munisp · munisp · Jun 20, 2026 · Jun 20, 2026 · Jun 20, 2026
diff --git a/infra/apisix/apisix-high-throughput.yaml b/infra/apisix/apisix-high-throughput.yaml
@@ -0,0 +1,135 @@
+# ==============================================================================
+# APISIX Gateway — High-Throughput Configuration (Millions of req/sec)
+# Nginx-based: scales linearly with worker_processes
+# Target: 32 vCPU / 64 GB RAM
+# ==============================================================================
+
+apisix:
+  node_listen:
+    - port: 9080
+      enable_http2: true
+  ssl:
+    enable: true
+    listen:
+      - port: 9443
+        enable_http2: true
+    ssl_protocols: "TLSv1.2 TLSv1.3"
+    ssl_ciphers: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"
+
+  enable_control: true
+  control:
+    ip: "127.0.0.1"
+    port: 9090
+
+  # ── Performance — Core Settings ────────────────────────────────────────────
+  worker_processes: auto                    # 1 worker per CPU core
+  worker_shutdown_timeout: 240
+  max_pending_timers: 65536
+  max_running_timers: 16384
+
+  router:
+    http: radixtree_uri                     # Fastest route matching
+    ssl: radixtree_sni
+
+  # ── DNS Resolution ─────────────────────────────────────────────────────────
+  dns_resolver:
+    - "127.0.0.53"
+  dns_resolver_valid: 60                    # Cache DNS for 60s
+
+deployment:
+  role: traditional
+  role_traditional:
+    config_provider: etcd
+  etcd:
+    host:
+      - "http://etcd-1:2379"
+      - "http://etcd-2:2379"
+      - "http://etcd-3:2379"
+    prefix: "/apisix"
+    timeout: 30
+
+# ── Plugins (minimal set for throughput) ─────────────────────────────────────
+plugins:
+  - real-ip
+  - cors
+  - limit-req
+  - limit-count
+  - limit-conn
+  - api-breaker
+  - prometheus
+  - key-auth
+  - jwt-auth
+  - consumer-restriction
+  - request-id
+  - proxy-rewrite
+  - response-rewrite
+  - redirect
+  - traffic-split
+  - grpc-transcode
+  - grpc-web
+  - ip-restriction
+
+# ── Plugin Attributes ────────────────────────────────────────────────────────
+plugin_attr:
+  prometheus:
+    export_addr:
+      ip: "0.0.0.0"
+      port: 9091
+    metric_prefix: apisix_
+  limit-req:
+    rate: 10000                              # 10K req/s per key (high-throughput)
+    burst: 5000
+    rejected_code: 429
+    key: remote_addr
+  api-breaker:
+    break_response_code: 502
+    max_breaker_sec: 60
+    unhealthy:
+      http_statuses: [500, 502, 503]
+      failures: 5
+    healthy:
+      http_statuses: [200]
+      successes: 3
+
+# ── Nginx HTTP — High-Performance Tuning ─────────────────────────────────────
+nginx_config:
+  error_log_level: error                     # Minimal logging
+  worker_connections: 65536                  # Max connections per worker
+  worker_rlimit_nofile: 131072               # File descriptor limit
+  http:
+    sendfile: "on"
+    tcp_nopush: "on"
+    tcp_nodelay: "on"
+    keepalive_timeout: 75
+    keepalive_requests: 10000                # Reuse connections aggressively
+    client_header_timeout: 15
+    client_body_timeout: 30
+    send_timeout: 30
+    client_max_body_size: "50m"
+    proxy_connect_timeout: 5
+    proxy_read_timeout: 30
+    proxy_send_timeout: 30
+    proxy_buffering: "on"
+    proxy_buffer_size: "16k"
+    proxy_buffers: "8 32k"
+    proxy_busy_buffers_size: "64k"
+
+    # ── Upstream Connection Pooling ──────────────────────────────────────────
+    upstream:
+      keepalive: 320                         # Keep 320 connections per upstream
+      keepalive_timeout: 60
+      keepalive_requests: 10000
+
+    # ── Gzip Compression ─────────────────────────────────────────────────────
+    gzip: "on"
+    gzip_min_length: 256
+    gzip_comp_level: 4
+    gzip_types: "application/json application/javascript text/css text/plain text/xml application/xml"
+
+    # ── Access Log — Buffered for Performance ────────────────────────────────
+    access_log_format: '{"@timestamp":"$time_iso8601","remote_addr":"$remote_addr","status":$status,"request_time":$request_time,"upstream_response_time":"$upstream_response_time"}'
+    access_log_format_escape: json
+
+  # ── Main Process ───────────────────────────────────────────────────────────
+  main:
+    worker_rlimit_core: "500M"
diff --git a/infra/dapr/dapr-high-throughput.yaml b/infra/dapr/dapr-high-throughput.yaml
@@ -0,0 +1,185 @@
+# ==============================================================================
+# Dapr — High-Throughput Configuration (Millions of msg/sec)
+# Pipeline mode + bulk publish + optimized components
+# ==============================================================================
+
+apiVersion: dapr.io/v1alpha1
+kind: Configuration
+metadata:
+  name: 54link-dapr-high-throughput
+  namespace: default
+spec:
+  # ── Tracing — Reduced sampling for throughput ──────────────────────────────
+  tracing:
+    samplingRate: "0.01"                     # 1% sampling in high-throughput mode
+    otel:
+      endpointAddress: "otel-collector:4317"
+      isSecure: false
+      protocol: grpc
+
+  # ── Metrics ────────────────────────────────────────────────────────────────
+  metric:
+    enabled: true
+    rules:
+      - name: "dapr_*"
+        labels:
+          - name: "method"
+            regex:
+              "GET": "GET"
+              "POST": "POST"
+          - name: "path"
+            allowList:
+              - "/v1.0/publish/*"
+              - "/v1.0/state/*"
+              - "/v1.0/invoke/*"
+
+  # ── API Access Control ────────────────────────────────────────────────────
+  api:
+    allowed:
+      - name: invoke
+        version: v1
+        protocol: grpc                       # gRPC is faster than HTTP
+      - name: state
+        version: v1
+        protocol: grpc
+      - name: pubsub
+        version: v1
+        protocol: grpc
+      - name: secrets
+        version: v1
+      - name: actors
+        version: v1
+      - name: bindings
+        version: v1
+
+  # ── App Channel ────────────────────────────────────────────────────────────
+  appHttpPipeline:
+    handlers:
+      - name: uppercase
+        type: middleware.http.uppercase
+  httpPipeline:
+    handlers: []
+
+  # ── Features ───────────────────────────────────────────────────────────────
+  features:
+    - name: Actor.TypeMetadata
+      enabled: true
+    - name: PubSub.BulkPublish                # Bulk publish support
+      enabled: true
+    - name: PubSub.BulkSubscribe              # Bulk subscribe support
+      enabled: true
+
+  # ── Logging ────────────────────────────────────────────────────────────────
+  logging:
+    apiLogging:
+      enabled: false                          # Disable API logging for throughput
+      obfuscateURLs: true
+      omitHealthChecks: true
+
+---
+# ── Kafka PubSub — High-Throughput ───────────────────────────────────────────
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: 54link-pubsub-ht
+  namespace: default
+spec:
+  type: pubsub.kafka
+  version: v1
+  metadata:
+    - name: brokers
+      value: "kafka-1:9092,kafka-2:9092,kafka-3:9092,kafka-4:9092,kafka-5:9092"
+    - name: consumerGroup
+      value: "54link-dapr-ht"
+    - name: authRequired
+      value: "false"
+    - name: maxMessageBytes
+      value: "10485760"                       # 10 MB
+    - name: consumeRetryInterval
+      value: "100ms"
+    - name: version
+      value: "3.0.0"
+    - name: clientID
+      value: "54link-dapr-ht"
+    # ── Producer Tuning ──────────────────────────────────────────────────────
+    - name: producerRequiredAcks
+      value: "1"                              # Leader ack only for throughput
+    - name: producerBatchMaxMessages
+      value: "10000"                          # Batch up to 10K messages
+    - name: producerBatchMaxBytes
+      value: "16777216"                       # 16 MB batch
+    - name: producerFlushMaxMessages
+      value: "10000"
+    - name: producerFlushFrequencyMs
+      value: "10"                             # Flush every 10ms
+    - name: producerCompressionType
+      value: "zstd"
+    # ── Consumer Tuning ──────────────────────────────────────────────────────
+    - name: consumerFetchDefault
+      value: "10485760"                       # 10 MB default fetch
+    - name: consumerFetchMin
+      value: "1048576"                        # 1 MB min fetch
+    - name: channelBufferSize
+      value: "10000"                          # Internal channel buffer
+    - name: consumeRetryEnabled
+      value: "true"
+    - name: consumeRetryInterval
+      value: "200ms"
+
+---
+# ── Redis State Store — High-Throughput ──────────────────────────────────────
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: 54link-statestore-ht
+  namespace: default
+spec:
+  type: state.redis
+  version: v1
+  metadata:
+    - name: redisHost
+      value: "redis-cluster:6379"
+    - name: redisPassword
+      secretKeyRef:
+        name: redis-secret
+        key: password
+    - name: actorStateStore
+      value: "true"
+    - name: enableTLS
+      value: "false"
+    - name: maxRetries
+      value: "3"
+    - name: maxRetryBackoff
+      value: "500ms"
+    - name: ttlInSeconds
+      value: "86400"
+    - name: queryIndexes
+      value: |
+        [
+          { "name": "agentId", "type": "TEXT" },
+          { "name": "status", "type": "TAG" },
+          { "name": "timestamp", "type": "NUMERIC" }
+        ]
+    # ── Pipeline Mode ────────────────────────────────────────────────────────
+    - name: processingTimeout
+      value: "15s"
+    - name: redeliverInterval
+      value: "10s"
+    - name: concurrency
+      value: "parallel"                       # Parallel state operations
+    - name: redisDB
+      value: "0"
+    - name: redisMaxRetries
+      value: "5"
+    - name: redisMinRetryInterval
+      value: "8ms"
+    - name: dialTimeout
+      value: "5s"
+    - name: readTimeout
+      value: "5s"
+    - name: writeTimeout
+      value: "5s"
+    - name: poolSize
+      value: "200"                            # Large connection pool
+    - name: minIdleConns
+      value: "50"
diff --git a/infra/dapr/ha/dapr-ha-config.yaml b/infra/dapr/ha/dapr-ha-config.yaml
@@ -13,11 +13,13 @@ spec:
     workloadCertTTL: "24h"
     allowedClockSkew: "15m"
 
-  # ── Tracing ─────────────────────────────────────────────────────────────────
+  # ── Tracing (reduced sampling for high throughput) ───────────────────────────
   tracing:
-    samplingRate: "0.1"
-    zipkin:
-      endpointAddress: "http://zipkin:9411/api/v2/spans"
+    samplingRate: "0.01"                 # 1% sampling for millions of TPS
+    otel:
+      endpointAddress: "otel-collector:4317"
+      isSecure: false
+      protocol: grpc                     # gRPC is faster than HTTP for traces
 
   # ── Metrics ─────────────────────────────────────────────────────────────────
   metric:
@@ -53,24 +55,33 @@ spec:
         trustDomain: "pos54.local"
         namespace: "production"
 
-  # ── API ─────────────────────────────────────────────────────────────────────
+  # ── Features (high-throughput bulk operations) ──────────────────────────────
+  features:
+    - name: PubSub.BulkPublish
+      enabled: true
+    - name: PubSub.BulkSubscribe
+      enabled: true
+    - name: Actor.TypeMetadata
+      enabled: true
+
+  # ── API (gRPC for throughput) ──────────────────────────────────────────────
   api:
     allowed:
       - name: state
         version: v1.0
-        protocol: http
+        protocol: grpc
       - name: publish
         version: v1.0
-        protocol: http
+        protocol: grpc
       - name: bindings
         version: v1.0
-        protocol: http
+        protocol: grpc
       - name: invoke
         version: v1.0
-        protocol: http
+        protocol: grpc
       - name: secrets
         version: v1.0
-        protocol: http
+        protocol: grpc
 
 ---
 ###############################################################################