Spring Boot自建CDN完整方案：架构设计与高可用实现

# application-edge.yml 关键配置
server:
  port: 8080
  compression:
    enabled: true
    mime-types: text/html,text/css,application/javascript,image/*
    min-response-size: 1024
  http2:
    enabled: true
  tomcat:
    max-connections: 10000
    threads:
      max: 200
      min-spare: 20

@Configuration
@EnableWebFlux
public class StaticResourceConfig implements WebFluxConfigurer {
    
    @Value("${cdn.cache.directory:/data/cache}")
    private String cacheDirectory;
    
    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
        registry.addResourceHandler("/static/**")
                .addResourceLocations(
                    "file:" + cacheDirectory + "/",
                    "classpath:/static/"
                )
                .setCacheControl(CacheControl.maxAge(365, TimeUnit.DAYS))
                .resourceChain(true)
                .addResolver(new VersionResourceResolver().addContentVersionStrategy("/**"));
    }
}

@Service
public class MultiLevelCacheService {
    
    @Cacheable(value = "l1_cache", key = "#url", cacheManager = "caffeineCacheManager")
    @Cacheable(value = "l2_cache", key = "#url", cacheManager = "redisCacheManager")
    public CacheResource getResource(String url) {
        // L3缓存查询或回源获取
        return fetchFromL3OrOrigin(url);
    }
}

@Component
@EnableScheduling
public class CacheWarmUpScheduler {
    
    @Scheduled(cron = "0 30 6 * * ?") // 每日6:30执行
    public void warmUpCache() {
        List<String> hotResources = analyticsService.getDailyHotResources();
        hotResources.parallelStream()
            .forEach(resource -> cacheService.preload(resource));
    }
}

@RestController
public class CachePurgeController {
    
    @PostMapping("/cache/purge")
    public ResponseEntity<String> purgeCache(@RequestBody PurgeRequest request) {
        cacheService.evict(request.getUrls());
        messageQueue.publishPurgeEvent(request); // 通知其他节点
        return ResponseEntity.ok("Purge initiated");
    }
}

@RestController
public class EdgeComputeController {
    
    @GetMapping("/personalized/{userId}")
    public Mono<PersonalizedContent> getPersonalizedContent(
            @PathVariable String userId, 
            ServerWebExchange exchange) {
        
        String region = geoService.getRegion(exchange.getRequest());
        String deviceType = deviceDetectionService.detect(exchange.getRequest());
        
        return contentService.getBaseContent(userId)
                .flatMap(baseContent -> 
                    personalizationService.adaptContent(baseContent, region, deviceType)
                );
    }
}

@Component
public class EsiProcessor {
    
    public String processEsiTags(String htmlContent, HttpServletRequest request) {
        Pattern esiPattern = Pattern.compile("<esi:include src=\"(.*?)\" />");
        Matcher matcher = esiPattern.matcher(htmlContent);
        
        StringBuffer result = new StringBuffer();
        while (matcher.find()) {
            String esiUrl = matcher.group(1);
            String fragment = fetchFragment(esiUrl, request);
            matcher.appendReplacement(result, fragment != null ? fragment : "");
        }
        matcher.appendTail(result);
        
        return result.toString();
    }
}

@Controller
public class Http2PushController {
    
    @GetMapping("/page-with-resources")
    public String getPage(Model model, ServerHttpResponse response) {
        if (response instanceof ServletServerHttpResponse) {
            PushBuilder pushBuilder = ((ServletServerHttpResponse) response)
                    .getServletRequest().newPushBuilder();
            if (pushBuilder != null) {
                pushBuilder.path("/static/css/page.css").push();
                pushBuilder.path("/static/js/page.js").push();
            }
        }
        return "page";
    }
}

@Configuration
public class QuicConfig {
    
    @Bean
    public ReactorResourceFactory resourceFactory() {
        ReactorResourceFactory factory = new ReactorResourceFactory();
        factory.setUseGlobalResources(false);
        factory.addServerCustomizers(builder -> 
            builder.protocol(HttpProtocol.H2, HttpProtocol.HTTP11)
        );
        return factory;
    }
}

management:
  endpoints:
    web:
      exposure:
        include: health,metrics,info
  endpoint:
    health:
      show-details: always
      probes:
        enabled: true

@Component
public class CdnHealthIndicator implements HealthIndicator {
    
    @Override
    public Health health() {
        double hitRate = cacheStats.getHitRate();
        long activeConnections = connectionStats.getActiveCount();
        
        Health.Builder status = hitRate > 0.9 ? Health.up() : Health.down();
        
        return status
            .withDetail("cache_hit_rate", hitRate)
            .withDetail("active_connections", activeConnections)
            .withDetail("last_check_time", Instant.now())
            .build();
    }
}

@Component
public class CdnMetrics {
    
    private final MeterRegistry meterRegistry;
    private final Counter cacheHits;
    private final Counter cacheMisses;
    private final Timer requestTimer;
    
    public CdnMetrics(MeterRegistry meterRegistry) {
        this.meterRegistry = meterRegistry;
        this.cacheHits = Counter.builder("cdn.cache.hits")
                .description("CDN缓存命中次数")
                .register(meterRegistry);
        this.cacheMisses = Counter.builder("cdn.cache.misses")
                .description("CDN缓存未命中次数")
                .register(meterRegistry);
        this.requestTimer = Timer.builder("cdn.request.duration")
                .description("CDN请求处理时间")
                .register(meterRegistry);
    }
}

@Component
public class EdgeWafFilter implements WebFilter {
    
    @Override
    public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
        HttpServletRequest request = exchange.getRequest();
        
        // SQL注入检测
        if (sqlInjectionDetected(request)) {
            return Mono.error(new SecurityException("SQL injection attempt detected"));
        }
        
        // XSS攻击检测
        if (xssAttackDetected(request)) {
            return Mono.error(new SecurityException("XSS attack attempt detected"));
        }
        
        return chain.filter(exchange);
    }
}

@Service
public class RateLimitService {
    
    public boolean isAllowed(String clientIp, String endpoint, int maxRequests, Duration period) {
        String key = String.format("rate_limit:%s:%s", endpoint, clientIp);
        Long count = redisTemplate.opsForValue().increment(key);
        
        if (count == 1) {
            redisTemplate.expire(key, period.getSeconds(), TimeUnit.SECONDS);
        }
        
        return count <= maxRequests;
    }
}

# 网关路由配置示例
spring:
  cloud:
    gateway:
      routes:
        - id: static_content_route
          uri: lb://cdn-static-service
          predicates:
            - Path=/static/**
            - Header=X-Region, us-west
          filters:
            - StripPrefix=1
            - name: RequestRateLimiter
              args:
                redis-rate-limiter.replenishRate: 100
                redis-rate-limiter.burstCapacity: 200

@Component
public class DynamicLoadBalancerConfiguration {
    
    @Bean
    public ReactorLoadBalancer<ServiceInstance> dynamicWeightedLoadBalancer(
        Environment environment, LoadBalancerClientFactory factory) {
        
        String serviceId = factory.getName(environment);
        return new DynamicWeightedLoadBalancer(
            serviceId, 
            factory.getLazyProvider(serviceId, ServiceInstanceListSupplier.class)
        );
    }
}

# 健康检查配置
spring:
  cloud:
    gateway:
      discovery:
        locator:
          enabled: true
      loadbalancer:
        health-check:
          interval: 10s
          timeout: 3s
          path: /actuator/health
        circuit-breaker:
          enabled: true
          failure-threshold: 5
          slow-call-threshold: 2s

@Configuration
public class RateLimitConfig {
    
    @Bean
    public RedisRateLimiter redisRateLimiter() {
        return new RedisRateLimiter(
            RedisRateLimiter.Config.builder()
                .burstCapacity(200)  // 令牌桶容量
                .replenishRate(100) // 每秒补充令牌数
                .requestedTokens(1) // 每个请求消耗令牌数
                .build()
        );
    }
    
    @Bean
    public KeyResolver ipKeyResolver() {
        return exchange -> Mono.just(
            exchange.getRequest().getRemoteAddress().getAddress().getHostAddress()
        );
    }
}

# Nacos配置中心的路由规则
data:
  routes:
    - id: image_cdn_route
      predicates:
        - Path=/images/**
        - Method=GET
      filters:
        - name: ImageOptimizationFilter
          args:
            quality: 80
            format: webp
        - SetResponseHeader=Cache-Control, public, max-age=2592000
      uri: lb://image-processing-service

# HTTP客户端连接池配置
spring:
  cloud:
    gateway:
      httpclient:
        pool:
          type: elastic
          max-connections: 1000
          max-idle-time: 60s
          acquire-timeout: 45s
      httpserver:
        max-initial-line-length: 16KB
        max-header-size: 32KB

@Configuration
public class TracingConfig {
    
    @Bean
    public Tracing tracing() {
        return Tracing.newBuilder()
            .localServiceName("api-gateway")
            .spanReporter(spanReporter())
            .build();
    }
    
    @Bean
    public HttpClientFilter tracingClientFilter(Tracing tracing) {
        return new TracingClientFilter(tracing);
    }
}

@RestController
public class GatewayHealthController {
    
    @GetMapping("/gateway/health")
    public Map<String, Object> health() {
        return Map.of(
            "status", "UP",
            "timestamp", Instant.now(),
            "loadFactor", calculateCurrentLoad(),
            "activeRoutes", getActiveRoutesCount()
        );
    }
}

upstream gateway_cluster {
    server gateway01:8080 max_fails=3 fail_timeout=30s;
    server gateway02:8080 max_fails=3 fail_timeout=30s;
    server gateway03:8080 max_fails=3 fail_timeout=30s;
    
    # 基于最少连接数的负载均衡
    least_conn;
    
    # 健康检查配置
    check interval=5000 rise=2 fall=3 timeout=3000;
}

# application-cdn.yml 缓存配置
cdn:
  cache:
    l1:
      maximum-size: 10000
      expire-after-write: 10m
      refresh-after-write: 5m
    l2:
      host: redis-cluster.example.com
      port: 6379
      timeout: 2000ms

@Configuration
@EnableCaching
public class RedisClusterConfig {
    
    @Bean
    public RedisConnectionFactory redisConnectionFactory() {
        RedisClusterConfiguration config = new RedisClusterConfiguration();
        config.addClusterNode(new RedisNode("192.168.1.1", 6379));
        config.addClusterNode(new RedisNode("192.168.1.2", 6379));
        config.setMaxRedirects(3);
        
        LettuceClientConfiguration clientConfig = LettuceClientConfiguration.builder()
            .commandTimeout(Duration.ofSeconds(2))
            .build();
            
        return new LettuceConnectionFactory(config, clientConfig);
    }
}

@Component
public class DiskCacheResourceResolver implements ResourceResolver {
    
    @Value("${cdn.cache.disk-path:/data/cdn-cache}")
    private String cacheBasePath;
    
    @Override
    public Resource resolveResource(HttpServletRequest request, String requestPath, 
                                   List<? extends Resource> locations) {
        Path filePath = Paths.get(cacheBasePath, requestPath);
        if (Files.exists(filePath)) {
            return new FileSystemResource(filePath.toFile());
        }
        return null;
    }
}

@Configuration
public class CacheTtlConfig {
    
    @Bean
    public CacheManager cacheManager(RedisConnectionFactory factory) {
        RedisCacheConfiguration staticConfig = RedisCacheConfiguration.defaultCacheConfig()
            .entryTtl(Duration.ofDays(365))
            .disableCachingNullValues();
            
        RedisCacheConfiguration dynamicConfig = RedisCacheConfiguration.defaultCacheConfig()
            .entryTtl(Duration.ofMinutes(5))
            .disableCachingNullValues();
            
        return RedisCacheManager.builder(factory)
            .withCacheConfiguration("static", staticConfig)
            .withCacheConfiguration("dynamic", dynamicConfig)
            .build();
    }
}

@RestController
@RequestMapping("/cache")
public class CachePurgeController {
    
    @Autowired
    private CacheManager cacheManager;
    
    @PostMapping("/purge/{resourceId}")
    public ResponseEntity<String> purgeCache(@PathVariable String resourceId) {
        // 本地缓存清除
        cacheManager.getCache("static").evict(resourceId);
        
        // 广播到集群其他节点
        clusterEventPublisher.publishEvent(new CachePurgeEvent(resourceId));
        
        return ResponseEntity.ok("Cache purged successfully");
    }
}

@GetMapping("/resource/{id}")
public ResponseEntity<Resource> getResource(@PathVariable String id, 
                                          HttpServletRequest request) {
    String eTag = generateETag(id);
    String clientETag = request.getHeader("If-None-Match");
    
    if (eTag.equals(clientETag)) {
        return ResponseEntity.status(HttpStatus.NOT_MODIFIED).build();
    }
    
    Resource resource = resourceService.getResource(id);
    return ResponseEntity.ok()
        .eTag(eTag)
        .body(resource);
}

@Service
public class OriginPullService {
    
    @Autowired
    private WebClient webClient;
    
    public Mono<Resource> pullFromOrigin(String resourcePath) {
        return webClient.get()
            .uri(originBaseUrl + resourcePath)
            .header("X-CDN-Edge-Node", "true")
            .retrieve()
            .bodyToMono(Resource.class)
            .timeout(Duration.ofSeconds(10))
            .doOnSuccess(resource -> {
                // 异步缓存到各级存储
                cacheService.cacheResource(resourcePath, resource);
            });
    }
}

@Component
public class CacheWarmUpScheduler {
    
    @Scheduled(cron = "0 30 3 * * ?") // 每天凌晨3:30执行
    public void dailyWarmUp() {
        List<String> hotResources = analyticsService.predictHotResources();
        
        hotResources.parallelStream()
            .forEach(resource -> {
                pushToEdgeNodes(resource);
                log.info("Warmed up resource: {}", resource);
            });
    }
    
    private void pushToEdgeNodes(String resourcePath) {
        edgeNodeClient.pushResource(resourcePath)
            .onErrorResume(error -> {
                log.warn("Push failed for {}: {}", resourcePath, error.getMessage());
                return Mono.empty();
            });
    }
}

@Component
public class CacheKeyStrategy {
    
    public String generateCacheKey(String resourcePath, HttpServletRequest request) {
        // 规范化路径，忽略无关参数
        String normalizedPath = normalizePath(resourcePath);
        
        // 考虑设备类型差异化缓存
        String deviceType = extractDeviceType(request);
        
        // 版本化缓存键
        return String.format("%s:%s:%s", normalizedPath, deviceType, contentVersion);
    }
    
    private String normalizePath(String path) {
        // 移除统计参数等无关查询字符串
        return path.replaceAll("([?&])utm_[^&]*", "").replaceAll("[?&]+$", "");
    }
}

@ControllerAdvice
public class RegionalCacheAdvice {
    
    @ModelAttribute
    public void addRegionalAttributes(HttpServletRequest request, Model model) {
        String region = geoIpService.resolveRegion(request.getRemoteAddr());
        model.addAttribute("userRegion", region);
    }
}

@Cacheable(value = "content", key = "#contentId + ':' + #userRegion")
public RegionalContent getRegionalContent(String contentId, String userRegion) {
    return contentService.getContent(contentId, userRegion);
}

# 监控配置
management:
  endpoints:
    web:
      exposure:
        include: health,metrics,cache
  metrics:
    export:
      prometheus:
        enabled: true
  endpoint:
    metrics:
      enabled: true
    cache:
      enabled: true

@Component
public class CacheMetrics {
    
    private final MeterRegistry meterRegistry;
    private final Counter cacheHits;
    private final Counter cacheMisses;
    
    public CacheMetrics(MeterRegistry meterRegistry) {
        this.meterRegistry = meterRegistry;
        this.cacheHits = Counter.builder("cdn.cache.hits")
            .description("CDN缓存命中次数")
            .register(meterRegistry);
            
        this.cacheMisses = Counter.builder("cdn.cache.misses")
            .description("CDN缓存未命中次数")
            .register(meterRegistry);
    }
    
    public void recordHit() {
        cacheHits.increment();
    }
    
    public void recordMiss() {
        cacheMisses.increment();
    }
    
    public double getHitRate() {
        double hits = cacheHits.count();
        double misses = cacheMisses.count();
        return hits / (hits + misses);
    }
}

@Service
public class RateLimiterService {
    private static final DefaultRedisScript<Long> REDIS_SCRIPT;
    
    public boolean isAllowed(String key, int capacity, double rate, int requested) {
        long now = Instant.now().getEpochSecond();
        Long result = redisTemplate.execute(REDIS_SCRIPT, 
            Collections.singletonList(key),
            String.valueOf(now), String.valueOf(capacity),
            String.valueOf(rate), String.valueOf(requested));
        return result != null && result == 1;
    }
}

# 限制每个IP的并发连接数和请求速率
limit_conn_zone $binary_remote_addr zone=perip:10m;
limit_req_zone $binary_remote_addr zone=ratelimit:10m rate=10r/s;

server {
    limit_conn perip 10;
    limit_req zone=ratelimit burst=20 nodelay;
    
    # 静态资源缓存策略
    location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
        expires 7d;
        add_header Cache-Control "public, immutable";
        proxy_cache my_cache;
        proxy_cache_valid 200 302 10m;
    }
}

# application-security.yml
spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: https://auth.yourdomain.com
          jwk-set-uri: ${spring.security.oauth2.resourceserver.jwt.issuer-uri}/oauth2/jwks

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/static/**").permitAll()
                .requestMatchers("/api/public/**").permitAll()
                .requestMatchers("/api/secure/**").authenticated()
                .requestMatchers("/admin/**").hasRole("ADMIN")
            )
            .oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt)
            .sessionManagement(session -> session
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            );
        return http.build();
    }
    
    @Bean
    public JwtDecoder jwtDecoder() {
        return JwtDecoders.fromIssuerLocation(
            " https://auth.yourdomain.com "
        );
    }
}

@Service
public class CDNAuthorizationService {
    
    private final JwtDecoder jwtDecoder;
    
    public boolean hasPurgePermission(String token, String zone) {
        Jwt jwt = jwtDecoder.decode(token);
        Set<String> roles = jwt.getClaimAsStringList("roles")
                             .stream().collect(Collectors.toSet());
        
        // 检查用户是否有指定区域的缓存清除权限
        return roles.contains("CDN_ADMIN") || 
               roles.contains("ZONE_" + zone + "_ADMIN");
    }
    
    public boolean canAccessLogs(String token, String timeRange) {
        Jwt jwt = jwtDecoder.decode(token);
        Set<String> scopes = jwt.getClaimAsStringList("scope")
                               .stream().collect(Collectors.toSet());
        
        // 限制日志访问时间范围
        return scopes.contains("logs:read") && 
               isValidTimeRange(timeRange);
    }
}

# bootstrap.yml
spring:
  cloud:
    vault:
      host: vault.yourdomain.com
      port: 8200
      scheme: https
      authentication: TOKEN
      token: ${VAULT_TOKEN}
      kv:
        enabled: true
        backend: secret
        default-context: cdn
        
management:
  endpoint:
    vault:
      enabled: true

@Service
@RefreshScope
public class KeyManagementService {
    
    @Value("${cdn.tls.private-key}")
    private String tlsPrivateKey;
    
    @Value("${cdn.api.signing-key}")
    private String apiSigningKey;
    
    @Scheduled(fixedRate = 86400000) // 每天检查一次
    public void checkKeyExpiration() {
        checkTlsCertificateExpiry();
        rotateApiKeysIfNeeded();
    }
    
    private void checkTlsCertificateExpiry() {
        try {
            Certificate certificate = loadCertificate();
            if (certificate.getNotAfter().before(
                Date.from(Instant.now().plus(30, ChronoUnit.DAYS)))) {
                log.warn("TLS证书将在30天内过期，需要更新");
                triggerCertificateRenewal();
            }
        } catch (CertificateException e) {
            log.error("证书检查失败", e);
        }
    }
    
    @EventListener
    public void onKeyRotationEvent(KeyRotationEvent event) {
        log.info("接收到密钥轮换事件: {}", event.getKeyId());
        refreshKeysFromVault();
    }
}

@Configuration
public class MTLSConfig {
    
    @Bean
    public WebClient webClient() throws Exception {
        SSLContext sslContext = SSLContextBuilder
            .create()
            .loadKeyMaterial(
                keyStore(), 
                "key-password".toCharArray(),
                (aliases, socket) -> "cdn-edge-client"
            )
            .loadTrustMaterial(trustStore(), null)
            .build();
        
        HttpClient httpClient = HttpClient.create()
            .secure(spec -> spec.sslContext(
                SslContextBuilder.forClient()
                    .sslContext(sslContext)
            ));
        
        return WebClient.builder()
            .clientConnector(new ReactorClientHttpConnector(httpClient))
            .build();
    }
    
    @Bean
    public KeyStore keyStore() throws Exception {
        return KeyStore.getInstance("PKCS12");
    }
    
    @Bean 
    public KeyStore trustStore() throws Exception {
        KeyStore trustStore = KeyStore.getInstance("JKS");
        trustStore.load(new FileInputStream("truststore.jks"), 
                       "truststore-password".toCharArray());
        return trustStore;
    }
}

@Configuration
public class SecurityHeadersConfig {
    
    @Bean
    public SecurityFilterChain securityHeadersFilterChain(HttpSecurity http) throws Exception {
        http
            .headers(headers -> headers
                .contentSecurityPolicy(csp -> csp
                    .policyDirectives("default-src 'self'; " +
                        "script-src 'self' 'unsafe-inline'; " +
                        "style-src 'self' 'unsafe-inline'; " +
                        "img-src 'self' data: https:")
                )
                .httpStrictTransportSecurity(hsts -> hsts
                    .includeSubDomains(true)
                    .maxAgeInSeconds(31536000)
                )
                .xssProtection(xss -> xss
                    .headerValue(XXssProtectionHeaderWriter.HeaderValue.ENABLED_MODE_BLOCK)
                )
                .frameOptions(frame -> frame
                    .sameOrigin()
                )
                .contentTypeOptions(contentType -> contentType
                    .disable()
                )
            )
            .cors(cors -> cors
                .configurationSource(corsConfigurationSource())
            );
        return http.build();
    }
    
    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(Arrays.asList(
            " https://yourdomain.com ", 
            " https://cdn.yourdomain.com "
        ));
        configuration.setAllowedMethods(Arrays.asList("GET", "POST"));
        configuration.setAllowedHeaders(Arrays.asList("Authorization", "Content-Type"));
        configuration.setExposedHeaders(Arrays.asList("X-Cache-Hit", "X-Cache-Key"));
        configuration.setMaxAge(3600L);
        
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
}

@Component
public class RequestValidationFilter implements Filter {
    
    private final ObjectMapper objectMapper;
    
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, 
                       FilterChain chain) throws IOException, ServletException {
        
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        ContentCachingRequestWrapper wrappedRequest = 
            new ContentCachingRequestWrapper(httpRequest);
        
        // 验证请求头
        if (!isValidUserAgent(httpRequest.getHeader("User-Agent"))) {
            sendErrorResponse(response, "Invalid User-Agent");
            return;
        }
        
        // 检查请求大小限制
        if (httpRequest.getContentLengthLong() > 10 * 1024 * 1024) { // 10MB
            sendErrorResponse(response, "Request too large");
            return;
        }
        
        chain.doFilter(wrappedRequest, response);
    }
    
    private boolean isValidUserAgent(String userAgent) {
        if (userAgent == null || userAgent.length() > 500) {
            return false;
        }
        
        // 检查常见的恶意User-Agent模式
        String[] maliciousPatterns = {
            "sqlmap", "nmap", "metasploit", "wget", "curl"
        };
        
        for (String pattern : maliciousPatterns) {
            if (userAgent.toLowerCase().contains(pattern)) {
                return false;
            }
        }
        
        return true;
    }
}

@Component
@Aspect
public class SecurityAuditAspect {
    
    private final SecurityEventRepository eventRepository;
    
    @AfterReturning(
        pointcut = "@annotation(org.springframework.security.access.prepost.PreAuthorize)",
        returning = "result"
    )
    public void auditAuthorizationSuccess(JoinPoint joinPoint, Object result) {
        Authentication authentication = SecurityContextHolder.getContext()
                                                            .getAuthentication();
        
        SecurityEvent event = SecurityEvent.builder()
            .timestamp(Instant.now())
            .principal(authentication.getName())
            .type("AUTHORIZATION_SUCCESS")
            .method(joinPoint.getSignature().getName())
            .details(Map.of(
                "roles", authentication.getAuthorities().stream()
                    .map(GrantedAuthority::getAuthority)
                    .collect(Collectors.toList())
            ))
            .build();
            
        eventRepository.save(event);
    }
    
    @AfterThrowing(
        pointcut = "@annotation(org.springframework.security.access.prepost.PreAuthorize)",
        throwing = "ex"
    )
    public void auditAuthorizationFailure(JoinPoint joinPoint, AccessDeniedException ex) {
        Authentication authentication = SecurityContextHolder.getContext()
                                                            .getAuthentication();
        
        SecurityEvent event = SecurityEvent.builder()
            .timestamp(Instant.now())
            .principal(authentication != null ? authentication.getName() : "anonymous")
            .type("AUTHORIZATION_FAILURE")
            .method(joinPoint.getSignature().getName())
            .details(Map.of("error", ex.getMessage()))
            .build();
            
        eventRepository.save(event);
    }
}

@Component
public class SecurityMetrics {
    
    private final MeterRegistry meterRegistry;
    private final Counter authenticationSuccessCounter;
    private final Counter authenticationFailureCounter;
    private final Counter authorizationFailureCounter;
    
    public SecurityMetrics(MeterRegistry meterRegistry) {
        this.meterRegistry = meterRegistry;
        
        this.authenticationSuccessCounter = Counter.builder("security.authentication.success")
            .description("Number of successful authentications")
            .register(meterRegistry);
            
        this.authenticationFailureCounter = Counter.builder("security.authentication.failure")
            .description("Number of failed authentications")
            .register(meterRegistry);
            
        this.authorizationFailureCounter = Counter.builder("security.authorization.failure")
            .description("Number of authorization failures")
            .register(meterRegistry);
    }
    
    public void recordAuthenticationSuccess(String username) {
        authenticationSuccessCounter.increment();
        meterRegistry.gauge("security.active.sessions", 
            SecurityContextHolder.getContexts().size());
    }
    
    public void recordAuthenticationFailure(String username, String reason) {
        authenticationFailureCounter.increment();
        Tags tags = Tags.of("reason", reason);
        meterRegistry.counter("security.authentication.failure.detail", tags).increment();
    }
}

# config-server配置
security:
  rate-limiting:
    ip:
      requests-per-second: 100
      burst-capacity: 200
    user:
      requests-per-second: 50
      burst-capacity: 100
  waf:
    rules:
      - name: "SQL Injection Prevention"
        pattern: "(union|select|insert|drop).*from"
        action: "block"
      - name: "XSS Prevention"  
        pattern: "(<script|javascript:)"
        action: "block"
  blacklist:
    update-interval: 300000  # 5分钟更新一次
    sources:
      - " https://threat-intel.yourdomain.com/blacklist "

@Component
public class SecurityConfigRefresher {
    
    private final RateLimitService rateLimitService;
    private final WAFRuleEngine wafRuleEngine;
    private final IPBlacklistService blacklistService;
    
    @EventListener
    public void onRefreshEvent(ContextRefreshedEvent event) {
        refreshSecurityConfigurations();
    }
    
    @Scheduled(fixedRateString = "${security.blacklist.update-interval:300000}")
    public void refreshBlacklist() {
        blacklistService.refreshBlacklist();
    }
    
    @RefreshScope
    @Configuration
    @ConfigurationProperties(prefix = "security.rate-limiting")
    public static class RateLimitConfig {
        private RateLimitRule ip;
        private RateLimitRule user;
        
        // getters and setters
    }
}

@Service
public class HotUpdateSecurityPolicy {
    
    private final Map<String, SecurityPolicy> activePolicies = new ConcurrentHashMap<>();
    private final ScheduledExecutorService scheduler = 
        Executors.newScheduledThreadPool(1);
    
    @PostConstruct
    public void init() {
        // 每30秒检查策略更新
        scheduler.scheduleAtFixedRate(this::checkPolicyUpdates, 0, 30, TimeUnit.SECONDS);
    }
    
    public void updatePolicy(String policyId, SecurityPolicy newPolicy) {
        activePolicies.put(policyId, newPolicy);
        log.info("安全策略已更新: {}", policyId);
        
        // 通知相关组件策略已更新
        applicationContext.publishEvent(new SecurityPolicyUpdateEvent(this, policyId));
    }
    
    public boolean evaluateRequest(String policyId, HttpServletRequest request) {
        SecurityPolicy policy = activePolicies.get(policyId);
        if (policy == null) {
            return true; // 默认允许
        }
        return policy.evaluate(request);
    }
    
    @EventListener
    public void onWafRuleUpdate(WafRuleUpdateEvent event) {
        updatePolicy("waf_" + event.getRuleId(), event.getNewPolicy());
    }
}

缓存键 = 规范化路径 + 用户代理特征 + 内容哈希 + 压缩算法标识

// 内容协商缓存策略示例
public class ContentNegotiationCacheStrategy {
    
    public CachedResponse negotiate(HttpServletRequest request, 
                                   List<CachedVariant> availableVariants) {
        
        // 解析客户端能力
        ClientCapabilities capabilities = parseClientCapabilities(request);
        
        // 匹配最优变体
        return availableVariants.stream()
                .filter(variant -> variant.isCompatible(capabilities))
                .max(Comparator.comparing(CachedVariant::getPreferenceScore))
                .orElseGet(() -> getDefaultVariant(availableVariants));
    }
    
    private ClientCapabilities parseClientCapabilities(HttpServletRequest request) {
        String acceptEncoding = request.getHeader("Accept-Encoding");
        String userAgent = request.getHeader("User-Agent");
        String accept = request.getHeader("Accept");
        
        return new ClientCapabilities(acceptEncoding, userAgent, accept);
    }
}

# 网络感知压缩配置
compression:
  adaptive:
    enabled: true
    network_thresholds:
      high_speed: 
        rtt_max: 50ms
        compression_level: 4
      medium_speed:
        rtt_max: 200ms  
        compression_level: 7
      low_speed:
        rtt_max: 500ms
        compression_level: 11
    fallback_policy: "degrade_content"

@Component
public class ApiResponseCompressionOptimizer {
    
    @Autowired
    private CompressionService compressionService;
    
    public byte[] optimizeAggregatedResponse(List<ApiResponse> responses, 
                                           ClientInfo clientInfo) {
        
        // 分析响应特征
        ResponseCharacteristics characteristics = analyzeResponses(responses);
        
        // 选择最优压缩策略
        CompressionStrategy strategy = selectCompressionStrategy(characteristics, clientInfo);
        
        // 应用差异化压缩
        return applyDifferentiatedCompression(responses, strategy);
    }
    
    private CompressionStrategy selectCompressionStrategy(
            ResponseCharacteristics characteristics, ClientInfo clientInfo) {
        
        if (characteristics.hasLargeBinaryData()) {
            return new BinaryOptimizedStrategy();
        } else if (characteristics.isTextHeavy()) {
            return new TextOptimizedStrategy(clientInfo.supportsBrotli());
        } else {
            return new BalancedCompressionStrategy();
        }
    }
}

# Prometheus监控配置
metrics:
  compression:
    enabled: true
    buckets: [0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10]
    labels: ["content_type", "compression_algorithm", "compression_level"]

public class PredictiveCacheManager {
    
    public void adjustCachePolicy(String contentId, AccessPattern pattern) {
        HeatPrediction prediction = heatPredictor.predict(contentId, pattern);
        
        switch (prediction.getHeatLevel()) {
            case HIGH:
                // 延长TTL，增加缓存副本
                cacheStore.setTTL(contentId, Duration.ofDays(7));
                cacheStore.replicate(contentId, 3);
                break;
            case MEDIUM:
                cacheStore.setTTL(contentId, Duration.ofDays(2));
                break;
            case LOW:
                // 缩短TTL，可能不缓存
                cacheStore.setTTL(contentId, Duration.ofHours(6));
                break;
        }
    }
}

# application.yml
server:
  http2:
    enabled: true
  ssl:
    key-store: classpath:keystore.p12
    key-store-password: changeit

@Configuration
public class TlsOptimizationConfig {
    
    @Bean
    public ServletWebServerFactory servletContainer() {
        TomcatServletWebServerFactory tomcat = new TomcatServletWebServerFactory();
        tomcat.addConnectorCustomizers(connector -> {
            if (connector.getProtocolHandler() instanceof AbstractHttp11Protocol) {
                AbstractHttp11Protocol<?> protocol = 
                    (AbstractHttp11Protocol<?>) connector.getProtocolHandler();
                protocol.setUseServerCipherSuitesOrder(true);
            }
        });
        return tomcat;
    }
}

@Component
public class EdgeFunctionEngine {
    
    private final ScriptEngineManager manager = new ScriptEngineManager();
    
    public Object executeEdgeFunction(String script, Map<String, Object> context) {
        ScriptEngine engine = manager.getEngineByName("javascript");
        
        // 设置上下文变量
        context.forEach((key, value) -> engine.put(key, value));
        
        try {
            return engine.eval(script);
        } catch (ScriptException e) {
            throw new RuntimeException("Edge function execution failed", e);
        }
    }
}

@Service
public class ProtocolSelectionService {
    
    public Protocol selectOptimalProtocol(NetworkMetrics metrics) {
        if (metrics.getLatency() > 200 || metrics.getPacketLoss() > 0.02) {
            return Protocol.HTTP3; // 高延迟或丢包网络
        } else if (metrics.getBandwidth() < 5) {
            return Protocol.HTTP2; // 低带宽环境
        } else {
            return Protocol.HTTP2; // 默认选择
        }
    }
}

@Service
public class ContentPreheatService {
    
    @Autowired
    private AccessLogAnalyzer logAnalyzer;
    
    public void preheatContent(String contentId, PreheatStrategy strategy) {
        // 基于预测热度决定预热范围
        HeatLevel heatLevel = predictContentHeat(contentId);
        
        switch (heatLevel) {
            case HIGH:
                preheatToAllEdges(contentId);
                break;
            case MEDIUM:
                preheatToRegionalEdges(contentId);
                break;
            case LOW:
                preheatToNearestEdge(contentId);
                break;
        }
    }
}

@Configuration
public class ProtocolABTestConfig {
    
    @Bean
    public ABTestManager protocolTestManager() {
        return ABTestManager.builder()
            .addVariant("http2_only", new Http2OnlyStrategy())
            .addVariant("http3_preferred", new Http3PreferredStrategy())
            .addVariant("adaptive", new AdaptiveProtocolStrategy())
            .build();
    }
}

用户请求 → DNS查询 → 调度中心 → 实时数据分析 → 最优节点选择 → 返回节点IP

# application-scheduler.yml
spring:
  cloud:
    loadbalancer:
      config:
        health-check:
          interval: 5s
          timeout: 2s
        algorithm: weighted_least_connection
        weights:
          node-beijing: 0.3
          node-shanghai: 0.4
          node-guangzhou: 0.3

@Configuration
@EnableConfigurationProperties(SchedulerProperties.class)
public class SchedulerConfig {
    
    @Bean
    public MeterRegistryCustomizer<MeterRegistry> metricsCommonTags() {
        return registry -> registry.config()
            .commonTags("application", "cdn-scheduler")
            .commonTags("region", System.getProperty("region", "unknown"));
    }
    
    @Bean
    @ConditionalOnMissingBean
    public HealthIndicator nodeHealthIndicator() {
        return new CompositeHealthIndicator(
            new OrderedHealthAggregator(),
            Map.of(
                "network", new NetworkHealthIndicator(),
                "cache", new CacheHealthIndicator(),
                "load", new LoadHealthIndicator()
            )
        );
    }
}

@Service
public class GeoLocationService {
    
    private final DatabaseReader cityDatabase;
    private final DatabaseReader asnDatabase;
    
    public GeoLocationService(@Value("${geoip.city-db}") String cityDbPath,
                             @Value("${geoip.asn-db}") String asnDbPath) 
        throws IOException {
        this.cityDatabase = new DatabaseReader.Builder(
            new File(cityDbPath)).build();
        this.asnDatabase = new DatabaseReader.Builder(
            new File(asnDbPath)).build();
    }
    
    public UserLocation resolveLocation(String clientIP) {
        try {
            InetAddress ipAddress = InetAddress.getByName(clientIP);
            CityResponse cityResponse = cityDatabase.city(ipAddress);
            AsnResponse asnResponse = asnDatabase.asn(ipAddress);
            
            return UserLocation.builder()
                .ip(clientIP)
                .country(cityResponse.getCountry().getName())
                .city(cityResponse.getCity().getName())
                .latitude(cityResponse.getLocation().getLatitude())
                .longitude(cityResponse.getLocation().getLongitude())
                .autonomousSystemNumber(asnResponse.getAutonomousSystemNumber())
                .autonomousSystemOrganization(asnResponse.getAutonomousSystemOrganization())
                .build();
        } catch (Exception e) {
            log.warn("Failed to resolve location for IP: {}", clientIP, e);
            return UserLocation.unknown(clientIP);
        }
    }
}

@Component
public class DistanceCalculator {
    
    private static final double EARTH_RADIUS_KM = 6371.0;
    
    public double calculateDistance(double lat1, double lon1, 
                                   double lat2, double lon2) {
        double dLat = Math.toRadians(lat2 - lat1);
        double dLon = Math.toRadians(lon2 - lon1);
        
        double a = Math.sin(dLat/2) * Math.sin(dLat/2) +
                  Math.cos(Math.toRadians(lat1)) * Math.cos(Math.toRadians(lat2)) *
                  Math.sin(dLon/2) * Math.sin(dLon/2);
        
        double c = 2 * Math.atan2(Math.sqrt(a), Math.sqrt(1-a));
        return EARTH_RADIUS_KM * c;
    }
    
    public List<CdnNode> findNearestNodes(UserLocation userLocation, 
                                         List<CdnNode> availableNodes, 
                                         int maxResults) {
        return availableNodes.stream()
            .map(node -> new NodeDistance(node, 
                calculateDistance(userLocation.getLatitude(), 
                                userLocation.getLongitude(),
                                node.getLatitude(), 
                                node.getLongitude())))
            .sorted(Comparator.comparingDouble(NodeDistance::getDistance))
            .limit(maxResults)
            .map(NodeDistance::getNode)
            .collect(Collectors.toList());
    }
    
    @Data
    @AllArgsConstructor
    private static class NodeDistance {
        private CdnNode node;
        private double distance;
    }
}

@Service
@Slf4j
public class NetworkProbeService {
    
    private final ScheduledExecutorService scheduler = 
        Executors.newScheduledThreadPool(10);
    private final Map<String, NetworkMetrics> nodeMetrics = 
        new ConcurrentHashMap<>();
    
    @PostConstruct
    public void init() {
        // 每30秒执行一次网络探测
        scheduler.scheduleAtFixedRate(this::probeAllNodes, 0, 30, TimeUnit.SECONDS);
    }
    
    private void probeAllNodes() {
        List<CdnNode> nodes = nodeRepository.findAllActiveNodes();
        nodes.forEach(this::probeNodeAsync);
    }
    
    @Async
    public void probeNodeAsync(CdnNode node) {
        try {
            NetworkMetrics metrics = new NetworkMetrics();
            
            // ICMP延迟测试
            metrics.setPingLatency(measurePingLatency(node.getIpAddress()));
            
            // TCP连接延迟测试
            metrics.setTcpHandshakeLatency(measureTcpHandshake(node.getIpAddress(), 80));
            
            // HTTP响应时间测试
            metrics.setHttpResponseTime(measureHttpResponse(node.getUrl()));
            
            // 带宽测试（抽样）
            if (shouldMeasureBandwidth()) {
                metrics.setAvailableBandwidth(measureBandwidth(node));
            }
            
            // 更新节点指标
            nodeMetrics.put(node.getId(), metrics);
            log.debug("Probed node {}: {}", node.getId(), metrics);
            
        } catch (Exception e) {
            log.warn("Failed to probe node {}: {}", node.getId(), e.getMessage());
            markNodeUnhealthy(node.getId());
        }
    }
    
    public Optional<NetworkMetrics> getNodeMetrics(String nodeId) {
        return Optional.ofNullable(nodeMetrics.get(nodeId));
    }
    
    public double calculateNetworkScore(String nodeId) {
        NetworkMetrics metrics = nodeMetrics.get(nodeId);
        if (metrics == null) return 0.0;
        
        // 综合网络评分算法
        double latencyScore = Math.max(0, 1 - metrics.getPingLatency() / 100.0);
        double bandwidthScore = Math.min(1.0, metrics.getAvailableBandwidth() / 1000.0);
        double reliabilityScore = metrics.getPacketLossRate() < 0.05 ? 1.0 : 0.5;
        
        return (latencyScore * 0.6 + bandwidthScore * 0.3 + reliabilityScore * 0.1);
    }
}

@Component
public class DynamicWeightCalculator {
    
    private static final double BASE_WEIGHT = 1.0;
    private static final double LATENCY_WEIGHT = 0.5;
    private static final double LOAD_WEIGHT = 0.3;
    private static final double COST_WEIGHT = 0.2;
    
    public Map<String, Double> calculateNodeWeights(List<CdnNode> nodes, 
                                                  UserLocation userLocation) {
        Map<String, Double> weights = new HashMap<>();
        
        for (CdnNode node : nodes) {
            double latencyFactor = calculateLatencyFactor(node, userLocation);
            double loadFactor = calculateLoadFactor(node);
            double costFactor = calculateCostFactor(node);
            double distanceFactor = calculateDistanceFactor(node, userLocation);
            
            double weight = BASE_WEIGHT * 
                          (LATENCY_WEIGHT * latencyFactor +
                           LOAD_WEIGHT * loadFactor +
                           COST_WEIGHT * costFactor) *
                          distanceFactor;
            
            weights.put(node.getId(), Math.max(0.1, weight)); // 最小权重0.1
        }
        
        return normalizeWeights(weights);
    }
    
    private double calculateLatencyFactor(CdnNode node, UserLocation userLocation) {
        double currentLatency = networkProbeService.getNodeMetrics(node.getId())
            .map(NetworkMetrics::getPingLatency)
            .orElse(100.0); // 默认100ms
        
        double expectedLatency = calculateExpectedLatency(node, userLocation);
        return Math.max(0.1, expectedLatency / currentLatency);
    }
    
    private double calculateLoadFactor(CdnNode node) {
        double cpuUsage = node.getCurrentCpuUsage();
        double connectionCount = node.getActiveConnections();
        double maxConnections = node.getMaxConnections();
        
        // CPU使用率影响因子（0-1，越低越好）
        double cpuFactor = 1.0 - (cpuUsage / 100.0);
        // 连接数影响因子
        double connFactor = 1.0 - (connectionCount / maxConnections);
        
        return (cpuFactor * 0.6 + connFactor * 0.4);
    }
    
    private Map<String, Double> normalizeWeights(Map<String, Double> weights) {
        double sum = weights.values().stream().mapToDouble(Double::doubleValue).sum();
        if (sum == 0) return weights;
        
        Map<String, Double> normalized = new HashMap<>();
        weights.forEach((nodeId, weight) -> 
            normalized.put(nodeId, weight / sum));
        return normalized;
    }
}

@Service
public class ComprehensiveScoringService {
    
    private final NetworkProbeService networkProbeService;
    private final NodeLoadService nodeLoadService;
    private final CacheStateService cacheStateService;
    private final CostCalculator costCalculator;
    private final SecurityStatusService securityStatusService;
    
    public NodeScore calculateNodeScore(CdnNode node, String resourceKey, 
                                       UserLocation userLocation) {
        NodeScore score = new NodeScore(node.getId());
        
        // 网络延迟评分（35%权重）
        double networkScore = calculateNetworkScore(node, userLocation);
        score.addDimensionScore("network", networkScore, 0.35);
        
        // 节点负载评分（25%权重）
        double loadScore = calculateLoadScore(node);
        score.addDimensionScore("load", loadScore, 0.25);
        
        // 缓存状态评分（20%权重）
        double cacheScore = calculateCacheScore(node, resourceKey);
        score.addDimensionScore("cache", cacheScore, 0.20);
        
        // 成本因素评分（10%权重）
        double costScore = calculateCostScore(node, userLocation);
        score.addDimensionScore("cost", costScore, 0.10);
        
        // 安全状态评分（10%权重）
        double securityScore = calculateSecurityScore(node);
        score.addDimensionScore("security", securityScore, 0.10);
        
        return score;
    }
    
    private double calculateNetworkScore(CdnNode node, UserLocation userLocation) {
        Optional<NetworkMetrics> metrics = networkProbeService.getNodeMetrics(node.getId());
        if (metrics.isEmpty()) return 0.5; // 默认中等评分
        
        NetworkMetrics nm = metrics.get();
        double latency = nm.getPingLatency();
        
        // 延迟评分：0-50ms=1.0, 50-100ms=0.8, 100-200ms=0.6, 200ms+=0.3
        if (latency <= 50) return 1.0;
        else if (latency <= 100) return 0.8;
        else if (latency <= 200) return 0.6;
        else return 0.3;
    }
    
    private double calculateCacheScore(CdnNode node, String resourceKey) {
        CacheState cacheState = cacheStateService.getCacheState(node.getId(), resourceKey);
        
        if (cacheState.isPresent() && cacheState.isFresh()) {
            return 1.0; // 缓存存在且新鲜
        } else if (cacheState.isPresent() && !cacheState.isFresh()) {
            return 0.7; // 缓存存在但需要验证
        } else {
            return 0.3; // 缓存不存在
        }
    }
    
    public Optional<CdnNode> selectOptimalNode(List<CdnNode> candidates, 
                                               String resourceKey, 
                                               UserLocation userLocation) {
        return candidates.stream()
            .map(node -> new NodeSelection(node, 
                calculateNodeScore(node, resourceKey, userLocation)))
            .max(Comparator.comparingDouble(NodeSelection::getScore))
            .map(NodeSelection::getNode);
    }
    
    @Data
    @AllArgsConstructor
    private static class NodeSelection {
        private CdnNode node;
        private NodeScore score;
    }
}

@Service
public class PredictiveSchedulingService {
    
    private final TimeSeriesAnalyzer timeSeriesAnalyzer;
    private final PatternRecognitionService patternRecognition;
    
    public PredictiveMetrics predictNodePerformance(String nodeId, 
                                                   Instant timePoint) {
        // 分析历史性能数据
        List<PerformanceRecord> history = loadHistoricalData(nodeId, 
            timePoint.minus(7, ChronoUnit.DAYS), timePoint);
        
        // 识别周期性模式（日周期、周周期）
        PeriodicPattern dailyPattern = patternRecognition.analyzeDailyPattern(history);
        PeriodicPattern weeklyPattern = patternRecognition.analyzeWeeklyPattern(history);
        
        // 预测未来性能
        double predictedLoad = predictLoad(dailyPattern, weeklyPattern, timePoint);
        double predictedLatency = predictLatency(dailyPattern, weeklyPattern, timePoint);
        
        return new PredictiveMetrics(predictedLoad, predictedLatency);
    }
    
    public double calculatePredictiveScore(CdnNode node, Instant scheduledTime) {
        PredictiveMetrics metrics = predictNodePerformance(node.getId(), scheduledTime);
        
        // 基于预测结果计算调度评分
        double loadScore = 1.0 - Math.min(1.0, metrics.getPredictedLoad() / 0.8);
        double latencyScore = metrics.getPredictedLatency() < 100 ? 1.0 : 0.6;
        
        return (loadScore * 0.6 + latencyScore * 0.4);
    }
}

@Component
public class BusinessTypeRecognizer {
    
    public BusinessType recognizeBusinessType(HttpServletRequest request) {
        String path = request.getRequestURI();
        String userAgent = request.getHeader("User-Agent");
        String acceptHeader = request.getHeader("Accept");
        
        // 基于URL路径识别
        if (path.endsWith(".mp4") || path.endsWith(".m3u8")) {
            return BusinessType.VIDEO_STREAMING;
        } else if (path.endsWith(".jpg") || path.endsWith(".png")) {
            return BusinessType.IMAGE_DELIVERY;
        } else if (path.contains("/api/") || path.endsWith(".json")) {
            return BusinessType.API_GATEWAY;
        } else if (path.endsWith(".zip") || path.endsWith(".exe")) {
            return BusinessType.LARGE_FILE_DOWNLOAD;
        }
        
        // 基于Content-Type识别
        if (acceptHeader != null && acceptHeader.contains("text/html")) {
            return BusinessType.WEB_PAGE;
        }
        
        return BusinessType.GENERIC_STATIC;
    }
    
    public SchedulingStrategy getStrategyForBusinessType(BusinessType type) {
        switch (type) {
            case VIDEO_STREAMING:
                return new VideoStreamingStrategy();
            case IMAGE_DELIVERY:
                return new ImageDeliveryStrategy();
            case LARGE_FILE_DOWNLOAD:
                return new LargeFileStrategy();
            case API_GATEWAY:
                return new ApiGatewayStrategy();
            default:
                return new GenericStrategy();
        }
    }
}

@Component
public class VideoStreamingStrategy implements SchedulingStrategy {
    
    private static final double BANDWIDTH_WEIGHT = 0.4;
    private static final double STABILITY_WEIGHT = 0.4;
    private static final double LATENCY_WEIGHT = 0.2;
    
    @Override
    public NodeScore calculateNodeScore(CdnNode node, UserLocation userLocation, 
                                       Map<String, Object> context) {
        NodeScore score = new NodeScore(node.getId());
        
        // 带宽能力评分
        double bandwidthScore = calculateBandwidthScore(node);
        score.addDimensionScore("bandwidth", bandwidthScore, BANDWIDTH_WEIGHT);
        
        // 网络稳定性评分
        double stabilityScore = calculateStabilityScore(node);
        score.addDimensionScore("stability", stabilityScore, STABILITY_WEIGHT);
        
        // 延迟评分（相对次要）
        double latencyScore = calculateLatencyScore(node, userLocation);
        score.addDimensionScore("latency", latencyScore, LATENCY_WEIGHT);
        
        return score;
    }
    
    private double calculateBandwidthScore(CdnNode node) {
        NetworkMetrics metrics = networkProbeService.getNodeMetrics(node.getId())
            .orElse(NetworkMetrics.defaultMetrics());
        
        double availableBandwidth = metrics.getAvailableBandwidth();
        // 带宽评分：100Mbps+=1.0, 50-100Mbps=0.8, 20-50Mbps=0.6, <20Mbps=0.3
        if (availableBandwidth >= 100) return 1.0;
        else if (availableBandwidth >= 50) return 0.8;
        else if (availableBandwidth >= 20) return 0.6;
        else return 0.3;
    }
    
    private double calculateStabilityScore(CdnNode node) {
        NetworkMetrics metrics = networkProbeService.getNodeMetrics(node.getId())
            .orElse(NetworkMetrics.defaultMetrics());
        
        double packetLoss = metrics.getPacketLossRate();
        double jitter = metrics.getJitter();
        
        // 丢包率评分
        double lossScore = packetLoss < 0.01 ? 1.0 : 
                          packetLoss < 0.05 ? 0.7 : 0.3;
        
        // 抖动评分
        double jitterScore = jitter < 10 ? 1.0 :
                            jitter < 30 ? 0.7 : 0.3;
        
        return (lossScore * 0.6 + jitterScore * 0.4);
    }
}

@Component
public class HealthCheckService {
    
    private final ScheduledExecutorService healthCheckScheduler =
        Executors.newScheduledThreadPool(5);
    private final Map<String, NodeHealthStatus> healthStatus = 
        new ConcurrentHashMap<>();
    
    @PostConstruct
    public void startHealthMonitoring() {
        // 每10秒执行一次健康检查
        healthCheckScheduler.scheduleAtFixedRate(
            this::performHealthChecks, 0, 10, TimeUnit.SECONDS);
    }
    
    private void performHealthChecks() {
        List<CdnNode> nodes = nodeRepository.findAllActiveNodes();
        nodes.forEach(this::checkNodeHealthAsync);
    }
    
    @Async
    public void checkNodeHealthAsync(CdnNode node) {
        HealthCheckResult result = new HealthCheckResult();
        
        // 基础连通性检查
        result.setNetworkReachable(checkNetworkConnectivity(node));
        
        // 服务端口检查
        result.setServiceAvailable(checkServicePorts(node));
        
        // 性能指标检查
        result.setPerformanceNormal(checkPerformanceMetrics(node));
        
        // 业务功能检查
        result.setBusinessFunctional(checkBusinessFunctionality(node));
        
        // 更新健康状态
        updateHealthStatus(node.getId(), result);
    }
    
    private boolean checkNetworkConnectivity(CdnNode node) {
        try {
            return InetAddress.getByName(node.getIpAddress()).isReachable(3000);
        } catch (Exception e) {
            return false;
        }
    }
    
    private boolean checkServicePorts(CdnNode node) {
        int[] ports = {80, 443, 8080}; // 需要检查的服务端口
        for (int port : ports) {
            if (!isPortOpen(node.getIpAddress(), port)) {
                return false;
            }
        }
        return true;
    }
    
    public HealthStatus getNodeHealthStatus(String nodeId) {
        NodeHealthStatus status = healthStatus.get(nodeId);
        if (status == null) return HealthStatus.UNKNOWN;
        
        // 连续失败次数判断
        if (status.getConsecutiveFailures() >= 3) {
            return HealthStatus.UNHEALTHY;
        }
        
        // 最近成功率判断
        double successRate = status.getSuccessRate(5); // 最近5次检查
        if (successRate >= 0.8) {
            return HealthStatus.HEALTHY;
        } else if (successRate >= 0.5) {
            return HealthStatus.DEGRADED;
        } else {
            return HealthStatus.UNHEALTHY;
        }
    }
}

@Service
public class FailoverService {
    
    private final HealthCheckService healthCheckService;
    private final SchedulingService schedulingService;
    
    @EventListener
    public void handleNodeFailure(NodeFailureEvent event) {
        String failedNodeId = event.getNodeId();
        HealthStatus status = healthCheckService.getNodeHealthStatus(failedNodeId);
        
        if (status == HealthStatus.UNHEALTHY) {
            log.warn("Node {} is unhealthy, initiating failover", failedNodeId);
            
            // 步骤1：将故障节点标记为不可用
            markNodeUnavailable(failedNodeId);
            
            // 步骤2：重新路由受影响流量
            rerouteAffectedTraffic(failedNodeId);
            
            // 步骤3：通知监控系统
            alertMonitoringSystem(failedNodeId);
            
            // 步骤4：启动自动恢复检查
            scheduleRecoveryCheck(failedNodeId);
        }
    }
    
    private void rerouteAffectedTraffic(String failedNodeId) {
        // 获取受影响的路由规则
        List<RoutingRule> affectedRules = routingRuleService.findRulesByNode(failedNodeId);
        
        for (RoutingRule rule : affectedRules) {
            // 寻找替代节点
            Optional<CdnNode> alternative = findAlternativeNode(rule, failedNodeId);
            
            if (alternative.isPresent()) {
                // 更新路由规则
                updateRoutingRule(rule, alternative.get());
                log.info("Rerouted traffic from {} to {}", 
                    failedNodeId, alternative.get().getId());
            } else {
                log.error("No alternative node found for rule: {}", rule.getId());
            }
        }
    }
    
    private Optional<CdnNode> findAlternativeNode(RoutingRule rule, String failedNodeId) {
        // 基于地理位置寻找最近节点
        List<CdnNode> candidates = nodeRepository.findByRegion(rule.getRegion());
        candidates = candidates.stream()
            .filter(node -> !node.getId().equals(failedNodeId))
            .filter(node -> healthCheckService.getNodeHealthStatus(node.getId()) 
                      == HealthStatus.HEALTHY)
            .collect(Collectors.toList());
        
        return schedulingService.selectOptimalNode(candidates, 
            rule.getResourcePattern(), rule.getUserLocation());
    }
    
    @Scheduled(fixedRate = 300000) // 每5分钟检查一次
    public void checkFailedNodesRecovery() {
        List<String> failedNodes = getCurrentlyFailedNodes();
        
        for (String nodeId : failedNodes) {
            HealthStatus status = healthCheckService.getNodeHealthStatus(nodeId);
            if (status == HealthStatus.HEALTHY) {
                log.info("Node {} has recovered, reintegrating into cluster", nodeId);
                reintegrateNode(nodeId);
            }
        }
    }
}

@Configuration
public class SchedulingMetricsConfig {
    
    @Bean
    public TimedAspect timedAspect(MeterRegistry registry) {
        return new TimedAspect(registry);
    }
    
    @Bean
    public MeterRegistryCustomizer<MeterRegistry> schedulingMetrics() {
        return registry -> {
            // 调度准确率指标
            Gauge.builder("scheduler.accuracy.rate")
                .description("调度准确率")
                .tag("type", "geographic")
                .register(registry);
            
            // 调度延迟指标
            Timer.builder("scheduler.response.time")
                .description("调度响应时间")
                .publishPercentiles(0.5, 0.95, 0.99)
                .register(registry);
            
            // 故障检测指标
            Counter.builder("scheduler.failure.detection")
                .description("故障检测次数")
                .tag("severity", "critical")
                .register(registry);
        };
    }
}

@Service
public class AlgorithmOptimizationService {
    
    private final A/BTestRunner abTestRunner;
    private final MetricsCollector metricsCollector;
    
    public void runSchedulingAlgorithmTest(String algorithmA, String algorithmB, 
                                         Duration testDuration) {
        ABTestConfig config = new ABTestConfig.Builder()
            .testName("scheduling-algorithm-comparison")
            .variantA(algorithmA)
            .variantB(algorithmB)
            .trafficSplit(0.5) // 50/50分流
            .duration(testDuration)
            .primaryMetric("user.experience.delay")
            .secondaryMetrics(Arrays.asList("cache.hit.rate", "origin.traffic.ratio"))
            .build();
        
        ABTestResult result = abTestRunner.runTest(config);
        
        if (result.isStatisticallySignificant()) {
            String winningAlgorithm = result.getWinningVariant();
            log.info("Algorithm test completed. Winner: {}", winningAlgorithm);
            
            // 部署获胜算法
            deployWinningAlgorithm(winningAlgorithm);
        }
    }
    
    public void continuouslyOptimizeWeights() {
        // 基于历史性能数据调整权重参数
        Map<String, Double> currentWeights = getCurrentWeightSettings();
        Map<String, Double> performanceCorrelations = 
            calculateWeightPerformanceCorrelation();
        
        Map<String, Double> optimizedWeights = optimizeWeights(
            currentWeights, performanceCorrelations);
        
        if (isImprovementSignificant(optimizedWeights)) {
            updateWeightSettings(optimizedWeights);
            log.info("Updated scheduling weights: {}", optimizedWeights);
        }
    }
}