    Note over Nginx,Client: === Header Filter 阶段 ===
    Nginx->>Init: http_header_filter_phase()
    Init->>Init: 设置 Server 头部 (APISIX/<version>)
    Init->>Init: 设置 X-APISIX-Upstream-Status
    Init->>Plugin: common_phase("header_filter")
    Plugin->>Plugin: 执行各插件的 header_filter 方法

    Note over Nginx,Client: === Body Filter 阶段 ===
    Nginx->>Init: http_body_filter_phase()
    Init->>Plugin: common_phase("body_filter")
    Plugin->>Plugin: 执行各插件的 body_filter 方法<br/>可能修改响应体
    Init->>Plugin: common_phase("delayed_body_filter")

    Nginx-->>Client: HTTP Response<br/>200 OK + Headers + Body

    Note over Nginx,Client: === Log 阶段 ===
    Nginx->>Init: http_log_phase()
    Init->>Plugin: common_phase("log")
    Plugin->>Plugin: 执行各插件的 log 方法<br/>记录日志、指标上报
    Init->>Init: healthcheck_passive()<br/>被动健康检查
    Init->>Init: 释放资源<br/>tablepool.release(api_ctx)

# 安装依赖
curl https://raw.githubusercontent.com/apache/apisix/master/utils/install-dependencies.sh -sL | bash -

# 初始化配置
apisix init

# 启动 etcd (如果未运行)
etcd &

# 启动 APISIX
apisix start

curl -X PUT http://127.0.0.1:9180/apisix/admin/upstreams/1 \
-H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" \
-d '{
  "type": "roundrobin",
  "nodes": {
    "httpbin.org:80": 1
  }
}'

curl -X PUT http://127.0.0.1:9180/apisix/admin/routes/1 \
-H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" \
-d '{
  "uri": "/get",
  "methods": ["GET"],
  "upstream_id": 1
}'

curl http://127.0.0.1:9080/get

# 响应:
# {
#   "args": {},
#   "headers": {
#     "Host": "httpbin.org",
#     ...
#   },
#   "origin": "...",
#   "url": "https://httpbin.org/get"
# }

curl -X PUT http://127.0.0.1:9180/apisix/admin/routes/1 \
-H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" \
-d '{
  "uri": "/get",
  "methods": ["GET"],
  "plugins": {
    "limit-count": {
      "count": 2,
      "time_window": 60,
      "rejected_code": 429,
      "key_type": "var",
      "key": "remote_addr"
    },
    "key-auth": {
      "key": "auth-key"
    }
  },
  "upstream_id": 1
}'

# 创建 Consumer
curl -X PUT http://127.0.0.1:9180/apisix/admin/consumers \
-H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" \
-d '{
  "username": "jack",
  "plugins": {
    "key-auth": {
      "key": "auth-key"
    }
  }
}'

# 正常请求 (第1、2次)
curl http://127.0.0.1:9080/get -H "apikey: auth-key"
# 响应: 200 OK

# 超限请求 (第3次)
curl http://127.0.0.1:9080/get -H "apikey: auth-key"
# 响应: 429 Too Many Requests

# 1. 创建 Service (包含上游和通用插件)
curl -X PUT http://127.0.0.1:9180/apisix/admin/services/1 \
-H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" \
-d '{
  "upstream": {
    "type": "roundrobin",
    "nodes": {
      "httpbin.org:80": 1
    }
  },
  "plugins": {
    "limit-count": {
      "count": 100,
      "time_window": 60,
      "key_type": "var",
      "key": "remote_addr"
    }
  }
}'

# 2. 创建多个路由引用同一 Service
curl -X PUT http://127.0.0.1:9180/apisix/admin/routes/1 \
-H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" \
-d '{
  "uri": "/get",
  "service_id": 1
}'

curl -X PUT http://127.0.0.1:9180/apisix/admin/routes/2 \
-H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" \
-d '{
  "uri": "/post",
  "methods": ["POST"],
  "service_id": 1,
  "plugins": {
    "request-validation": {
      "body_schema": {
        "type": "object",
        "required": ["name"]
      }
    }
  }
}'

curl -X PUT http://127.0.0.1:9180/apisix/admin/routes/1 \
-H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" \
-d '{
  "uri": "/api/*",
  "plugins": {
    "traffic-split": {
      "rules": [
        {
          "weighted_upstreams": [
            {
              "upstream": {
                "name": "upstream_v1",
                "type": "roundrobin",
                "nodes": {
                  "127.0.0.1:8001": 1
                }
              },
              "weight": 9
            },
            {
              "upstream": {
                "name": "upstream_v2",
                "type": "roundrobin",
                "nodes": {
                  "127.0.0.1:8002": 1
                }
              },
              "weight": 1
            }
          ]
        }
      ]
    }
  },
  "upstream": {
    "type": "roundrobin",
    "nodes": {
      "127.0.0.1:8001": 1
    }
  }
}'

{
  "rules": [
    {
      "match": [
        {
          "vars": [
            ["http_x_canary", "==", "true"]
          ]
        }
      ],
      "weighted_upstreams": [
        {
          "upstream_id": 2,
          "weight": 1
        }
      ]
    }
  ]
}

curl -X PUT http://127.0.0.1:9180/apisix/admin/upstreams/1 \
-H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" \
-d '{
  "type": "roundrobin",
  "nodes": {
    "127.0.0.1:8001": 1,
    "127.0.0.1:8002": 1
  },
  "checks": {
    "active": {
      "type": "http",
      "http_path": "/health",
      "timeout": 1,
      "healthy": {
        "interval": 5,
        "successes": 2
      },
      "unhealthy": {
        "interval": 5,
        "http_failures": 3
      }
    },
    "passive": {
      "healthy": {
        "http_statuses": [200, 201, 202],
        "successes": 3
      },
      "unhealthy": {
        "http_statuses": [500, 502, 503, 504],
        "http_failures": 3,
        "tcp_failures": 3
      }
    }
  }
}'

-- apisix/plugins/my-plugin.lua
local core = require("apisix.core")

local schema = {
    type = "object",
    properties = {
        body = {
            type = "string"
        }
    },
    required = {"body"}
}

local _M = {
    version = 0.1,
    priority = 10000,  -- 优先级，越大越先执行
    name = "my-plugin",
    schema = schema
}

function _M.check_schema(conf)
    return core.schema.check(schema, conf)
end

function _M.access(conf, ctx)
    core.log.warn("my-plugin access phase, body: ", conf.body)
    -- 返回非 nil 值会中断请求
    -- return 403, {message = "Forbidden"}
end

return _M

plugins:
  - my-plugin  # 添加自定义插件
  - ... # 其他插件

curl -X PUT http://127.0.0.1:9180/apisix/admin/routes/1 \
-H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" \
-d '{
  "uri": "/test",
  "plugins": {
    "my-plugin": {
      "body": "hello custom plugin"
    }
  },
  "upstream": {
    "type": "roundrobin",
    "nodes": {
      "httpbin.org:80": 1
    }
  }
}'

sequenceDiagram
    autonumber
    participant Nginx as Nginx Master
    participant Worker as Nginx Worker
    participant Init as init.lua
    participant Config as config 模块
    participant Plugin as plugin 模块
    participant Router as router 模块
    participant Etcd as etcd

    Nginx->>Worker: fork worker 进程
    Worker->>Init: init_by_lua_block<br/>加载 APISIX 代码
    Init->>Init: 设置 JIT 参数
    Init->>Init: require("apisix.patch").patch()

    Worker->>Init: http_init()
    Init->>Config: core.resolver.init_resolver()<br/>初始化 DNS 解析器
    Init->>Config: core.id.init()<br/>生成节点 ID
    Init->>Config: core.config.init()<br/>初始化配置中心连接
    Config->>Etcd: 连接 etcd 集群
    Etcd-->>Config: 连接成功

    Worker->>Init: init_worker_by_lua_block
    Init->>Init: http_init_worker()
    Init->>Init: 设置随机数种子
    Init->>Init: events.init_worker()<br/>初始化事件总线
    Init->>Init: lrucache.init_worker()<br/>初始化 LRU 缓存

    Init->>Config: core.config.init_worker()
    Config->>Etcd: watch /apisix/routes
    Config->>Etcd: watch /apisix/upstreams
    Config->>Etcd: watch /apisix/services
    Config->>Etcd: watch /apisix/ssls
    Config->>Etcd: watch /apisix/consumers
    Config->>Etcd: watch /apisix/global_rules
    Config->>Etcd: watch /apisix/plugin_configs

    Etcd-->>Config: 返回初始数据 + watch ID

    Init->>Plugin: plugin.init_worker()
    Plugin->>Plugin: load() 加载插件列表
    Plugin->>Plugin: 加载各插件模块<br/>require("apisix.plugins.*")
    Plugin->>Plugin: 校验插件 schema
    Plugin->>Plugin: 按优先级排序插件
    Plugin->>Plugin: 调用各插件 init() 方法

    Init->>Router: router.http_init_worker()
    Router->>Router: 加载路由实现<br/>require("apisix.http.router.radixtree_uri")
    Router->>Config: 订阅 routes 配置变更
    Router->>Router: 构建 radixtree 路由树

    Init->>Init: balancer.init_worker()
    Init->>Init: admin.init_worker()<br/>初始化 Admin API
    Init->>Init: upstream.init_worker()<br/>订阅 upstreams 变更
    Init->>Init: consumer.init_worker()<br/>订阅 consumers 变更
    Init->>Init: secret.init_worker()<br/>初始化密钥管理

    Init-->>Worker: 初始化完成
    Worker-->>Nginx: worker 就绪

    Note over Nginx,Etcd: === 配置热更新示例 ===
    Etcd->>Config: watch 触发 (routes 变更)
    Config->>Router: filter() 回调
    Router->>Router: 重建 radixtree
    Router->>Router: load_times += 1

sequenceDiagram
    autonumber
    participant User as 管理员
    participant Admin as Admin API
    participant Etcd as etcd
    participant Watch as config 模块<br/>(watch 协程)
    participant Worker as Worker 进程
    participant Router as router 模块

    User->>Admin: PUT /apisix/admin/routes/1
    Admin->>Admin: 校验 JSON schema
    Admin->>Admin: 校验插件配置
    Admin->>Etcd: PUT /apisix/routes/1
    Etcd-->>Admin: 成功 (新 modifiedIndex)
    Admin-->>User: 200 OK

    Etcd->>Watch: watch event (PUT)
    Watch->>Watch: 解析变更数据
    Watch->>Router: filter(route) 回调
    Router->>Router: 更新 route 对象<br/>orig_modifiedIndex = modifiedIndex
    Router->>Router: set_plugins_meta_parent()
    Router->>Router: filter_upstream()
    Router->>Router: 重建 radixtree
    Router->>Router: load_times += 1

    Watch-->>Worker: 配置已更新

    Note over User,Router: === 下一个请求立即生效 ===
    User->>Worker: GET /api/users
    Worker->>Router: router_http.match(api_ctx)
    Router->>Router: radixtree.dispatch()<br/>使用新路由树
    Router-->>Worker: matched_route (新配置)

stateDiagram-v2
    [*] --> 正常运行: etcd 可用
    正常运行 --> etcd断连: 网络中断/etcd挂掉
    etcd断连 --> 降级运行: watch 失败
    降级运行 --> 降级运行: 使用本地缓存配置<br/>无法变更配置
    etcd断连 --> 正常运行: etcd 恢复<br/>重建 watch
    降级运行 --> 正常运行: etcd 恢复<br/>同步最新配置

stateDiagram-v2
    [*] --> 正常: 有健康节点
    正常 --> 全部不健康: 主动/被动健康检查<br/>标记所有节点不健康
    全部不健康 --> 使用所有节点: 忽略健康状态
    使用所有节点 --> 正常: 节点恢复健康

{
    var = {},                      -- Nginx 变量封装
    matched_route = route,         -- 匹配的路由对象
    matched_upstream = upstream,   -- 匹配的上游对象
    matched_ssl = ssl,             -- 匹配的 SSL 对象
    plugins = {plugin_obj, conf, ...},  -- 激活的插件列表 (对象和配置交替)
    conf_type = "route",           -- 配置类型
    conf_version = "123",          -- 配置版本号
    conf_id = "1",                 -- 配置 ID
    upstream_conf = up_conf,       -- 上游配置
    upstream_version = "123",      -- 上游版本号
    upstream_key = "upstreams#1",  -- 上游缓存 key
    upstream_scheme = "http",      -- 上游协议
    balancer_ip = "127.0.0.1",     -- 选中的节点 IP
    balancer_port = 8080,          -- 选中的节点端口
    balancer_try_count = 1,        -- 负载均衡尝试次数
    picked_server = server,        -- 选中的服务器对象
    server_picker = picker,        -- 负载均衡选择器
    up_checker = checker,          -- 健康检查器
    consumer = consumer,           -- 认证通过的消费者
    consumer_name = "jack",        -- 消费者名称
    consumer_ver = "123"           -- 消费者版本号
}

{
    value = {
        id = "1",                  -- 路由 ID
        uri = "/api/*",            -- URI 匹配模式
        uris = {"/api/v1", "/api/v2"},  -- 多个 URI (二选一)
        methods = {"GET", "POST"}, -- HTTP 方法
        host = "api.example.com",  -- 域名
        hosts = {"api.example.com", "*.example.com"},  -- 多个域名
        remote_addr = "192.168.1.0/24",  -- 客户端 IP
        remote_addrs = {"192.168.1.0/24"},  -- 多个 IP
        vars = {{"arg_id", "==", "123"}},  -- Nginx 变量表达式
        filter_func = "function(vars) ... end",  -- 自定义过滤函数
        priority = 0,              -- 优先级 (默认 0)
        plugins = {                -- 插件配置
            ["limit-count"] = {
                count = 100,
                time_window = 60
            }
        },
        upstream_id = "1",         -- 上游 ID
        upstream = {...},          -- 内联上游配置
        service_id = "1",          -- 服务 ID
        plugin_config_id = "1",    -- 插件配置 ID
        script = "...",            -- 脚本路由
        enable_websocket = true,   -- 启用 WebSocket
        timeout = {                -- 超时配置
            connect = 60,
            send = 60,
            read = 60
        },
        status = 1                 -- 启用状态 (0 禁用, 1 启用)
    },
    modifiedIndex = 123,           -- etcd 修改版本号
    key = "/apisix/routes/1"       -- etcd key
}

{
    resource_id = "1",             -- 上游 ID
    resource_version = "123",      -- 配置版本号
    resource_key = "/apisix/upstreams/1",  -- etcd key
    type = "roundrobin",           -- 负载均衡类型
    nodes = {                      -- 节点列表
        {host = "127.0.0.1", port = 8080, weight = 1, priority = 0},
        {host = "127.0.0.1", port = 8081, weight = 2, priority = 0}
    },
    scheme = "http",               -- 协议 (http/https/grpc/grpcs)
    hash_on = "vars",              -- 哈希键类型 (chash)
    key = "remote_addr",           -- 哈希键
    retries = 2,                   -- 重试次数
    retry_timeout = 0,             -- 重试超时 (0 表示无限)
    timeout = {                    -- 超时配置
        connect = 60,
        send = 60,
        read = 60
    },
    keepalive_pool = {             -- 连接池配置
        size = 320,
        idle_timeout = 60,
        requests = 1000
    },
    pass_host = "pass",            -- Host 传递策略 (pass/rewrite/node)
    upstream_host = "api.example.com",  -- 自定义 Host
    service_name = "my-service",   -- 服务发现服务名
    discovery_type = "consul",     -- 服务发现类型
    discovery_args = {...},        -- 服务发现参数
    checks = {                     -- 健康检查配置
        active = {...},            -- 主动健康检查
        passive = {...}            -- 被动健康检查
    },
    tls = {                        -- 上游 TLS 配置
        client_cert = "...",       -- 客户端证书
        client_key = "...",        -- 客户端私钥
        client_cert_id = "1"       -- 客户端证书 ID
    }
}

apisix:
  node_listen:                     # 监听端口
    - 9080                         # HTTP
    - port: 9443                   # HTTPS
      ssl: true
  enable_admin: true               # 启用 Admin API
  enable_control: true             # 启用 Control API
  enable_debug: false              # 启用调试模式
  enable_dev_mode: false           # 启用开发模式 (自动重载代码)
  enable_reuseport: true           # 启用端口复用
  enable_ipv6: true                # 启用 IPv6

  router:
    http: radixtree_uri            # HTTP 路由实现
    ssl: radixtree_sni             # SSL 路由实现

  proxy_cache:                     # 代理缓存配置
    zones:
    - name: disk_cache_one
      memory_size: 50m
      disk_size: 1G
      disk_path: /tmp/disk_cache_one

  delete_uri_tail_slash: false     # 删除 URI 尾部斜杠
  normalize_uri_like_servlet: false  # Servlet 风格 URI 标准化

nginx_config:
  error_log_level: warn            # 错误日志级别
  worker_processes: auto           # worker 进程数 (auto = CPU 核数)
  worker_rlimit_nofile: 20480      # 文件描述符上限

  event:
    worker_connections: 10620      # 每个 worker 最大连接数

  http:
    access_log: logs/access.log    # 访问日志路径
    keepalive_timeout: 60s         # Keepalive 超时
    client_header_timeout: 60s     # 客户端 header 超时
    client_body_timeout: 60s       # 客户端 body 超时
    send_timeout: 10s              # 发送超时

    upstream:
      keepalive: 320               # 上游连接池大小
      keepalive_timeout: 60s       # 上游 Keepalive 超时
      keepalive_requests: 1000     # 每连接最大请求数

deployment:
  role: traditional                # 角色 (traditional/data_plane/control_plane)
  role_traditional:
    config_provider: etcd          # 配置提供者 (etcd/yaml/xds)

  admin:
    admin_key:                     # Admin API 密钥
      - name: admin
        key: edd1c9f034335f136f87ad84b625c8f1
        role: admin
    admin_listen:
      ip: 0.0.0.0
      port: 9180
    https_admin: false             # Admin API 使用 HTTPS
    enable_admin_cors: true        # Admin API CORS

  etcd:
    host:                          # etcd 集群地址
      - "http://127.0.0.1:2379"
    prefix: /apisix                # etcd key 前缀
    timeout: 30                    # 连接超时 (秒)

plugin_attr:                       # 插件全局属性
  prometheus:
    export_addr:
      ip: 0.0.0.0
      port: 9091
  skywalking:
    service_name: APISIX
    service_instance_name: APISIX-Instance-1
    endpoint_addr: http://127.0.0.1:12800

plugins:                           # 启用的插件列表
  - real-ip
  - client-control
  - proxy-control
  - request-id
  - zipkin
  - ext-plugin-pre-req
  - fault-injection
  - mocking
  - serverless-pre-function
  - cors
  - ip-restriction
  - ua-restriction
  - referer-restriction
  - csrf
  - uri-blocker
  - request-validation
  - openid-connect
  - authz-keycloak
  - authz-casdoor
  - wolf-rbac
  - ldap-auth
  - hmac-auth
  - basic-auth
  - jwt-auth
  - key-auth
  - consumer-restriction
  - forward-auth
  - opa
  - proxy-rewrite
  - workflow
  - proxy-mirror
  - api-breaker
  - limit-req
  - limit-count
  - limit-conn
  # ... 更多插件