🌐 使用 Cloudflare Workers 实现全球智能分流 —— 海内外访问加速实践

大陆用户 → star.divinations.top (大阪 VPS) → Cloudflare Origin

之前的架构（所有流量都经过大阪）：

                    star.divinations.top
                            ↓
                   DNS 解析到大阪 VPS IP
                            ↓
                 ┌──────────────────────┐
                 │    大阪 VPS (nginx)   │ ← 所有用户都经过这里
                 └──────────────────────┘
                            ↓
                 star-origin.divinations.top
                            ↓
                    Cloudflare Pages

                         用户访问
                            ↓
                   star.divinations.top
                            ↓
                  ┌─────────────────────┐
                  │  Cloudflare Workers │  ← 在边缘节点判断地区
                  │    (Geo Router)     │
                  └─────────────────────┘
                            ↓
              ┌─────────────┴─────────────┐
              ↓                           ↓
         CN/HK/MO 用户                  其他地区
              ↓                           ↓
    osaka.divinations.top      star-origin.divinations.top
              ↓                           ↓
         大阪 VPS (nginx)           Cloudflare 直连
              ↓
    star-origin.divinations.top
              ↓
        Cloudflare Pages

const country = request.cf?.country  // "CN", "US", "JP", etc.

workers/
├── geo-router-web/
│   ├── wrangler.toml
│   └── src/index.ts
└── geo-router-api/
    ├── wrangler.toml
    └── src/index.ts

/**
 * Geo Router for Web (star.divinations.top)
 * 
 * 根据用户地理位置路由请求：
 * - 大陆用户 → 大阪 VPS → CF Pages
 * - 海外用户 → CF Pages 直连
 */

// 大陆用户走大阪 VPS 中转
const CN_BACKEND = 'https://osaka.divinations.top'
// 海外用户直连 Cloudflare Pages
const GLOBAL_BACKEND = 'https://star-origin.divinations.top'

// 需要走大阪中转的国家/地区代码
const CN_REGIONS = new Set(['CN', 'HK', 'MO'])

export default {
  async fetch(request: Request): Promise<Response> {
    try {
      const cf = request.cf as { country?: string; colo?: string } | undefined
      const country = cf?.country || 'US'
      const colo = cf?.colo || 'unknown'
      const isCN = CN_REGIONS.has(country)

      const backend = isCN ? CN_BACKEND : GLOBAL_BACKEND
      const targetUrl = new URL(request.url)
      targetUrl.hostname = new URL(backend).hostname
      targetUrl.protocol = 'https:'

      // 构建新请求，保留原始 headers
      const headers = new Headers(request.headers)
      headers.set('X-Real-IP', headers.get('CF-Connecting-IP') || '')
      headers.set('X-Forwarded-For', headers.get('CF-Connecting-IP') || '')
      headers.set('X-Forwarded-Proto', 'https')

      const response = await fetch(targetUrl.toString(), {
        method: request.method,
        headers,
        body: request.body,
        redirect: 'follow',
      })

      // 添加调试 headers
      const newHeaders = new Headers(response.headers)
      newHeaders.set('X-Geo-Route', isCN ? 'cn-osaka' : 'global-cf')
      newHeaders.set('X-Geo-Country', country)
      newHeaders.set('X-Geo-Colo', colo)

      return new Response(response.body, {
        status: response.status,
        statusText: response.statusText,
        headers: newHeaders,
      })
    } catch (error) {
      // 发生错误时降级到全球后端
      console.error('Geo router error:', error)
      
      const targetUrl = new URL(request.url)
      targetUrl.hostname = new URL(GLOBAL_BACKEND).hostname

      return fetch(targetUrl.toString(), {
        method: request.method,
        headers: request.headers,
        body: request.body,
      })
    }
  },
}

# /etc/nginx/sites-available/starflix-geo.conf

server {
    listen 80;
    server_name osaka.divinations.top;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name osaka.divinations.top;

    # SSL 证书 (Let's Encrypt)
    ssl_certificate /etc/letsencrypt/live/osaka.divinations.top/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/osaka.divinations.top/privkey.pem;
    
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;

    location / {
        # ⭐ 关键：动态 DNS 解析
        resolver 1.1.1.1 8.8.8.8 valid=300s ipv6=off;
        resolver_timeout 5s;

        proxy_pass https://star-origin.divinations.top;
        proxy_set_header Host star-origin.divinations.top;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # ⭐ 核心：SNI 设置
        proxy_ssl_server_name on;
        proxy_ssl_name star-origin.divinations.top;
        proxy_ssl_verify off;
        
        proxy_connect_timeout 10s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
        
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location /health {
        return 200 'OK';
        add_header Content-Type text/plain;
    }
}

# 获取 SSL 证书
sudo certbot certonly --nginx -d osaka.divinations.top -d osaka-api.divinations.top

# 启用配置
sudo ln -sf /etc/nginx/sites-available/starflix-geo.conf /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

# 部署 Web Router
pnpm wrangler deploy workers/geo-router-web/src/index.ts --name star-geo-router-web

# 部署 API Router
pnpm wrangler deploy workers/geo-router-api/src/index.ts --name star-geo-router-api

# 从不同地区测试
curl -I https://star.divinations.top 2>&1 | grep -i x-geo

# 预期输出（大陆）：
X-Geo-Route: cn-osaka
X-Geo-Country: CN
X-Geo-Colo: HKG

# 预期输出（海外）：
X-Geo-Route: global-cf
X-Geo-Country: US
X-Geo-Colo: SJC

# 只有大陆用户的请求会出现在日志中
sudo tail -f /var/log/nginx/osaka-web-access.log