全球化 SaaS 基础设施清单：域名、CDN、支付与监控

// ❌ 错误做法：所有服务指向同一 IP
// DNS 记录
// app.example.com  A  1.2.3.4
// api.example.com  A  1.2.3.4
// cdn.example.com  A  1.2.3.4
 
// ✅ 正确做法：按职责拆分域名，配合 CDN 和智能解析
// app.example.com  CNAME  cname.vercel-dns.com
// api.example.com  CNAME  api-lb-123456789.us-east-1.elb.amazonaws.com
// cdn.example.com  CNAME  cdn.cloudflare.net
// static.example.com  CNAME  r2.cloudflarestorage.com

// ❌ 错误做法：直接从服务器提供静态资源，没有 CDN 加速
app.get('/images/:id', async (req, res) => {
  const image = await fs.readFile(`./uploads/${req.params.id}`)
  res.set('Content-Type', 'image/jpeg')
  res.send(image)
})
 
// ✅ 正确做法：静态资源上传到对象存储，通过 CDN 分发
// 上传时直接写入 R2/S3，应用只生成签名 URL
import { S3Client, PutObjectCommand } from '@aws-sdk/client-s3'
import { getSignedUrl } from '@aws-sdk/s3-request-presigner'
 
const s3 = new S3Client({
  region: 'auto',
  endpoint: 'https://<account_id>.r2.cloudflarestorage.com',
  credentials: {
    accessKeyId: process.env.R2_ACCESS_KEY_ID,
    secretAccessKey: process.env.R2_SECRET_ACCESS_KEY,
  },
})
 
async function getUploadUrl(key: string) {
  const command = new PutObjectCommand({
    Bucket: 'my-saas-uploads',
    Key: key,
    ContentType: 'image/jpeg',
  })
  return getSignedUrl(s3, command, { expiresIn: 3600 })
}
 
// 前端直接上传到 R2，CDN 自动加速访问
// https://cdn.example.com/uploads/user-123/avatar.jpg

// ❌ 错误做法：所有区域直连同一个区域的数据库，跨洋延迟高
// 欧洲用户请求 API → US-East-1 API → US-East-1 DB → 响应延迟 150ms+
async function getUser(userId: string) {
  // 直接从主库读取，无论用户在哪个区域
  return db.query('SELECT * FROM users WHERE id = $1', [userId])
}
 
// ✅ 正确做法：读请求路由到就近的只读副本
// 欧洲用户请求 API → EU API → EU Replica DB → 响应延迟 20ms
import { Client } from 'pg'
 
async function getUser(userId: string, region: 'us' | 'eu' | 'ap') {
  const dbConfig = {
    us: { host: 'db-us.example.com', port: 5432 },
    eu: { host: 'db-eu.example.com', port: 5432 },
    ap: { host: 'db-ap.example.com', port: 5432 },
  }
 
  const client = new Client(dbConfig[region])
  await client.connect()
 
  try {
    // 读请求走就近副本
    const result = await client.query(
      'SELECT * FROM users WHERE id = $1',
      [userId]
    )
    return result.rows[0]
  } finally {
    await client.end()
  }
}
 
// 写请求始终路由到主库
async function updateUser(userId: string, data: Partial<User>) {
  const primaryClient = new Client({ host: 'db-us.example.com', port: 5432 })
  await primaryClient.connect()
  try {
    await primaryClient.query(
      'UPDATE users SET name = $1, updated_at = NOW() WHERE id = $2',
      [data.name, userId]
    )
  } finally {
    await primaryClient.end()
  }
}

// ❌ 错误做法：在 Webhook 处理器中同步执行耗时操作
app.post('/webhook/stripe', async (req, res) => {
  const event = req.body
 
  switch (event.type) {
    case 'checkout.session.completed':
      // 同步发送邮件 + 更新数据库 + 调用第三方 API
      await sendWelcomeEmail(event.data.object.customer_email) // 可能超时
      await updateSubscription(event.data.object) // 可能失败
      await notifySlack(event) // 可能超时
      break
  }
 
  res.json({ received: true })
})
 
// ✅ 正确做法：快速响应，耗时操作异步处理
import { Queue } from 'bullmq'
 
const webhookQueue = new Queue('stripe-webhooks', {
  connection: { host: 'redis.example.com', port: 6379 },
})
 
app.post('/webhook/stripe', async (req, res) => {
  // 1. 验证签名
  const sig = req.headers['stripe-signature']
  let event
  try {
    event = stripe.webhooks.constructEvent(
      req.rawBody,
      sig,
      process.env.STRIPE_WEBHOOK_SECRET
    )
  } catch (err) {
    console.error('Webhook signature verification failed')
    return res.status(400).json({ error: 'Invalid signature' })
  }
 
  // 2. 幂等性检查：检查是否已处理过这个事件
  const alreadyProcessed = await db.query(
    'SELECT 1 FROM processed_events WHERE event_id = $1',
    [event.id]
  )
  if (alreadyProcessed.rows.length > 0) {
    return res.json({ received: true })
  }
 
  // 3. 入队异步处理，快速返回 200
  await webhookQueue.add('process-event', {
    eventId: event.id,
    eventType: event.type,
    eventData: event.data.object,
  })
 
  res.json({ received: true })
})
 
// 4. 异步处理器：消费队列，处理实际业务逻辑
webhookQueue.process('process-event', async (job) => {
  const { eventId, eventType, eventData } = job.data
 
  try {
    switch (eventType) {
      case 'checkout.session.completed':
        await sendWelcomeEmail(eventData.customer_email)
        await updateSubscription(eventData)
        await notifySlack(eventData)
        break
      // ...
    }
 
    // 标记事件已处理
    await db.query(
      'INSERT INTO processed_events (event_id, processed_at) VALUES ($1, NOW())',
      [eventId]
    )
  } catch (err) {
    console.error(`Failed to process event ${eventId}:`, err)
    // 抛出异常，让 BullMQ 自动重试这个 job
    throw err
  }
})

# ❌ 错误做法：只配了 SPF，没配 DKIM 和 DMARC
# example.com DNS 记录
example.com.    TXT    "v=spf1 include:sendgrid.net ~all"
 
# ✅ 正确做法：SPF + DKIM + DMARC 三件套
# SPF 记录
example.com.    TXT    "v=spf1 include:sendgrid.net ~all"
mail.example.com. TXT  "v=spf1 include:sendgrid.net ~all"
 
# DKIM 记录（SendGrid 提供）
s1._domainkey.example.com.  CNAME  s1.domainkey.u1234567.wl.sendgrid.net
s2._domainkey.example.com.  CNAME  s2.domainkey.u1234567.wl.sendgrid.net
 
# DMARC 记录（先从 none 开始监控，逐步过渡到 quarantine/reject）
_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]; pct=100"

// ❌ 错误做法：日志没有结构化，没有请求 ID，难以追踪
console.log('User login failed')
console.log('Payment webhook received')
console.log('Database query slow')
 
// ✅ 正确做法：结构化日志 + 请求 ID 串联
import pino from 'pino'
 
const logger = pino({
  level: process.env.LOG_LEVEL || 'info',
  formatters: {
    level: (label) => ({ level: label }),
  },
})
 
// 中间件：为每个请求生成唯一 ID
app.use((req, res, next) => {
  const requestId = req.headers['x-request-id'] || crypto.randomUUID()
  req.requestId = requestId
  res.setHeader('x-request-id', requestId)
  next()
})
 
// 业务逻辑：携带上下文的结构化日志
app.post('/api/checkout', async (req, res) => {
  const { userId, amount } = req.body
  const requestId = req.requestId
 
  logger.info({
    event: 'checkout_started',
    requestId,
    userId,
    amount,
    currency: 'USD',
  })
 
  try {
    const session = await stripe.checkout.sessions.create({
      // ...
    })
 
    logger.info({
      event: 'checkout_session_created',
      requestId,
      userId,
      sessionId: session.id,
    })
 
    res.json({ sessionId: session.id })
  } catch (err) {
    logger.error({
      event: 'checkout_failed',
      requestId,
      userId,
      error: err.message,
      stack: err.stack,
    })
 
    res.status(500).json({ error: 'Checkout failed' })
  }
})

// ❌ 错误做法：所有用户数据都存储在同一个区域，违反 GDPR 数据驻留要求
// 假设数据库部署在 US-East-1，但服务欧盟用户
const dbConfig = {
  host: 'db-us-east-1.example.com', // 所有欧盟用户数据都在美国
  port: 5432,
  database: 'my_saas',
}
 
// ✅ 正确做法：根据用户所在地路由到对应区域的数据库
import { Client } from 'pg'
 
const dbConfigs = {
  eu: {
    host: 'db-eu-west-1.example.com', // 欧盟用户数据存储在欧盟
    port: 5432,
    database: 'my_saas_eu',
  },
  us: {
    host: 'db-us-east-1.example.com',
    port: 5432,
    database: 'my_saas_us',
  },
}
 
async function getDbClient(userRegion: 'eu' | 'us') {
  return new Client(dbConfigs[userRegion])
}
 
// 用户注册时，根据其所在地选择数据库
app.post('/api/register', async (req, res) => {
  const { email, country } = req.body
 
  // 根据 IP 或用户声明确定区域
  const region = isEUCountry(country) ? 'eu' : 'us'
 
  const client = await getDbClient(region)
  await client.connect()
 
  try {
    await client.query(
      'INSERT INTO users (email, country, region) VALUES ($1, $2, $3)',
      [email, country, region]
    )
    res.json({ success: true })
  } finally {
    await client.end()
  }
})