471 lines
17 KiB
Nginx Configuration File
471 lines
17 KiB
Nginx Configuration File
user www-data;
|
|
worker_processes auto;
|
|
pid /app/nginx.pid;
|
|
include /etc/nginx/modules-enabled/*.conf;
|
|
|
|
events {
|
|
worker_connections 1024;
|
|
use epoll;
|
|
multi_accept on;
|
|
}
|
|
|
|
http {
|
|
# Configuration de base
|
|
sendfile on;
|
|
tcp_nopush on;
|
|
tcp_nodelay on;
|
|
keepalive_timeout 65;
|
|
types_hash_max_size 2048;
|
|
server_tokens off;
|
|
|
|
# MIME types
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
|
|
# Logging
|
|
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
|
'$status $body_bytes_sent "$http_referer" '
|
|
'"$http_user_agent" "$http_x_forwarded_for"';
|
|
|
|
access_log /app/logs/nginx/access.log main;
|
|
error_log /app/logs/nginx/error.log warn;
|
|
|
|
# Gzip compression
|
|
gzip on;
|
|
gzip_vary on;
|
|
gzip_proxied any;
|
|
gzip_comp_level 6;
|
|
gzip_types
|
|
text/plain
|
|
text/css
|
|
text/xml
|
|
text/javascript
|
|
application/json
|
|
application/javascript
|
|
application/xml+rss
|
|
application/atom+xml
|
|
image/svg+xml;
|
|
|
|
# Rate limiting
|
|
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
|
|
limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s;
|
|
|
|
# Upstream servers
|
|
|
|
upstream lecoffre_frontend {
|
|
server localhost:3004;
|
|
keepalive 32;
|
|
}
|
|
|
|
upstream ihm_client {
|
|
server localhost:3003;
|
|
keepalive 32;
|
|
}
|
|
|
|
upstream grafana {
|
|
server localhost:3005;
|
|
keepalive 32;
|
|
}
|
|
|
|
upstream loki {
|
|
server localhost:3100;
|
|
keepalive 32;
|
|
}
|
|
|
|
upstream status_api {
|
|
server localhost:3006;
|
|
keepalive 32;
|
|
}
|
|
|
|
upstream sdk_relay {
|
|
server localhost:8090;
|
|
keepalive 32;
|
|
}
|
|
|
|
upstream blindbit {
|
|
server localhost:8000;
|
|
keepalive 32;
|
|
}
|
|
|
|
# Serveur principal HTTP (port 80)
|
|
server {
|
|
listen 80 default_server;
|
|
listen [::]:80 default_server;
|
|
server_name _;
|
|
|
|
# Redirection automatique vers HTTPS si disponible
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
# Serveur HTTPS (port 443)
|
|
server {
|
|
listen 443 ssl http2 default_server;
|
|
listen [::]:443 ssl http2 default_server;
|
|
server_name _;
|
|
|
|
# Certificats SSL (auto-signés pour le développement)
|
|
ssl_certificate /app/ssl/nginx-selfsigned.crt;
|
|
ssl_certificate_key /app/ssl/nginx-selfsigned.key;
|
|
|
|
# Configuration SSL
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
|
|
ssl_prefer_server_ciphers off;
|
|
ssl_session_cache shared:SSL:10m;
|
|
ssl_session_timeout 10m;
|
|
|
|
# Headers de sécurité
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
|
|
# Page de statut des services
|
|
location /status/ {
|
|
alias /var/www/lecoffre/status/;
|
|
index index.html;
|
|
try_files $uri $uri/ /status/index.html;
|
|
|
|
location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg)$ {
|
|
expires 1h;
|
|
add_header Cache-Control "public, immutable";
|
|
}
|
|
}
|
|
|
|
# API de statut des services
|
|
location /status/api {
|
|
limit_req zone=api burst=20 nodelay;
|
|
proxy_pass http://status_api/api;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
# CORS
|
|
add_header Access-Control-Allow-Origin *;
|
|
add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
|
|
add_header Access-Control-Allow-Headers "Content-Type, Authorization";
|
|
|
|
if ($request_method = 'OPTIONS') {
|
|
return 204;
|
|
}
|
|
}
|
|
|
|
# Grafana - Interface de monitoring
|
|
location /grafana/ {
|
|
proxy_pass http://grafana/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Grafana-Org-Id 1;
|
|
|
|
# WebSocket support
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
|
|
proxy_connect_timeout 60s;
|
|
proxy_send_timeout 60s;
|
|
proxy_read_timeout 60s;
|
|
proxy_buffering off;
|
|
proxy_request_buffering off;
|
|
}
|
|
|
|
# Loki API - API de logs
|
|
location /loki/ {
|
|
limit_req zone=api burst=10 nodelay;
|
|
proxy_pass http://loki/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
# CORS pour Grafana
|
|
add_header Access-Control-Allow-Origin *;
|
|
add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
|
|
add_header Access-Control-Allow-Headers "Content-Type, Authorization";
|
|
|
|
if ($request_method = 'OPTIONS') {
|
|
return 204;
|
|
}
|
|
}
|
|
|
|
# API backend - routes /back/ vers /api/
|
|
location ~* ^/back/(.*)$ {
|
|
limit_req zone=api burst=20 nodelay;
|
|
proxy_pass http://lecoffre_backend/api/$1;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header Connection "";
|
|
proxy_buffering off;
|
|
}
|
|
|
|
# API direct - routes /api/
|
|
location /api/ {
|
|
limit_req zone=api burst=20 nodelay;
|
|
|
|
# CORS dynamique
|
|
set $cors_origin "";
|
|
if ($http_origin ~* ^(http://localhost:3000|http://local\.4nkweb\.com:3000|https://dev4\.4nkweb\.com)$) {
|
|
set $cors_origin $http_origin;
|
|
}
|
|
|
|
proxy_hide_header Access-Control-Allow-Origin;
|
|
proxy_hide_header Access-Control-Allow-Credentials;
|
|
proxy_hide_header Access-Control-Allow-Headers;
|
|
proxy_hide_header Access-Control-Allow-Methods;
|
|
|
|
if ($request_method = OPTIONS) {
|
|
add_header Access-Control-Allow-Origin $cors_origin always;
|
|
add_header Access-Control-Allow-Credentials "true" always;
|
|
add_header Access-Control-Allow-Headers "Content-Type, x-session-id, Authorization, x-request-id" always;
|
|
add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
|
|
return 204;
|
|
}
|
|
|
|
add_header Access-Control-Allow-Origin $cors_origin always;
|
|
add_header Access-Control-Allow-Credentials "true" always;
|
|
add_header Access-Control-Allow-Headers "Content-Type, x-session-id, Authorization" always;
|
|
add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
|
|
|
|
proxy_pass http://lecoffre_backend/api/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 300;
|
|
proxy_connect_timeout 300;
|
|
proxy_send_timeout 300;
|
|
}
|
|
|
|
# WebSocket relay (sdk_relay)
|
|
location /ws/ {
|
|
proxy_pass http://sdk_relay/;
|
|
proxy_set_header Sec-WebSocket-Key $http_sec_websocket_key;
|
|
proxy_set_header Sec-WebSocket-Version $http_sec_websocket_version;
|
|
proxy_set_header Sec-WebSocket-Protocol $http_sec_websocket_protocol;
|
|
proxy_set_header Sec-WebSocket-Extensions $http_sec_websocket_extensions;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_read_timeout 86400;
|
|
}
|
|
|
|
# API de transfert de fonds
|
|
location /api/v1/funds/ {
|
|
limit_req zone=api burst=5 nodelay;
|
|
proxy_pass http://lecoffre_backend/api/v1/funds/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 300;
|
|
proxy_connect_timeout 300;
|
|
proxy_send_timeout 300;
|
|
}
|
|
|
|
# favicon
|
|
location = /favicon.ico {
|
|
root /var/www/lecoffre/assets;
|
|
try_files /favicon.ico =404;
|
|
}
|
|
|
|
# blindbit
|
|
location /blindbit/ {
|
|
proxy_pass http://blindbit/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
# LeCoffre Front - Application principale
|
|
# Redirige /lecoffre -> /lecoffre/
|
|
location = /lecoffre {
|
|
return 301 /lecoffre/;
|
|
}
|
|
location /lecoffre/ {
|
|
proxy_pass http://lecoffre_frontend/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_read_timeout 300;
|
|
|
|
# Configuration spécifique pour Next.js
|
|
proxy_buffering off;
|
|
proxy_request_buffering off;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-Server $host;
|
|
}
|
|
|
|
# ihm_client (root) - DOIT être en dernier
|
|
location / {
|
|
proxy_pass http://ihm_client;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_read_timeout 300;
|
|
}
|
|
}
|
|
# API de statut des services
|
|
location /status/api {
|
|
limit_req zone=api burst=20 nodelay;
|
|
proxy_pass http://status_api/api;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
# CORS
|
|
add_header Access-Control-Allow-Origin *;
|
|
add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
|
|
add_header Access-Control-Allow-Headers "Content-Type, Authorization";
|
|
|
|
if ($request_method = 'OPTIONS') {
|
|
return 204;
|
|
}
|
|
}
|
|
|
|
# Grafana - Interface de monitoring
|
|
location /grafana/ {
|
|
proxy_pass http://grafana/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Grafana-Org-Id 1;
|
|
|
|
# WebSocket support
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
|
|
proxy_connect_timeout 60s;
|
|
proxy_send_timeout 60s;
|
|
proxy_read_timeout 60s;
|
|
proxy_buffering off;
|
|
proxy_request_buffering off;
|
|
}
|
|
|
|
# API backend - routes /back/ vers /api/
|
|
location ~* ^/back/(.*)$ {
|
|
limit_req zone=api burst=20 nodelay;
|
|
proxy_pass http://lecoffre_backend/api/$1;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header Connection "";
|
|
proxy_buffering off;
|
|
}
|
|
|
|
# API direct - routes /api/
|
|
location /api/ {
|
|
limit_req zone=api burst=20 nodelay;
|
|
|
|
# CORS dynamique pour développement local
|
|
set $cors_origin "";
|
|
if ($http_origin ~* ^(http://local\.4nkweb\.com:3000|http://localhost:3000|https://dev4\.4nkweb\.com)$) {
|
|
set $cors_origin $http_origin;
|
|
}
|
|
|
|
proxy_hide_header Access-Control-Allow-Origin;
|
|
proxy_hide_header Access-Control-Allow-Credentials;
|
|
proxy_hide_header Access-Control-Allow-Headers;
|
|
proxy_hide_header Access-Control-Allow-Methods;
|
|
|
|
if ($request_method = OPTIONS) {
|
|
add_header Access-Control-Allow-Origin $cors_origin always;
|
|
add_header Access-Control-Allow-Credentials "true" always;
|
|
add_header Access-Control-Allow-Headers "Content-Type, x-session-id, Authorization, x-request-id" always;
|
|
add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
|
|
return 204;
|
|
}
|
|
|
|
add_header Access-Control-Allow-Origin $cors_origin always;
|
|
add_header Access-Control-Allow-Credentials "true" always;
|
|
add_header Access-Control-Allow-Headers "Content-Type, x-session-id, Authorization" always;
|
|
add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
|
|
|
|
proxy_pass http://lecoffre_backend/api/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 300;
|
|
proxy_connect_timeout 300;
|
|
proxy_send_timeout 300;
|
|
}
|
|
|
|
# WebSocket relay (sdk_relay)
|
|
location /ws/ {
|
|
proxy_pass http://sdk_relay/;
|
|
proxy_set_header Sec-WebSocket-Key $http_sec_websocket_key;
|
|
proxy_set_header Sec-WebSocket-Version $http_sec_websocket_version;
|
|
proxy_set_header Sec-WebSocket-Protocol $http_sec_websocket_protocol;
|
|
proxy_set_header Sec-WebSocket-Extensions $http_sec_websocket_extensions;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_read_timeout 86400;
|
|
}
|
|
|
|
# LeCoffre Front - Application principale
|
|
# Redirige /lecoffre -> /lecoffre/
|
|
location = /lecoffre {
|
|
return 301 /lecoffre/;
|
|
}
|
|
location /lecoffre/ {
|
|
proxy_pass http://lecoffre_frontend/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_read_timeout 300;
|
|
|
|
# Configuration spécifique pour Next.js
|
|
proxy_buffering off;
|
|
proxy_request_buffering off;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-Server $host;
|
|
}
|
|
|
|
# ihm_client (root) - DOIT être en dernier
|
|
location / {
|
|
proxy_pass http://ihm_client;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_read_timeout 300;
|
|
}
|
|
}
|
|
}
|