Cara Membangun API Gateway untuk Arsitektur Microservices Modern

Ketika aplikasi Anda mulai berkembang dan traffic meningkat drastis, arsitektur monolitik tradisional akan menunjukkan keterbatasannya. Di sinilah microservices menjadi solusi, dan API Gateway menjadi komponen krusial yang menghubungkan semua service tersebut.

API Gateway bukan sekadar reverse proxy biasa. Ia adalah pintu gerbang cerdas yang mengatur traffic, autentikasi, rate limiting, load balancing, dan transformasi data sebelum request mencapai service backend Anda.

Artikel ini akan membahas secara mendalam bagaimana membangun API Gateway yang robust, scalable, dan production-ready untuk arsitektur microservices modern.

Apa Itu API Gateway dan Mengapa Anda Membutuhkannya

API Gateway adalah single entry point yang menerima semua request dari client, kemudian meneruskannya ke service yang tepat di backend.

Bayangkan Anda memiliki 15 microservices berbeda untuk e-commerce: user service, product service, payment service, inventory service, notification service, dan lainnya. Tanpa API Gateway, aplikasi frontend Anda harus tahu endpoint dari 15 service tersebut.

Ini menciptakan masalah kompleksitas yang serius.

Dengan API Gateway, frontend hanya perlu berkomunikasi dengan satu endpoint. Gateway yang akan mengatur routing, autentikasi, dan orchestration ke berbagai service backend.

Keuntungan Menggunakan API Gateway

Pertama, API Gateway menyederhanakan arsitektur client-side. Frontend tidak perlu tahu detail implementasi backend dan tidak perlu mengelola multiple endpoints.

Kedua, security menjadi lebih terpusat. Anda bisa implement authentication, authorization, dan SSL termination di satu tempat instead of di setiap service.

Ketiga, monitoring dan logging menjadi lebih mudah. Semua traffic melewati satu titik, jadi Anda bisa track performance metrics, error rates, dan usage patterns dengan lebih efektif.

Keempat, API Gateway memungkinkan Anda melakukan request aggregation. Misalnya, untuk menampilkan product detail page, Anda perlu data dari product service, review service, dan inventory service. Gateway bisa melakukan parallel calls dan menggabungkan responsenya.

Komponen Inti API Gateway

Sebelum mulai membangun, penting memahami komponen fundamental yang harus ada di API Gateway Anda.

1. Request Routing

Ini adalah fungsi paling dasar. Gateway harus bisa meneruskan request ke service yang tepat berdasarkan path, HTTP method, atau header tertentu.

Contoh routing sederhana:

GET /api/users/* → User Service
GET /api/products/* → Product Service
POST /api/orders/* → Order Service
GET /api/payments/* → Payment Service

Routing juga harus support versioning API untuk backward compatibility:

GET /api/v1/products/* → Product Service V1
GET /api/v2/products/* → Product Service V2

2. Authentication & Authorization

Gateway harus memvalidasi setiap request sebelum meneruskannya ke backend service. Ini mencegah unauthorized access dan mengurangi beban security logic di setiap service.

Implementasi umum menggunakan JWT (JSON Web Token). Client mengirim token di header, Gateway memvalidasi signature dan claims, kemudian meneruskan user context ke downstream services.

Kesulitan dengan tugas programming atau butuh bantuan coding? KerjaKode siap membantu menyelesaikan tugas IT dan teknik informatika Anda. Dapatkan bantuan profesional di jasa tugas IT KerjaKode.

3. Rate Limiting

Tanpa rate limiting, satu client yang bermasalah bisa membanjiri sistem dengan request dan menyebabkan downtime untuk semua user.

Rate limiting membatasi jumlah request yang bisa dilakukan client dalam periode waktu tertentu. Misalnya, maksimal 100 request per menit per IP address atau per API key.

Ada beberapa algoritma rate limiting yang umum digunakan:

• Token Bucket: Setiap client punya "bucket" yang diisi token secara periodik. Setiap request mengkonsumsi token. Jika bucket kosong, request ditolak.
• Leaky Bucket: Request masuk ke queue dan diproses dengan rate konstan. Request yang melebihi kapasitas queue akan ditolak.
• Fixed Window: Membatasi request dalam time window tetap (misalnya per menit). Sederhana tapi bisa di-abuse di boundary antara window.
• Sliding Window: Lebih smooth dibanding fixed window, menghitung request dalam rolling time period.

4. Load Balancing

Untuk high availability, setiap service biasanya running di multiple instances. Gateway harus mendistribusikan traffic secara merata ke instance-instance tersebut.

Strategi load balancing yang umum:

• Round Robin: Request didistribusikan secara bergiliran ke setiap instance.
• Least Connections: Request dikirim ke instance dengan connection paling sedikit.
• Weighted Round Robin: Instance dengan kapasitas lebih besar mendapat weight lebih tinggi.
• IP Hash: Request dari IP yang sama selalu diarahkan ke instance yang sama (useful untuk session affinity).

5. Circuit Breaker

Ketika satu service down atau lambat, circuit breaker mencegah cascade failure dengan menghentikan sementara request ke service tersebut.

Circuit breaker punya tiga state: Closed (normal operation), Open (service unreachable, reject requests immediately), dan Half-Open (testing phase untuk check apakah service sudah recover).

Implementasi API Gateway dengan Node.js dan Express

Mari kita bangun API Gateway sederhana menggunakan Node.js. Kita akan implementasikan routing, authentication, dan rate limiting sebagai fondasi.

Setup Project

Pertama, buat project baru dan install dependencies:

mkdir api-gateway
cd api-gateway
npm init -y
npm install express http-proxy-middleware express-rate-limit jsonwebtoken dotenv helmet cors

Struktur Dasar Gateway

Buat file server.js sebagai entry point:

const express = require('express');
const helmet = require('helmet');
const cors = require('cors');
const rateLimit = require('express-rate-limit');
require('dotenv').config();

const app = express();
const PORT = process.env.PORT || 3000;

// Security middleware
app.use(helmet());
app.use(cors());
app.use(express.json());

// Global rate limiter
const limiter = rateLimit({
  windowMs: 60 * 1000, // 1 minute
  max: 100, // limit each IP to 100 requests per windowMs
  message: 'Too many requests from this IP, please try again later.'
});

app.use(limiter);

// Health check endpoint
app.get('/health', (req, res) => {
  res.json({ status: 'healthy', timestamp: new Date().toISOString() });
});

app.listen(PORT, () => {
  console.log(`API Gateway running on port ${PORT}`);
});

Implementasi Authentication Middleware

Buat file middleware/auth.js untuk handle JWT validation:

const jwt = require('jsonwebtoken');

const authenticateToken = (req, res, next) => {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1]; // Bearer TOKEN

  if (!token) {
    return res.status(401).json({ error: 'Access token required' });
  }

  jwt.verify(token, process.env.JWT_SECRET, (err, user) => {
    if (err) {
      return res.status(403).json({ error: 'Invalid or expired token' });
    }
    
    // Add user info to request object
    req.user = user;
    next();
  });
};

const optionalAuth = (req, res, next) => {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1];

  if (token) {
    jwt.verify(token, process.env.JWT_SECRET, (err, user) => {
      if (!err) {
        req.user = user;
      }
    });
  }
  
  next();
};

module.exports = { authenticateToken, optionalAuth };

Setup Service Registry dan Routing

Buat file config/services.js untuk define service endpoints:

const services = {
  user: {
    url: process.env.USER_SERVICE_URL || 'http://localhost:3001',
    protected: true
  },
  product: {
    url: process.env.PRODUCT_SERVICE_URL || 'http://localhost:3002',
    protected: false
  },
  order: {
    url: process.env.ORDER_SERVICE_URL || 'http://localhost:3003',
    protected: true
  },
  payment: {
    url: process.env.PAYMENT_SERVICE_URL || 'http://localhost:3004',
    protected: true
  }
};

module.exports = services;

Kemudian buat routing handler di routes/gateway.js:

const express = require('express');
const { createProxyMiddleware } = require('http-proxy-middleware');
const { authenticateToken, optionalAuth } = require('../middleware/auth');
const services = require('../config/services');

const router = express.Router();

// Setup proxy for each service
Object.keys(services).forEach(serviceName => {
  const service = services[serviceName];
  
  const proxyOptions = {
    target: service.url,
    changeOrigin: true,
    pathRewrite: {
      [`^/api/${serviceName}`]: '', // remove service prefix
    },
    onProxyReq: (proxyReq, req) => {
      // Forward user context to downstream services
      if (req.user) {
        proxyReq.setHeader('X-User-ID', req.user.id);
        proxyReq.setHeader('X-User-Role', req.user.role);
      }
    },
    onError: (err, req, res) => {
      console.error(`Error proxying to ${serviceName}:`, err.message);
      res.status(503).json({
        error: 'Service temporarily unavailable',
        service: serviceName
      });
    }
  };

  // Apply authentication middleware if service requires it
  const middleware = service.protected ? authenticateToken : optionalAuth;
  
  router.use(`/api/${serviceName}`, middleware, createProxyMiddleware(proxyOptions));
});

module.exports = router;

Integrasikan router ke server.js:

// ... previous code

const gatewayRouter = require('./routes/gateway');
app.use(gatewayRouter);

// ... rest of the code

Advanced Rate Limiting per Service

Untuk kontrol yang lebih granular, Anda bisa implement rate limiting berbeda untuk setiap service:

const rateLimit = require('express-rate-limit');

const createServiceLimiter = (maxRequests, windowMinutes = 1) => {
  return rateLimit({
    windowMs: windowMinutes * 60 * 1000,
    max: maxRequests,
    keyGenerator: (req) => {
      // Rate limit per user if authenticated, otherwise per IP
      return req.user ? `user:${req.user.id}` : `ip:${req.ip}`;
    },
    handler: (req, res) => {
      res.status(429).json({
        error: 'Rate limit exceeded',
        retryAfter: Math.ceil(req.rateLimit.resetTime / 1000)
      });
    }
  });
};

// Apply different limits to different services
router.use('/api/payment', createServiceLimiter(20, 1)); // 20 req/min
router.use('/api/order', createServiceLimiter(50, 1)); // 50 req/min
router.use('/api/product', createServiceLimiter(200, 1)); // 200 req/min

Implementasi Circuit Breaker Pattern

Circuit breaker melindungi sistem dari cascade failures. Kita bisa menggunakan library opossum untuk implementasi yang robust:

npm install opossum

Buat file middleware/circuitBreaker.js:

const CircuitBreaker = require('opossum');
const axios = require('axios');

const createBreaker = (serviceUrl, serviceName) => {
  const options = {
    timeout: 3000, // If function takes longer than 3 seconds, trigger a failure
    errorThresholdPercentage: 50, // When 50% of requests fail, open the circuit
    resetTimeout: 30000, // After 30 seconds, try again
    rollingCountTimeout: 10000, // 10 second rolling window for statistics
    rollingCountBuckets: 10,
    name: serviceName
  };

  const breaker = new CircuitBreaker(async (path, method, data) => {
    const config = {
      method,
      url: `${serviceUrl}${path}`,
      timeout: 3000
    };
    
    if (data) {
      config.data = data;
    }
    
    const response = await axios(config);
    return response.data;
  }, options);

  breaker.on('open', () => {
    console.warn(`Circuit breaker opened for ${serviceName}`);
  });

  breaker.on('halfOpen', () => {
    console.info(`Circuit breaker half-open for ${serviceName}`);
  });

  breaker.on('close', () => {
    console.info(`Circuit breaker closed for ${serviceName}`);
  });

  breaker.fallback(() => ({
    error: `Service ${serviceName} is currently unavailable`,
    fallback: true
  }));

  return breaker;
};

module.exports = { createBreaker };

Monitoring dan Logging

API Gateway harus memiliki observability yang baik untuk troubleshooting dan performance optimization.

Request Logging

Implementasikan structured logging menggunakan Winston atau Pino:

npm install pino pino-http

const pino = require('pino');
const pinoHttp = require('pino-http');

const logger = pino({
  level: process.env.LOG_LEVEL || 'info',
  transport: {
    target: 'pino-pretty',
    options: {
      colorize: true
    }
  }
});

const httpLogger = pinoHttp({
  logger,
  customLogLevel: (res, err) => {
    if (res.statusCode >= 400 && res.statusCode = 500 || err) {
      return 'error';
    }
    return 'info';
  },
  serializers: {
    req: (req) => ({
      id: req.id,
      method: req.method,
      url: req.url,
      userId: req.user?.id
    }),
    res: (res) => ({
      statusCode: res.statusCode
    })
  }
});

app.use(httpLogger);

Metrics Collection

Collect metrics seperti request count, response time, dan error rates menggunakan Prometheus client:

npm install prom-client

const client = require('prom-client');

// Create a Registry
const register = new client.Registry();

// Add default metrics
client.collectDefaultMetrics({ register });

// Custom metrics
const httpRequestDuration = new client.Histogram({
  name: 'http_request_duration_seconds',
  help: 'Duration of HTTP requests in seconds',
  labelNames: ['method', 'route', 'status_code'],
  registers: [register]
});

const httpRequestTotal = new client.Counter({
  name: 'http_requests_total',
  help: 'Total number of HTTP requests',
  labelNames: ['method', 'route', 'status_code'],
  registers: [register]
});

// Middleware to track metrics
app.use((req, res, next) => {
  const start = Date.now();
  
  res.on('finish', () => {
    const duration = (Date.now() - start) / 1000;
    const route = req.route?.path || req.path;
    
    httpRequestDuration.observe(
      { method: req.method, route, status_code: res.statusCode },
      duration
    );
    
    httpRequestTotal.inc({
      method: req.method,
      route,
      status_code: res.statusCode
    });
  });
  
  next();
});

// Expose metrics endpoint
app.get('/metrics', async (req, res) => {
  res.set('Content-Type', register.contentType);
  res.end(await register.metrics());
});

Caching Strategy untuk Performance

Caching di API Gateway level bisa dramatically meningkatkan response time dan mengurangi load di backend services.

Implementasi sederhana menggunakan Redis:

npm install redis

const redis = require('redis');
const client = redis.createClient({
  url: process.env.REDIS_URL || 'redis://localhost:6379'
});

client.connect();

const cacheMiddleware = (duration = 60) => {
  return async (req, res, next) => {
    // Only cache GET requests
    if (req.method !== 'GET') {
      return next();
    }

    const key = `cache:${req.originalUrl}`;
    
    try {
      const cachedResponse = await client.get(key);
      
      if (cachedResponse) {
        return res.json(JSON.parse(cachedResponse));
      }
      
      // Store original res.json
      const originalJson = res.json.bind(res);
      
      // Override res.json
      res.json = (data) => {
        // Cache the response
        client.setEx(key, duration, JSON.stringify(data));
        return originalJson(data);
      };
      
      next();
    } catch (err) {
      console.error('Cache error:', err);
      next();
    }
  };
};

// Apply caching to product routes
router.use('/api/product', cacheMiddleware(300)); // Cache for 5 minutes

Request Aggregation dan Composition

Salah satu benefit besar API Gateway adalah kemampuan untuk aggregate data dari multiple services dalam single request.

Contoh endpoint untuk mendapatkan product detail yang membutuhkan data dari 3 services berbeda:

router.get('/api/composite/product/:id', authenticateToken, async (req, res) => {
  const { id } = req.params;
  
  try {
    // Make parallel calls to multiple services
    const [productData, reviewData, inventoryData] = await Promise.all([
      axios.get(`${services.product.url}/products/${id}`),
      axios.get(`${services.review.url}/reviews/product/${id}`),
      axios.get(`${services.inventory.url}/stock/${id}`)
    ]);

    // Compose the response
    const compositeResponse = {
      product: productData.data,
      reviews: {
        average: reviewData.data.average,
        count: reviewData.data.count,
        items: reviewData.data.items.slice(0, 5) // Only top 5 reviews
      },
      inventory: {
        inStock: inventoryData.data.quantity > 0,
        quantity: inventoryData.data.quantity,
        warehouse: inventoryData.data.warehouse
      }
    };

    res.json(compositeResponse);
  } catch (error) {
    console.error('Composition error:', error.message);
    res.status(500).json({ error: 'Failed to fetch product details' });
  }
});

API Gateway dengan GraphQL

Untuk use case yang complex, GraphQL bisa menjadi alternatif powerful untuk REST API Gateway.

GraphQL memungkinkan client untuk specify exactly data apa yang mereka butuhkan, eliminating over-fetching dan under-fetching problems.

npm install apollo-server-express graphql

const { ApolloServer, gql } = require('apollo-server-express');

const typeDefs = gql`
  type Product {
    id: ID!
    name: String!
    price: Float!
    reviews: [Review!]!
    inventory: Inventory!
  }

  type Review {
    id: ID!
    rating: Int!
    comment: String!
    author: String!
  }

  type Inventory {
    inStock: Boolean!
    quantity: Int!
    warehouse: String!
  }

  type Query {
    product(id: ID!): Product
    products(limit: Int, offset: Int): [Product!]!
  }
`;

const resolvers = {
  Query: {
    product: async (_, { id }, context) => {
      const response = await axios.get(`${services.product.url}/products/${id}`);
      return response.data;
    },
    products: async (_, { limit = 10, offset = 0 }, context) => {
      const response = await axios.get(
        `${services.product.url}/products?limit=${limit}&offset=${offset}`
      );
      return response.data;
    }
  },
  Product: {
    reviews: async (product) => {
      const response = await axios.get(
        `${services.review.url}/reviews/product/${product.id}`
      );
      return response.data.items;
    },
    inventory: async (product) => {
      const response = await axios.get(
        `${services.inventory.url}/stock/${product.id}`
      );
      return response.data;
    }
  }
};

const server = new ApolloServer({
  typeDefs,
  resolvers,
  context: ({ req }) => ({
    user: req.user
  })
});

await server.start();
server.applyMiddleware({ app });

Security Best Practices

API Gateway adalah security perimeter pertama. Implementasi security yang proper sangat critical.

1. SSL/TLS Termination

Gateway harus handle HTTPS dan certificate management. Backend services bisa berkomunikasi via HTTP internal untuk performance, tapi client-to-gateway traffic must be encrypted.

2. Input Validation

Validate semua input di gateway level sebelum forwarding ke backend services:

const { body, validationResult } = require('express-validator');

router.post('/api/user/register',
  [
    body('email').isEmail().normalizeEmail(),
    body('password').isLength({ min: 8 }).matches(/^(?=.*[A-Za-z])(?=.*\d)/),
    body('name').trim().isLength({ min: 2, max: 50 })
  ],
  (req, res, next) => {
    const errors = validationResult(req);
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() });
    }
    next();
  },
  proxyToUserService
);

3. API Key Management

Untuk partner integrations, implement API key authentication sebagai alternative atau additional layer:

const validateApiKey = async (req, res, next) => {
  const apiKey = req.headers['x-api-key'];
  
  if (!apiKey) {
    return res.status(401).json({ error: 'API key required' });
  }
  
  // Check API key in database
  const keyData = await db.apiKeys.findOne({ key: apiKey, active: true });
  
  if (!keyData) {
    return res.status(403).json({ error: 'Invalid API key' });
  }
  
  // Track usage
  await db.apiKeys.incrementUsage(apiKey);
  
  req.apiKey = keyData;
  next();
};

4. CORS Configuration

Configure CORS properly untuk prevent unauthorized cross-origin requests:

const corsOptions = {
  origin: (origin, callback) => {
    const allowedOrigins = process.env.ALLOWED_ORIGINS.split(',');
    
    if (!origin || allowedOrigins.includes(origin)) {
      callback(null, true);
    } else {
      callback(new Error('Not allowed by CORS'));
    }
  },
  credentials: true,
  maxAge: 86400 // 24 hours
};

app.use(cors(corsOptions));

Deployment dan Scaling

API Gateway harus highly available dan bisa scale horizontally untuk handle increasing traffic.

Docker Containerization

Buat Dockerfile untuk containerization:

FROM node:18-alpine

WORKDIR /app

COPY package*.json ./
RUN npm ci --only=production

COPY . .

EXPOSE 3000

USER node

CMD ["node", "server.js"]

Kubernetes Deployment

Deploy dengan Kubernetes untuk auto-scaling dan high availability:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-gateway
spec:
  replicas: 3
  selector:
    matchLabels:
      app: api-gateway
  template:
    metadata:
      labels:
        app: api-gateway
    spec:
      containers:
      - name: api-gateway
        image: your-registry/api-gateway:latest
        ports:
        - containerPort: 3000
        env:
        - name: JWT_SECRET
          valueFrom:
            secretKeyRef:
              name: api-gateway-secrets
              key: jwt-secret
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        livenessProbe:
          httpGet:
            path: /health
            port: 3000
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /health
            port: 3000
          initialDelaySeconds: 5
          periodSeconds: 5
---
apiVersion: v1
kind: Service
metadata:
  name: api-gateway
spec:
  type: LoadBalancer
  ports:
  - port: 80
    targetPort: 3000
  selector:
    app: api-gateway
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: api-gateway-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: api-gateway
  minReplicas: 3
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70

Monitoring Production API Gateway

Setup comprehensive monitoring menggunakan Prometheus, Grafana, dan alert manager.

Key metrics yang harus di-track:

• Request rate per service
• Response time percentiles (p50, p95, p99)
• Error rate per endpoint
• Circuit breaker state changes
• Rate limit violations
• Backend service health status

Setup alerting untuk critical scenarios seperti high error rate, slow response time, atau service unavailability.

Kesimpulan

API Gateway adalah komponen krusial dalam arsitektur microservices modern. Gateway yang well-designed menyederhanakan client communication, meningkatkan security, dan memberikan flexibility untuk evolve backend architecture.

Implementasi yang proper mencakup routing, authentication, rate limiting, circuit breakers, monitoring, dan caching. Setiap komponen ini essential untuk production-grade gateway yang robust dan scalable.

Start dengan implementasi basic seperti routing dan authentication, kemudian gradually add advanced features seperti circuit breakers dan request aggregation sesuai kebutuhan sistem Anda.

Yang terpenting adalah maintain observability yang baik melalui logging dan metrics collection. Ini crucial untuk troubleshooting issues dan optimization efforts di production environment.