9.8-bob: API Gateway va service discovery

  GATEWAYSIZ (mijoz har xizmatga to'g'ridan):
  Mijoz ── User Service (auth? CORS? rate limit?)
       ├── Order Service (auth TAKROR? CORS TAKROR?)
       ├── Product Service (...)
       └── Payment Service (ichki tuzilma OSHKOR — xavfsizlik!)
   Har xizmatda auth/CORS/rate limit takror; mijoz tuzilmani biladi;
     ko'p endpoint; ichki o'zgarish mijozni buzadi

  GATEWAY BILAN (yagona eshik):
  Mijoz ── API Gateway ── kerakli xizmat
            (auth, rate limit, routing, CORS — BIR JOYDA)
   Markazlashgan; mijoz tuzilmani bilmaydi; bitta endpoint

  API GATEWAY NIMA QILADI (cross-cutting concerns):
   Routing — so'rovni kerakli xizmatga yo'naltirish (/users  User Svc)
   Autentifikatsiya — token tekshirish (8.9 — bir joyda, har xizmatda emas)
   Rate limiting — so'rov cheklash (5.20, 8.16 — DoS himoyasi)
   Request aggregation — bir necha xizmatdan ma'lumot yig'ish 2.4-bob
   CORS, SSL termination (HTTPS — bir joyda)
   Logging/monitoring (markazlashgan kuzatuv — 10)
   Caching (umumiy javoblar — 8.15)
   Request/response transformatsiya (format moslashtirish)
   Load balancing (xizmat nusxalariga taqsimlash)

  GATEWAY VOSITALARI:
  - Tayyor: Kong, Nginx, Traefik, AWS API Gateway, Apache APISIX
     ishlab chiqarish-tayyor (auth, rate limit plugin'lar)
  - Maxsus (custom): NestJS Gateway 8.16-bob — to'liq nazorat
  - Service Mesh (Istio/Linkerd): xizmatlararo (sidecar — 2.6)

   Oddiy: tayyor (Kong/Nginx); maxsus mantiq: custom (NestJS);
    juda katta: service mesh (qo'shimcha)

  AGGREGATION — bir so'rovga bir necha xizmatdan ma'lumot:

  Mijoz: "buyurtma sahifasi" (1 so'rov)
   Gateway:
      ├ Order Service (buyurtma)
      ├ User Service (mijoz)
      └ Product Service (mahsulotlar)
   birlashtirilgan javob (mijoz 1 so'rov yubordi, Gateway 3 ta qildi)

   Mijoz 1 so'rov (under-fetching yo'q — mobil uchun muhim)
   Gateway murakkablashadi (yoki BFF — 2.5; yoki GraphQL — 8.17)

  BFF — har MIJOZ TURI uchun maxsus Gateway:

  Mobil ilova ── Mobil BFF (ixcham javob — bandwidth/kichik ekran)
  Veb sayt   ── Veb BFF (boy ma'lumot — desktop)
  Admin panel── Admin BFF (ko'proq ruxsat, batafsil)
                     │
                     ▼ (har BFF ichki xizmatlarga)
                User, Order, Product Services

   Har mijoz o'z ehtiyojiga mos javob (mobil — kam; veb — ko'p)
   Mijoz mantig'i BFF'da (frontend jamoasi boshqaradi)
   Bir umumiy Gateway hammaga mos kelmaganda (mobil ≠ veb)

  API GATEWAY — "North-South" (tashqi  ichki):
  Mijoz (tashqi)  Gateway  xizmatlar
   auth, rate limit, routing (tashqi so'rovlar)

  SERVICE MESH — "East-West" (xizmat  xizmat — ichki):
  Xizmat A  [sidecar proxy]  Xizmat B (har xizmat yonida proxy)
   ichki aloqa: retry, circuit breaker 9.6-bob, mTLS, tracing
   Istio, Linkerd (Kubernetes — 10)

   Ular RAQOBATCHI EMAS — birga (Gateway tashqi, Mesh ichki)
   Kichik tizim: faqat Gateway; katta: Gateway + Mesh

  MUAMMO: xizmatlar IP'si DOIM O'ZGARADI (dinamik muhit):
  - Kubernetes har deploy'da yangi IP (10)
  - Auto-scaling — yangi nusxalar qo'shiladi/o'chadi
  - Xizmat ko'chadi (boshqa server)

   Hardcode IP (http://192.168.1.5:3001) — deploy'da buziladi!

  SERVICE DISCOVERY — xizmatlar bir-birini DINAMIK topadi:
  - Service registry — "kim qayerda" jadvali (doim yangi)
  - Xizmat ro'yxatdan o'tadi (register); boshqalar topadi (discover)

  CLIENT-SIDE DISCOVERY:
  Xizmat A  registry'dan B manzilini SO'RAYDI  to'g'ridan B'ga
   Kam tarmoq sakrash;  har xizmat discovery mantig'i (klient)

  SERVER-SIDE DISCOVERY:
  Xizmat A  load balancer/Gateway  registry  B
   Klient oddiy (discovery — infra ishi);  qo'shimcha sakrash
   Kubernetes Service (DNS) — server-side (eng keng, oson)

   Kubernetes'da: Service DNS (order-service:3001) — discovery avtomatik
   IP o'zgaradi, lekin DNS nomi barqaror (Kubernetes hal qiladi)

  SERVICE REGISTRY — "kim qayerda" markaziy jadvali:
  - Consul (HashiCorp): registry + health + KV + DNS
  - Eureka (Netflix): Java dunyosi (Spring)
  - Kubernetes: built-in (Service + DNS — eng keng — 10)
  - etcd, Zookeeper: pastroq daraja

  ISH JARAYONI:
  1. Xizmat ishga tushadi  registry'ga REGISTER (men shu manzilda)
  2. Health check — registry sog'lom xizmatlarni biladi 2.10-bob
  3. Boshqa xizmat  registry'dan SO'RAYDI (B qayerda?)
  4. Xizmat o'chsa  registry'dan chiqariladi (deregister)

   Kubernetes ishlatayotgan bo'lsangiz — built-in (qo'shimcha registry kerak emas)

  HEALTH CHECK — xizmat "tirik va sog'lom"mi (registry/load balancer uchun):
  - /health endpoint 8.15-bob — xizmat javob beradimi
  - Liveness: tirikmi (yiqilsa — qayta ishga tushirish)
  - Readiness: so'rov qabul qilishga tayyormi (DB ulanganmi, warm-up)

   Registry/Gateway faqat SOG'LOM xizmatlarga yo'naltiradi
   Kasal xizmat — chiqariladi (so'rov yuborilmaydi — circuit breaker — 9.6)

  Kubernetes: livenessProbe + readinessProbe (avtomatik — 10)

   Auth Gateway'da (token tekshirish — 8.9 — bir joyda — 2.2)
   Rate limiting (DoS himoyasi — 5.20, 8.16)
   SSL/TLS termination (HTTPS — Gateway'da)
   Ichki xizmatlar tashqaridan YOPIQ (faqat Gateway orqali)
   Gateway — single point of failure  HA (ko'p nusxa, load balancer)
   Request validation (Gateway'da — ichki xizmatga toza)
   Monitoring/tracing (markazlashgan — barcha so'rov o'tadi — 10)
   Gateway yiqilsa — hammasi yiqiladi  yuqori mavjudlik (HA) majburiy

  GATEWAY:
   Yagona kirish (auth/rate limit/routing markazlashgan — 2.1, 2.2)
   Tayyor vosita (Kong/Nginx) yoki custom (NestJS) — ehtiyojga 2.3-bob
   BFF (ko'p mijoz turi — 2.5); aggregation (kam so'rov — 2.4)
   Ichki xizmatlar yopiq (faqat Gateway — 2.11)
   HA (single point of failure — ko'p nusxa — 2.11)

  DISCOVERY:
   Hardcode IP'dan qoch (dinamik discovery — 2.7)
   Kubernetes Service DNS (built-in — eng oson — 2.8, 2.9)
   Health check (sog'lom xizmat — 2.10)
   Consul/Eureka (Kubernetes'siz — 2.9)

  PROTOKOL TARJIMASI — Gateway tashqi va ichki protokolni "tarjima" qiladi:

  Mijoz (brauzer/mobil) ── REST/JSON (HTTP/1.1) ── Gateway
                                                      │ ichki: gRPC/Protobuf 9.6-bob
                                                      ▼
                                              User, Order Services (gRPC)

   Tashqi: REST/JSON (brauzer tushunadi, oddiy, universal)
   Ichki: gRPC (tez, binar, tiplangan — xizmatlararo — 9.6)
   Gateway JSON'ni Protobuf'ga (va aksincha) tarjima qiladi

  TRANSFORMATSIYA — so'rov/javob shaklini o'zgartirish:
  - Request: header qo'shish (X-User-Id — auth'dan), yo'l qayta yozish
    (/v1/users  /users), body normallashtirish
  - Response: ichki maydonlarni yashirish (parol_hash, internal_id),
    format moslashtirish (mobil uchun soddalashtirish — BFF 2.5)

  LOAD BALANCING — so'rovni bir necha xizmat NUSXASIGA taqsimlash:

  Gateway/LB ──┬── Order Svc #1
               ├── Order Svc #2   (3 nusxa — yuk bo'linadi)
               └── Order Svc #3

  ALGORITMLAR:
  - Round-robin: navbat bilan (#1, #2, #3, #1... — eng oddiy, teng)
  - Least-connections: eng kam faol ulanishga (nomutanosib yuk uchun)
  - Weighted: og'irlik bilan (kuchli server #1  2x, kuchsiz #3  1x)
  - IP-hash: bir mijoz IP  doim bir nusxa (sticky — sessiya uchun)
  - Random: tasodifiy (oddiy, katta miqyosda teng taqsimlanadi)

   Sog'lom nusxalarga (health check 2.10) — kasal chiqariladi
   Caching/sessiya bilan bog'liq (IP-hash — 9.9 load balancing chuqur)

  RO'YXATDAN O'TISH (registration) — kim registry'ga yozadi:

  SELF-REGISTRATION — xizmat O'ZI yozadi:
  Xizmat ishga tushadi  registry'ga o'zini register (Consul kliyent — 2.9)
   Oddiy (tashqi komponent kerak emas)
   Xizmatga discovery mantig'i "aralashadi" (kod ichida register/deregister)

  THIRD-PARTY REGISTRATION — TASHQI komponent yozadi (registrar):
  Registrar (orkestrator) xizmatni kuzatadi  registry'ga yozadi/o'chiradi
   Xizmat "toza" (discovery bilmaydi — biznes mantiqqa e'tibor)
   Qo'shimcha komponent (lekin Kubernetes buni O'ZI qiladi)
   Kubernetes: pod ishga tushsa, Service/endpoint AVTOMATIK (3rd-party)

  DNS-BASED DISCOVERY — registry DNS orqali:
  Xizmat B'ni topish = DNS so'rov (order-service  IP)
   Universal (har til DNS'ni biladi — maxsus kliyent kerak emas)
   Kubernetes kube-dns, Consul DNS interfeysi (2.8)

  KUBERNETES DISCOVERY (built-in — qo'shimcha registry kerak emas):

  1. Deployment  Pod'lar (har biri o'z IP'si, o'zgaruvchan)
  2. Service  Pod'lar oldida BARQAROR nom + ClusterIP:
       apiVersion: v1
       kind: Service
       metadata: { name: order-service }
       spec:
         selector: { app: order }        # shu yorliqli pod'lar
         ports: [{ port: 3002 }]
  3. kube-dns/CoreDNS  "order-service" nomini ClusterIP'ga hal qiladi
  4. Boshqa xizmat: http://order-service:3002 (nom barqaror — IP emas)

   Service = registry + load balancer + DNS (hammasi bitta)
   Pod o'lsa/scale bo'lsa — Service endpoint'ni avtomatik yangilaydi
   To'liq: 10-QISM (Kubernetes)

  TLS (bir tomonlama) — SERVER o'zini isbotlaydi (HTTPS):
  Mijoz  [TLS]  Gateway (sertifikat: "men haqiqiy gateway")
   Gateway'da SSL termination: HTTPS shu yerda tugaydi 2.11-bob

  mTLS (o'zaro TLS) — IKKALA tomon isbotlaydi (ichki xizmatlararo):
  Xizmat A  [mTLS]  Xizmat B (ikkalasi ham sertifikat ko'rsatadi)
   "Zero trust" — ichki tarmoqda ham ishonch yo'q (2.6 service mesh)
   Istio/Linkerd mTLS'ni AVTOMATIK beradi (sidecar — 2.6)

  ANTI-PATTERN'LAR (Gateway'da QILMANG):
   Biznes mantiq Gateway'da (narx hisoblash, buyurtma qoidasi)
      Gateway faqat yo'naltiradi; biznes mantiq XIZMATDA (9.1, 9.5)
   Bitta ulkan Gateway (God object) — hamma narsa unda
   Gateway'ni SPOF qilib qoldirish (HA'siz — 2.11)
   Har o'zgarishda Gateway'ni deploy (mahkam bog'lanish)

GATEWAY 2.2-bob: routing + auth + rate limit + aggregation + CORS (markaziy)
BFF 2.5-bob: har mijoz turi (mobil/veb/admin) — maxsus gateway
Gateway vs Mesh 2.6-bob: Gateway (tashqi N-S); Mesh (ichki E-W)

Protokol 2.13-bob: tashqi REST/JSON  ichki gRPC/Protobuf (Gateway tarjima)
Load balancing 2.14-bob: round-robin / least-conn / weighted / IP-hash / random

DISCOVERY 2.7-bob: registry (kim qayerda) — register/discover/deregister
Registration 2.15-bob: self (xizmat o'zi) vs third-party (Kubernetes avtomatik)
Kubernetes 2.16-bob: Service + kube-dns (order-service:3001 — barqaror nom)
Health 2.10-bob: /health — liveness + readiness
TLS 2.17-bob: TLS (server) vs mTLS (ikkala tomon — zero trust)

// API Gateway — yagona kirish (auth, routing)
@Controller()
export class GatewayController {
  constructor(
    @Inject("USER_SERVICE") private userClient: ClientProxy,
    @Inject("ORDER_SERVICE") private orderClient: ClientProxy,
  ) {}

  // Routing + auth (Gateway'da — bir joyda — 2.2)
  @Get("users/:id")
  @UseGuards(JwtAuthGuard)                            // AUTH Gateway'da (8.9 — har xizmatda emas)
  getUser(@Param("id") id: string) {
    return this.userClient.send({ cmd: "user.get" }, id);   // routing  User Svc (9.6)
  }

  @Post("orders")
  @UseGuards(JwtAuthGuard)
  @Throttle({ default: { limit: 10, ttl: 60000 } })  // RATE LIMIT Gateway'da (5.20)
  createOrder(@Body() dto: any, @CurrentUser() user) {
    return this.orderClient.send({ cmd: "order.create" }, { ...dto, userId: user.id });
  }
}
//  Auth/rate limit BIR JOYDA (Gateway) — ichki xizmatlar faqat biznes mantiq

// Bir so'rovga bir necha xizmatdan (under-fetching yo'q — 2.4)
@Get("orders/:id/full")
@UseGuards(JwtAuthGuard)
async buyurtmaToliq(@Param("id") id: string) {
  // Parallel (Promise.all — tez — 9.6)
  const [order, user, products] = await Promise.all([
    firstValueFrom(this.orderClient.send({ cmd: "order.get" }, id)),
    firstValueFrom(this.userClient.send({ cmd: "user.get" }, /* userId */)),
    firstValueFrom(this.productClient.send({ cmd: "products.byOrder" }, id)),
  ]);
  // Birlashtirilgan javob (mijoz 1 so'rov yubordi — 2.4)
  return { ...order, user, products };
}
//  Mijoz 1 so'rov, Gateway 3 ta qildi (mobil uchun muhim — kam so'rov)
//  murakkab aggregation  GraphQL afzal (8.17)

// Mobil BFF — ixcham javob (bandwidth)
@Controller("mobile")
export class MobileBffController {
  @Get("products")
  async products() {
    const products = await firstValueFrom(this.productClient.send({ cmd: "products.all" }, {}));
    // Mobil uchun IXCHAM (faqat kerakli maydonlar — 2.5)
    return products.map((p) => ({ id: p.id, nom: p.nom, narx: p.narx, rasm: p.thumbnail }));
  }
}

// Veb BFF — boy ma'lumot (desktop)
@Controller("web")
export class WebBffController {
  @Get("products")
  async products() {
    const products = await firstValueFrom(this.productClient.send({ cmd: "products.all" }, {}));
    // Veb uchun BOY (to'liq ma'lumot — 2.5)
    return products;   // barcha maydon (tavsif, sharhlar, o'xshash...)
  }
}
//  Har mijoz o'z ehtiyojiga mos (mobil kam, veb ko'p — 2.5)

# kong.yml — deklarativ Gateway (auth, rate limit — plugin)
services:
  - name: user-service
    url: http://user-service:3001        # service discovery (DNS — 2.8)
    routes:
      - paths: ["/users"]
    plugins:
      - name: jwt                         # AUTH (plugin — kod yozmasdan)
      - name: rate-limiting               # RATE LIMIT
        config: { minute: 60 }
      - name: cors

  - name: order-service
    url: http://order-service:3002
    routes:
      - paths: ["/orders"]
    plugins:
      - name: jwt
#  Tayyor Gateway — plugin bilan (kod kam — 2.3); custom mantiq kerak bo'lsa NestJS

// Kubernetes — Service DNS (IP emas, BARQAROR nom — 2.8)
//  Hardcode IP (deploy'da buziladi)
// const userUrl = "http://192.168.1.5:3001";

//  Kubernetes Service DNS (barqaror — IP o'zgarsa ham nom bir xil)
@Module({
  imports: [
    ClientsModule.register([
      {
        name: "USER_SERVICE",
        transport: Transport.TCP,
        options: { host: "user-service", port: 3001 },   // DNS nom (Kubernetes — 2.8)
      },
    ]),
  ],
})
export class GatewayModule {}
//  "user-service" — Kubernetes Service nomi (DNS)  joriy sog'lom IP'ga (avtomatik — 2.9)
//  IP o'zgaradi, deploy bo'ladi, scale bo'ladi — nom o'zgarmaydi (discovery avtomatik)

// Health endpoint (Kubernetes probe + Gateway — 2.10, 8.15)
@Controller("health")
export class HealthController {
  constructor(
    private health: HealthCheckService,
    private db: TypeOrmHealthIndicator,
    private redis: RedisHealthIndicator,
  ) {}

  @Get("live")                                        // LIVENESS — tirikmi
  @HealthCheck()
  liveness() {
    return this.health.check([]);                     // oddiy — jarayon javob beradimi
  }

  @Get("ready")                                       // READINESS — tayyormi (2.10)
  @HealthCheck()
  readiness() {
    return this.health.check([
      () => this.db.pingCheck("database"),            // DB ulanganmi
      () => this.redis.checkHealth("redis"),          // Redis tayyormi
    ]);
  }
}
// Kubernetes: livenessProbe  /health/live; readinessProbe  /health/ready (10)
//  readiness FALSE  Gateway/registry so'rov yubormaydi (warm-up/DB uzilgan)

// Consul — xizmat ro'yxatdan o'tadi (register) va topadi (discover)
import Consul from "consul";

@Injectable()
export class ServiceRegistry implements OnModuleInit, OnModuleDestroy {
  private consul = new Consul({ host: "consul" });
  private serviceId = `order-service-${process.pid}`;

  async onModuleInit() {
    // REGISTER — men shu manzildaman (2.9)
    await this.consul.agent.service.register({
      id: this.serviceId, name: "order-service",
      address: process.env.HOST, port: 3002,
      check: { http: "http://localhost:3002/health/ready", interval: "10s" },   // health (2.10)
    });
  }
  async onModuleDestroy() {
    await this.consul.agent.service.deregister(this.serviceId);   // chiqish (2.9)
  }

  // DISCOVER — boshqa xizmatni topish
  async topish(name: string): Promise<{ host: string; port: number }> {
    const services = await this.consul.health.service({ service: name, passing: true });   // sog'lom
    const s = services[0].Service;
    return { host: s.Address, port: s.Port };
  }
}

// Gateway: tashqi REST/JSON ni ichki gRPC ga TARJIMA qiladi (2.13)
@Controller("users")
export class UserGatewayController {
  // gRPC kliyent (ichki xizmat — 9.6)
  constructor(@Inject("USER_GRPC") private grpc: ClientGrpc) {}
  private svc: any;
  onModuleInit() { this.svc = this.grpc.getService("UserService"); }

  @Get(":id")
  @UseGuards(JwtAuthGuard)
  async getUser(@Param("id") id: string, @CurrentUser() user) {
    // 1) TASHQI: REST/JSON so'rov keldi (brauzer/mobil)
    // 2) TARJIMA: gRPC chaqiruvi (Protobuf — ichki, tez — 2.13, 9.6)
    const res = await firstValueFrom(
      this.svc.getUser({ id, requestedBy: user.id }),   // headerichki maydon (transform)
    );
    // 3) RESPONSE TRANSFORM: ichki/maxfiy maydonlarni OLIB TASHLASH (2.13)
    const { parol_hash, internal_notes, ...ochiq } = res;
    return ochiq;   // mijoz faqat ochiq maydonlarni ko'radi
  }
}
//  Mijoz REST ko'radi, ichkarida gRPC (mijoz ichki texnologiyani bilmaydi — 2.13)
//  parol_hash/internal_notes tashqariga CHIQMAYDI (javob transformatsiyasi)

# Nginx upstream — bir xizmatning KO'P nusxasiga yuk taqsimlash (2.14)
upstream order_service {
    # ALGORITM tanlash (biri):
    least_conn;                      # eng kam ulanishga 2.14-bob — round-robin default
    # ip_hash;                       # sticky: bir IP  bir nusxa (sessiya — 2.14)

    server order-1:3002 weight=2;    # WEIGHTED — kuchli server 2x yuk (2.14)
    server order-2:3002 weight=1;
    server order-3:3002 weight=1 max_fails=3 fail_timeout=30s;  # health (2.10)
}

server {
    listen 443 ssl;                  # TLS termination (HTTPS — 2.11, 2.17)
    location /orders {
        proxy_pass http://order_service;   # LB qilingan xizmatga
        proxy_set_header X-Real-IP $remote_addr;   # header transform (2.13)
    }
}
#  least_conn/ip_hash/weighted — yuk profiliga qarab (2.14)
#  max_fails — kasal nusxa vaqtincha chiqariladi (health — 2.10)

# Istio — ichki xizmatlararo mTLS AVTOMATIK (sidecar — 2.6, 2.17)
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: default
  namespace: shop
spec:
  mtls:
    mode: STRICT        # IKKALA tomon ham sertifikat MAJBUR (mTLS — 2.17)
#  Xizmat kodi TEGILMAYDI — Istio sidecar mTLS'ni o'zi qiladi (2.6)
#  "Zero trust": ichki tarmoqda ham har aloqa isbotlanadi (2.17)

  IKKI YO'L — ko'p xizmat ma'lumotini bitta javobga 2.4-bob:

  1) API KOMPOZITSIYA (Gateway aggregation — 2.4, Misol 2):
     Gateway KODDA bir necha xizmatni chaqiradi  qo'lda birlashtiradi
      Oddiy, aniq nazorat
      Har yangi kombinatsiyaga Gateway kodini yozish (qo'lda)

  2) GraphQL FEDERATION (17-bob):
     Har xizmat o'z GraphQL sxemasini beradi (subgraph)
     Gateway (Apollo Router) sxemalarni BIRLASHTIRADI (supergraph)
     Mijoz bitta so'rovda kerakli maydonlarni SO'RAYDI (deklarativ)
      Mijoz kerakligini oladi (over/under-fetching yo'q — 8.17)
      Yangi kombinatsiya — Gateway kodisiz (sxema hal qiladi)
      Qo'shimcha murakkablik (GraphQL, federation sozlash)

   Oddiy/kam kombinatsiya  API kompozitsiya (bu bob, 2.4)
   Ko'p mijoz, ko'p turli kombinatsiya  GraphQL federation (17-bob)

  GATEWAY XAVFSIZLIK ARXITEKTURASI:

  Internet (tashqi)
       │ HTTPS
       ▼
  ┌─────────────┐
  │ API Gateway │   auth, rate limit, SSL 2.11-bob — YAGONA tashqi nuqta
  └──────┬──────┘
         │ ichki tarmoq (private — tashqaridan YOPIQ)
   ┌─────┼─────┐
   ▼     ▼     ▼
  User  Order  Product    ichki xizmatlar (internetdan KO'RINMAYDI)
        Services            (faqat Gateway orqali — 2.11)

   Ichki xizmatlar — private tarmoqda (firewall, Kubernetes NetworkPolicy)
   Faqat Gateway public; xizmatlar to'g'ridan murojaat qilib bo'lmaydi

  GATEWAY — single point of failure  HA (yuqori mavjudlik):

           Internet
              │
       ┌──────────────┐
       │Load Balancer │   Gateway oldida (Nginx/cloud LB — 10)
       └──────┬───────┘
        ┌─────┼─────┐
        ▼     ▼     ▼
     Gateway Gateway Gateway    KO'P nusxa (biri yiqilsa, boshqasi — 2.11)
        └─────┼─────┘
              ▼
        ichki xizmatlar

   Gateway yiqilsa hammasi yiqiladi  ko'p nusxa + load balancer
   Health check 2.10-bob — kasal Gateway'ni chiqaradi

  TO'LIQ ARXITEKTURA (Gateway + discovery + xizmatlar):

  Mijoz (mobil/veb)
       │ HTTPS
       ▼
  Load Balancer  API Gateway (auth, rate limit, routing — 2.2)
                       │ (service discovery — DNS — 2.8)
        ┌──────────────┼──────────────┐
        ▼ gRPC         ▼ gRPC          ▼ gRPC
     User Svc      Order Svc       Product Svc
     /health       /health         /health       health check 2.10-bob
     (register)    (register)      (register)     registry/K8s DNS 2.9-bob
                       │ event (Kafka — 9.6, 9.7)
                       ▼
                 Notification, Analytics (asinxron)

  Komponentlar:
  - Load Balancer (Gateway HA — 2.11)
  - API Gateway (yagona kirish — 2.1)
  - Service Discovery (K8s DNS / Consul — 2.8, 2.9)
  - Health check (sog'lom — 2.10)
  - gRPC (ichki — 9.6) + event (async — 9.7)

 Gateway'siz (auth takror, tuzilma oshkor — 2.1)
 API Gateway (yagona kirish)

 http://192.168.1.5 (deploy'da buziladi — 2.7)
 service discovery (DNS / registry)

 har xizmat token tekshiradi (takror — 2.2)
 Gateway'da (bir joyda)

 bitta Gateway (yiqilsa hammasi — 2.11)
 ko'p nusxa + load balancer

 xizmatlar internetdan ko'rinadi (xavfsizlik — 2.11)
 private tarmoq (faqat Gateway public)

 narx hisoblash/buyurtma qoidasi Gateway'da (God object — 2.17)
 Gateway yupqa (routing/auth); biznes mantiq xizmatda (9.1)

 sessiya xizmat xotirasida  IP-hash majbur (miqyoslash qiyin — 2.14)
 stateless sessiya (JWT/Redis)  har nusxa teng (round-robin — 2.14)