update Nginx configuration to set up SSL with Traefik routing and adjust port mappings

config/nginx/nginx-ssl.conf

@@ -0,0 +1,121 @@
+proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=STATIC:10m inactive=7d use_temp_path=off;
+
+upstream backend
+{
+	server unix:/app/run/socket0.sock;
+	server unix:/app/run/socket1.sock;
+	server unix:/app/run/socket2.sock;
+	server unix:/app/run/socket3.sock;
+}
+
+upstream frontend
+{
+	server front:3000;
+}
+
+server
+{
+	listen 443 ssl http2; # managed by Certbot
+
+	server_tokens off;
+	server_name crm.logidex.ru www.crm.logidex.ru;
+	gzip on;
+	gzip_proxied any;
+	gzip_comp_level 4;
+	gzip_types text/css application/javascript image/svg+xml application/json text/plain text/xml;
+
+
+    ssl_certificate /var/www/certbot/live/crm.logidex.ru/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /var/www/certbot/live/crm.logidex.ru/privkey.pem; # managed by Certbot
+
+    # Temp disable for testing
+    # add_header Strict-Transport-Security "max-age=0" always;
+
+
+    # intermediate configuration
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ecdh_curve X25519:prime256v1:secp384r1;
+    ssl_session_cache shared:le_nginx_SSL:10m;
+    ssl_session_timeout 1440m;
+    ssl_session_tickets off;
+    ssl_prefer_server_ciphers on;
+    ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
+
+    ssl_dhparam /var/www/certbot/live/crm.logidex.ru/dhparam.pem; # managed by Certbot
+
+
+    # OCSP stapling
+    ssl_stapling on;
+    ssl_stapling_verify on;
+
+    # verify chain of trust of OCSP response using Root CA and Intermediate certs
+    ssl_trusted_certificate /var/www/certbot/live/crm.logidex.ru/fullchain.pem;
+
+    # replace with the IP address of your resolver;
+    # async 'resolver' is important for proper operation of OCSP stapling
+    resolver 8.8.8.8 8.8.4.4 valid=300s;
+    resolver_timeout 5s;
+
+
+
+
+	# Общие proxy_set_header, унаследованные всеми location
+	proxy_set_header X-Real-IP $remote_addr;
+	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+	proxy_set_header X-Forwarded-Proto $scheme;
+	proxy_set_header Host $host;
+
+
+	location /api
+	{
+		proxy_pass http://backend;
+	}
+
+	location /
+	{
+		proxy_pass http://frontend;
+	}
+
+	location /_next/webpack-hmr
+	{
+		proxy_pass http://frontend;
+		proxy_http_version 1.1;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection "upgrade";
+	}
+
+	location /_next/static
+	{
+		proxy_cache STATIC;
+		proxy_pass http://frontend;
+		add_header X-Cache-Status $upstream_cache_status;
+		proxy_http_version 1.1;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection 'upgrade';
+		proxy_cache_bypass $http_upgrade;
+    }
+
+	location /static
+	{
+		proxy_cache STATIC;
+		proxy_ignore_headers Cache-Control;
+		proxy_cache_valid 60m;
+		proxy_pass http://frontend;
+	}
+
+	location /.well-known/acme-challenge/ {
+	    root /var/www/certbot;
+    }
+}
+
+
+server {
+    if ($host = crm.logidex.ru) {
+        return 301 https://$host$request_uri;
+    }
+    server_name git.logidex.ru;
+    listen 80;
+    return 404; # managed by Certbot
+
+
+}

config/nginx/nginx.conf

@@ -15,9 +15,8 @@ upstream frontend
 
 server
 {
-	listen 443 ssl http2; # managed by Certbot
+	listen 80; # managed by Certbot
 
-	server_tokens off;
 	server_name crm.logidex.ru www.crm.logidex.ru;
 	gzip on;
 	gzip_proxied any;
@@ -25,40 +24,6 @@ server
 	gzip_types text/css application/javascript image/svg+xml application/json text/plain text/xml;
 
 
-    ssl_certificate /var/www/certbot/live/crm.logidex.ru/fullchain.pem; # managed by Certbot
-    ssl_certificate_key /var/www/certbot/live/crm.logidex.ru/privkey.pem; # managed by Certbot
-
-    # Temp disable for testing
-    # add_header Strict-Transport-Security "max-age=0" always;
-
-
-    # intermediate configuration
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ecdh_curve X25519:prime256v1:secp384r1;
-    ssl_session_cache shared:le_nginx_SSL:10m;
-    ssl_session_timeout 1440m;
-    ssl_session_tickets off;
-    ssl_prefer_server_ciphers on;
-    ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
-
-    ssl_dhparam /var/www/certbot/live/crm.logidex.ru/dhparam.pem; # managed by Certbot
-
-
-    # OCSP stapling
-    ssl_stapling on;
-    ssl_stapling_verify on;
-
-    # verify chain of trust of OCSP response using Root CA and Intermediate certs
-    ssl_trusted_certificate /var/www/certbot/live/crm.logidex.ru/fullchain.pem;
-
-    # replace with the IP address of your resolver;
-    # async 'resolver' is important for proper operation of OCSP stapling
-    resolver 8.8.8.8 8.8.4.4 valid=300s;
-    resolver_timeout 5s;
-
-
-
-
 	# Общие proxy_set_header, унаследованные всеми location
 	proxy_set_header X-Real-IP $remote_addr;
 	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -102,20 +67,5 @@ server
 		proxy_cache_valid 60m;
 		proxy_pass http://frontend;
 	}
-
-	location /.well-known/acme-challenge/ {
-	    root /var/www/certbot;
-    }
 }
 
-
-server {
-    if ($host = crm.logidex.ru) {
-        return 301 https://$host$request_uri;
-    }
-    server_name git.logidex.ru;
-    listen 80;
-    return 404; # managed by Certbot
-
-
-}

docker-compose.yml

@@ -19,8 +19,7 @@ services:
   nginx:
     image: nginx:alpine-slim
     ports:
-      - "80:80"
+      - "4434:443"
-      - "443:443"
     depends_on:
       - back
       - front
@@ -40,6 +39,12 @@ services:
     restart: unless-stopped
     networks:
       - appnet
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.crm.rule=Host(`crm.logidex.ru`)"
+      - "traefik.http.routers.crm.entrypoints=websecure"
+      - "traefik.http.routers.crm.tls=true"
   certbot:
     image: certbot/certbot:latest
     volumes: