feat: 完善服务监控与下游重投

api/src/main.ts

@@ -1,8 +1,10 @@
 import 'reflect-metadata';
 import { NestFactory } from '@nestjs/core';
+import { createServer } from 'node:http';
 import type { NestExpressApplication } from '@nestjs/platform-express';
 import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
 import { AppModule } from './app.module';
+import { MetricsService } from './metrics/metrics.service';
 import { OpenApiModule } from './open-api/open-api.module';
 import { configureHttpBodyParsers } from './http-body-limits';
 
@@ -39,7 +41,26 @@ async function bootstrap() {
   SwaggerModule.setup('api/client-docs', app, clientDocument);
 
   const port = Number(process.env.API_PORT ?? 3000);
-  await app.listen(port);
+  // 生产环境只允许 Nginx 访问管理 API；显式绑定回环，避免默认的全网卡监听绕过入口鉴权与限流。
+  const host = process.env.API_HOST?.trim() || '127.0.0.1';
+  await app.listen(port, host);
+
+  const metrics = app.get(MetricsService);
+  const metricsHost = process.env.API_METRICS_HOST?.trim() || '127.0.0.1';
+  const metricsPort = Number(process.env.API_METRICS_PORT ?? 9464);
+  const metricsServer = createServer((request, response) => {
+    if (request.method !== 'GET' || request.url !== '/metrics') {
+      response.writeHead(404).end();
+      return;
+    }
+    response.writeHead(200, { 'Content-Type': 'text/plain; version=0.0.4; charset=utf-8', 'Cache-Control': 'no-store' });
+    response.end(metrics.render());
+  });
+  // Metrics use a dedicated loopback listener so Nginx cannot accidentally expose them through /api/.
+  await new Promise<void>((resolve, reject) => {
+    metricsServer.once('error', reject);
+    metricsServer.listen(metricsPort, metricsHost, resolve);
+  });
 }
 
 void bootstrap();