From 6921374d9f67a093d1cef41f05221c42b4424822 Mon Sep 17 00:00:00 2001 From: admin Date: Wed, 6 Aug 2025 01:38:45 +0300 Subject: [PATCH] update Nginx configuration to set up SSL with Traefik routing and adjust port mappings --- config/nginx/nginx-ssl.conf | 121 ++++++++++++++++++++++++++++++++++++ config/nginx/nginx.conf | 52 +--------------- docker-compose.yml | 9 ++- 3 files changed, 129 insertions(+), 53 deletions(-) create mode 100644 config/nginx/nginx-ssl.conf diff --git a/config/nginx/nginx-ssl.conf b/config/nginx/nginx-ssl.conf new file mode 100644 index 0000000..59c72b6 --- /dev/null +++ b/config/nginx/nginx-ssl.conf @@ -0,0 +1,121 @@ +proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=STATIC:10m inactive=7d use_temp_path=off; + +upstream backend +{ + server unix:/app/run/socket0.sock; + server unix:/app/run/socket1.sock; + server unix:/app/run/socket2.sock; + server unix:/app/run/socket3.sock; +} + +upstream frontend +{ + server front:3000; +} + +server +{ + listen 443 ssl http2; # managed by Certbot + + server_tokens off; + server_name crm.logidex.ru www.crm.logidex.ru; + gzip on; + gzip_proxied any; + gzip_comp_level 4; + gzip_types text/css application/javascript image/svg+xml application/json text/plain text/xml; + + + ssl_certificate /var/www/certbot/live/crm.logidex.ru/fullchain.pem; # managed by Certbot + ssl_certificate_key /var/www/certbot/live/crm.logidex.ru/privkey.pem; # managed by Certbot + + # Temp disable for testing + # add_header Strict-Transport-Security "max-age=0" always; + + + # intermediate configuration + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ecdh_curve X25519:prime256v1:secp384r1; + ssl_session_cache shared:le_nginx_SSL:10m; + ssl_session_timeout 1440m; + ssl_session_tickets off; + ssl_prefer_server_ciphers on; + ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"; + + ssl_dhparam /var/www/certbot/live/crm.logidex.ru/dhparam.pem; # managed by Certbot + + + # OCSP stapling + ssl_stapling on; + ssl_stapling_verify on; + + # verify chain of trust of OCSP response using Root CA and Intermediate certs + ssl_trusted_certificate /var/www/certbot/live/crm.logidex.ru/fullchain.pem; + + # replace with the IP address of your resolver; + # async 'resolver' is important for proper operation of OCSP stapling + resolver 8.8.8.8 8.8.4.4 valid=300s; + resolver_timeout 5s; + + + + + # Общие proxy_set_header, унаследованные всеми location + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Host $host; + + + location /api + { + proxy_pass http://backend; + } + + location / + { + proxy_pass http://frontend; + } + + location /_next/webpack-hmr + { + proxy_pass http://frontend; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + } + + location /_next/static + { + proxy_cache STATIC; + proxy_pass http://frontend; + add_header X-Cache-Status $upstream_cache_status; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection 'upgrade'; + proxy_cache_bypass $http_upgrade; + } + + location /static + { + proxy_cache STATIC; + proxy_ignore_headers Cache-Control; + proxy_cache_valid 60m; + proxy_pass http://frontend; + } + + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } +} + + +server { + if ($host = crm.logidex.ru) { + return 301 https://$host$request_uri; + } + server_name git.logidex.ru; + listen 80; + return 404; # managed by Certbot + + +} diff --git a/config/nginx/nginx.conf b/config/nginx/nginx.conf index 59c72b6..3c77fe7 100644 --- a/config/nginx/nginx.conf +++ b/config/nginx/nginx.conf @@ -15,9 +15,8 @@ upstream frontend server { - listen 443 ssl http2; # managed by Certbot + listen 80; # managed by Certbot - server_tokens off; server_name crm.logidex.ru www.crm.logidex.ru; gzip on; gzip_proxied any; @@ -25,40 +24,6 @@ server gzip_types text/css application/javascript image/svg+xml application/json text/plain text/xml; - ssl_certificate /var/www/certbot/live/crm.logidex.ru/fullchain.pem; # managed by Certbot - ssl_certificate_key /var/www/certbot/live/crm.logidex.ru/privkey.pem; # managed by Certbot - - # Temp disable for testing - # add_header Strict-Transport-Security "max-age=0" always; - - - # intermediate configuration - ssl_protocols TLSv1.2 TLSv1.3; - ssl_ecdh_curve X25519:prime256v1:secp384r1; - ssl_session_cache shared:le_nginx_SSL:10m; - ssl_session_timeout 1440m; - ssl_session_tickets off; - ssl_prefer_server_ciphers on; - ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"; - - ssl_dhparam /var/www/certbot/live/crm.logidex.ru/dhparam.pem; # managed by Certbot - - - # OCSP stapling - ssl_stapling on; - ssl_stapling_verify on; - - # verify chain of trust of OCSP response using Root CA and Intermediate certs - ssl_trusted_certificate /var/www/certbot/live/crm.logidex.ru/fullchain.pem; - - # replace with the IP address of your resolver; - # async 'resolver' is important for proper operation of OCSP stapling - resolver 8.8.8.8 8.8.4.4 valid=300s; - resolver_timeout 5s; - - - - # Общие proxy_set_header, унаследованные всеми location proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; @@ -102,20 +67,5 @@ server proxy_cache_valid 60m; proxy_pass http://frontend; } - - location /.well-known/acme-challenge/ { - root /var/www/certbot; - } } - -server { - if ($host = crm.logidex.ru) { - return 301 https://$host$request_uri; - } - server_name git.logidex.ru; - listen 80; - return 404; # managed by Certbot - - -} diff --git a/docker-compose.yml b/docker-compose.yml index 898d3e3..11d2881 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -19,8 +19,7 @@ services: nginx: image: nginx:alpine-slim ports: - - "80:80" - - "443:443" + - "4434:443" depends_on: - back - front @@ -40,6 +39,12 @@ services: restart: unless-stopped networks: - appnet + - proxy + labels: + - "traefik.enable=true" + - "traefik.http.routers.crm.rule=Host(`crm.logidex.ru`)" + - "traefik.http.routers.crm.entrypoints=websecure" + - "traefik.http.routers.crm.tls=true" certbot: image: certbot/certbot:latest volumes: