Configuration LeCoffre et dnsmasq
- Ajout des exemples de configuration .env pour LeCoffre Back et Front - Documentation dnsmasq pour résolution DNS Docker - Script de démarrage dnsmasq - Nettoyage des données Bitcoin confidentielles
This commit is contained in:
root
parent
b3f31d6b5b
commit
3991cedc85
120
docs/DNSMASQ_SETUP.md
Normal file
120
docs/DNSMASQ_SETUP.md
Normal file
@ -0,0 +1,120 @@
|
|||||||
|
# Configuration dnsmasq pour 4NK
|
||||||
|
|
||||||
|
## Vue d'ensemble
|
||||||
|
|
||||||
|
dnsmasq est configuré pour résoudre les noms Docker 4NK sur le port 5353, permettant à Nginx local d'accéder aux services Docker via leurs hostnames.
|
||||||
|
|
||||||
|
## Architecture
|
||||||
|
|
||||||
|
```
|
||||||
|
Nginx local (port 80)
|
||||||
|
↓
|
||||||
|
dnsmasq (port 5353)
|
||||||
|
↓
|
||||||
|
Services Docker (172.20.0.0/16)
|
||||||
|
```
|
||||||
|
|
||||||
|
## Configuration
|
||||||
|
|
||||||
|
### Fichier de configuration
|
||||||
|
- **Emplacement** : `conf/dnsmasq/dnsmasq.conf`
|
||||||
|
- **Port** : 5353 (évite le conflit avec le DNS système sur le port 53)
|
||||||
|
- **Interface** : 127.0.0.1
|
||||||
|
|
||||||
|
### Résolution des noms Docker
|
||||||
|
|
||||||
|
| Service | Hostname | IP Docker |
|
||||||
|
|---------|----------|-----------|
|
||||||
|
| tor | `tor.4nk.local` | 172.20.0.10 |
|
||||||
|
| bitcoin | `bitcoin.4nk.local` | 172.20.0.11 |
|
||||||
|
| blindbit | `blindbit.4nk.local` | 172.20.0.12 |
|
||||||
|
| sdk_storage | `sdk-storage.4nk.local` | 172.20.0.13 |
|
||||||
|
| sdk_relay1 | `sdk-relay1.4nk.local` | 172.20.0.14 |
|
||||||
|
| sdk_relay2 | `sdk-relay2.4nk.local` | 172.20.0.15 |
|
||||||
|
| sdk_relay3 | `sdk-relay3.4nk.local` | 172.20.0.16 |
|
||||||
|
| sdk_signer | `sdk-signer.4nk.local` | 172.20.0.17 |
|
||||||
|
| ihm_client | `ihm-client.4nk.local` | 172.20.0.18 |
|
||||||
|
| coffre_front | `coffre-front.4nk.local` | 172.20.0.32 |
|
||||||
|
| coffre_back_mini | `coffre-back-mini.4nk.local` | 172.20.0.33 |
|
||||||
|
| miniback-postgres | `miniback-postgres.4nk.local` | 172.20.0.30 |
|
||||||
|
|
||||||
|
## Utilisation
|
||||||
|
|
||||||
|
### Démarrage
|
||||||
|
```bash
|
||||||
|
# Démarrer dnsmasq pour 4NK
|
||||||
|
./scripts/start-dnsmasq.sh
|
||||||
|
```
|
||||||
|
|
||||||
|
### Test de résolution
|
||||||
|
```bash
|
||||||
|
# Test avec nslookup
|
||||||
|
nslookup -port=5353 tor.4nk.local 127.0.0.1
|
||||||
|
nslookup -port=5353 coffre-front.4nk.local 127.0.0.1
|
||||||
|
|
||||||
|
# Test avec dig
|
||||||
|
dig @127.0.0.1 -p 5353 bitcoin.4nk.local
|
||||||
|
```
|
||||||
|
|
||||||
|
### Configuration système (optionnel)
|
||||||
|
Pour utiliser dnsmasq comme DNS principal :
|
||||||
|
```bash
|
||||||
|
# Ajouter dans /etc/resolv.conf
|
||||||
|
echo "nameserver 127.0.0.1" >> /etc/resolv.conf
|
||||||
|
```
|
||||||
|
|
||||||
|
## Intégration avec Nginx
|
||||||
|
|
||||||
|
Nginx peut maintenant utiliser les hostnames Docker :
|
||||||
|
|
||||||
|
```nginx
|
||||||
|
# Configuration Nginx
|
||||||
|
location /coffre/ {
|
||||||
|
proxy_pass http://coffre-front.4nk.local:80/;
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
## Dépannage
|
||||||
|
|
||||||
|
### Vérifier le statut
|
||||||
|
```bash
|
||||||
|
# Vérifier si dnsmasq écoute sur le port 5353
|
||||||
|
netstat -tlnp | grep 5353
|
||||||
|
|
||||||
|
# Vérifier les processus dnsmasq
|
||||||
|
ps aux | grep dnsmasq
|
||||||
|
```
|
||||||
|
|
||||||
|
### Logs
|
||||||
|
```bash
|
||||||
|
# Logs dnsmasq (si configuré)
|
||||||
|
tail -f /var/log/dnsmasq.log
|
||||||
|
```
|
||||||
|
|
||||||
|
### Arrêt
|
||||||
|
```bash
|
||||||
|
# Arrêter dnsmasq
|
||||||
|
pkill -f "dnsmasq.*5353"
|
||||||
|
```
|
||||||
|
|
||||||
|
## Avantages
|
||||||
|
|
||||||
|
1. **Noms Docker natifs** : Utilise les hostnames Docker configurés
|
||||||
|
2. **Pas de conflit** : Port 5353 évite les conflits avec le DNS système
|
||||||
|
3. **Configuration centralisée** : Un seul fichier de configuration
|
||||||
|
4. **Facilité de maintenance** : Script de démarrage automatisé
|
||||||
|
5. **Compatibilité** : Fonctionne avec Nginx local et Docker
|
||||||
|
|
||||||
|
## Limitations
|
||||||
|
|
||||||
|
1. **Port non-standard** : Nécessite une configuration spécifique
|
||||||
|
2. **Dépendance** : Nginx doit être configuré pour utiliser dnsmasq
|
||||||
|
3. **Maintenance** : Les IPs Docker doivent être mises à jour si le réseau change
|
||||||
|
|
||||||
|
## Sécurité
|
||||||
|
|
||||||
|
- dnsmasq écoute uniquement sur 127.0.0.1
|
||||||
|
- Pas d'exposition externe
|
||||||
|
- Configuration limitée au réseau 4NK
|
||||||
@ -1,50 +1,16 @@
|
|||||||
# Configuration OVH
|
# Configuration d'environnement pour lecoffre-back-mini
|
||||||
OVH_APP_KEY=5ab0709bbb65ef26
|
# Base de données PostgreSQL
|
||||||
OVH_APP_SECRET=de1fac1779d707d263a611a557cd5766
|
POSTGRES_HOST=miniback-postgres.4nk.local
|
||||||
OVH_CONSUMER_KEY=5fe817829b8a9c780cfa2354f8312ece
|
POSTGRES_PORT=5432
|
||||||
OVH_SMS_SERVICE_NAME=sms-tt802880-1
|
POSTGRES_DB=miniback
|
||||||
|
POSTGRES_USER=miniback
|
||||||
|
POSTGRES_PASSWORD=minibackpassword
|
||||||
|
|
||||||
# Configuration SMS Factor
|
# Configuration de l'application
|
||||||
SMS_FACTOR_TOKEN=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiI4NzgzNiIsImlhdCI6MTcwMTMzOTY1Mi45NDUzOH0.GNoqLb5MDBWuniNlQjbr1PKolwxGqBZe_tf4IMObvHw
|
APP_PORT=3000
|
||||||
|
APP_ENV=development
|
||||||
|
LOG_LEVEL=info
|
||||||
|
|
||||||
#Configuration Mailchimp
|
# Configuration des services 4NK
|
||||||
MAILCHIMP_API_KEY=md-VVfaml-ApIV4nsGgaJKl0A
|
SDK_STORAGE_URL=http://sdk-storage.4nk.local:8081
|
||||||
MAILCHIMP_KEY=3fa54304bc766dfd0b8043a827b28a3a-us17
|
SDK_SIGNER_URL=http://sdk-signer.4nk.local:9090
|
||||||
MAILCHIMP_LIST_ID=a48d9ad852
|
|
||||||
|
|
||||||
#Configuration Stripe
|
|
||||||
STRIPE_SECRET_KEY=sk_test_51OwKmMP5xh1u9BqSeFpqw0Yr15hHtFsh0pvRGaE0VERhlYtvw33ND1qiGA6Dy1DPmmV61B6BqIimlhuv7bwElhjF00PLQwD60n
|
|
||||||
STRIPE_WEBHOOK_SECRET=
|
|
||||||
STRIPE_STANDARD_SUBSCRIPTION_PRICE_ID=price_1P66fuP5xh1u9BqSHj0O6Uy3
|
|
||||||
STRIPE_STANDARD_ANNUAL_SUBSCRIPTION_PRICE_ID=price_1P9NsRP5xh1u9BqSFgkUDbQY
|
|
||||||
STRIPE_UNLIMITED_SUBSCRIPTION_PRICE_ID=price_1P66RqP5xh1u9BqSuUzkQNac
|
|
||||||
STRIPE_UNLIMITED_ANNUAL_SUBSCRIPTION_PRICE_ID=price_1P9NpKP5xh1u9BqSApFogvUB
|
|
||||||
|
|
||||||
# Configuration serveur
|
|
||||||
APP_HOST=http://miniback.4nk.local
|
|
||||||
PORT=8080
|
|
||||||
|
|
||||||
# Configuration front-end
|
|
||||||
NEXT_PUBLIC_4NK_URL=https://ihm-client.4nk.local
|
|
||||||
NEXT_PUBLIC_FRONT_APP_HOST=http://coffre-front.4nk.local:3000
|
|
||||||
NEXT_PUBLIC_IDNOT_BASE_URL=https://qual-connexion.idnot.fr
|
|
||||||
NEXT_PUBLIC_IDNOT_AUTHORIZE_ENDPOINT=/IdPOAuth2/authorize/idnot_idp_v1
|
|
||||||
NEXT_PUBLIC_IDNOT_CLIENT_ID=4501646203F3EF67
|
|
||||||
NEXT_PUBLIC_BACK_API_PROTOCOL=http
|
|
||||||
NEXT_PUBLIC_BACK_API_HOST=miniback.4nk.local
|
|
||||||
BACK_API_PORT=8080
|
|
||||||
BACK_API_ROOT_URL=/api
|
|
||||||
BACK_API_VERSION=/v1
|
|
||||||
|
|
||||||
# Configuration idnot
|
|
||||||
IDNOT_ANNUARY_BASE_URL='https://qual-api.notaires.fr/annuaire'
|
|
||||||
IDNOT_API_KEY='ba557f84-0bf6-4dbf-844f-df2767555e3e'
|
|
||||||
|
|
||||||
# Configuration PostgreSQL
|
|
||||||
DB_HOST=
|
|
||||||
DB_PORT=
|
|
||||||
DB_NAME=
|
|
||||||
DB_USER=
|
|
||||||
DB_PASSWORD=
|
|
||||||
|
|
||||||
LOG_LEVEL="debug"
|
|
||||||
|
|||||||
@ -1,10 +1,31 @@
|
|||||||
EXT_PUBLIC_4NK_URL="http://ihm-client.4nk.local:3003"
|
# Configuration LeCoffre Front
|
||||||
NEXT_PUBLIC_FRONT_APP_HOST="http://coffre-front.4nk.local:3000"
|
# Copier ce fichier vers .env et adapter les valeurs
|
||||||
NEXT_PUBLIC_IDNOT_BASE_URL="https://qual-connexion.idnot.fr"
|
|
||||||
NEXT_PUBLIC_IDNOT_AUTHORIZE_ENDPOINT="/IdPOAuth2/authorize/idnot_idp_v1"
|
# Configuration API Backend
|
||||||
NEXT_PUBLIC_IDNOT_CLIENT_ID="4501646203F3EF67"
|
REACT_APP_API_URL=http://coffre-back-mini.4nk.local:8081/api/v1
|
||||||
NEXT_PUBLIC_BACK_API_PROTOCOL=http://
|
REACT_APP_API_TIMEOUT=30000
|
||||||
NEXT_PUBLIC_BACK_API_HOST=miniback.4nk.local
|
|
||||||
NEXT_PUBLIC_BACK_API_PORT=8080
|
# Configuration 4NK
|
||||||
NEXT_PUBLIC_BACK_API_ROOT_URL=/api
|
REACT_APP_SDK_STORAGE_URL=http://sdk-storage.4nk.local:80
|
||||||
NEXT_PUBLIC_BACK_API_VERSION=/v1
|
REACT_APP_SDK_RELAY_URL=http://sdk-relay1.4nk.local:80
|
||||||
|
REACT_APP_SDK_SIGNER_URL=http://sdk-signer.4nk.local:80
|
||||||
|
|
||||||
|
# Configuration Bitcoin
|
||||||
|
REACT_APP_BITCOIN_NETWORK=signet
|
||||||
|
REACT_APP_BITCOIN_RPC_URL=http://bitcoin.4nk.local:38332
|
||||||
|
|
||||||
|
# Configuration Tor
|
||||||
|
REACT_APP_TOR_PROXY_URL=socks5://tor.4nk.local:9050
|
||||||
|
|
||||||
|
# Configuration UI
|
||||||
|
REACT_APP_THEME=dark
|
||||||
|
REACT_APP_LANGUAGE=fr
|
||||||
|
REACT_APP_DEBUG=false
|
||||||
|
|
||||||
|
# Configuration sécurité
|
||||||
|
REACT_APP_ENABLE_2FA=true
|
||||||
|
REACT_APP_SESSION_TIMEOUT=3600000
|
||||||
|
|
||||||
|
# Configuration logs
|
||||||
|
REACT_APP_LOG_LEVEL=info
|
||||||
|
REACT_APP_ENABLE_ANALYTICS=false
|
||||||
|
|||||||
59
scripts/start-dnsmasq.sh
Executable file
59
scripts/start-dnsmasq.sh
Executable file
@ -0,0 +1,59 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Script de démarrage dnsmasq pour 4NK
|
||||||
|
# Résout les noms Docker 4NK sur le port 5353
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||||
|
PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
|
||||||
|
DNSMASQ_CONF="$PROJECT_ROOT/conf/dnsmasq/dnsmasq.conf"
|
||||||
|
|
||||||
|
echo "🚀 Démarrage dnsmasq pour 4NK..."
|
||||||
|
|
||||||
|
# Vérifier que la configuration existe
|
||||||
|
if [ ! -f "$DNSMASQ_CONF" ]; then
|
||||||
|
echo "❌ Configuration dnsmasq non trouvée: $DNSMASQ_CONF"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Arrêter dnsmasq s'il tourne déjà
|
||||||
|
if pgrep -f "dnsmasq.*5353" > /dev/null; then
|
||||||
|
echo "🛑 Arrêt dnsmasq existant..."
|
||||||
|
pkill -f "dnsmasq.*5353" || true
|
||||||
|
sleep 2
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Démarrer dnsmasq avec la configuration 4NK
|
||||||
|
echo "🔧 Démarrage dnsmasq sur le port 5353..."
|
||||||
|
dnsmasq --conf-file="$DNSMASQ_CONF" --no-daemon &
|
||||||
|
|
||||||
|
DNSMASQ_PID=$!
|
||||||
|
echo "✅ dnsmasq démarré avec PID: $DNSMASQ_PID"
|
||||||
|
|
||||||
|
# Tester la résolution
|
||||||
|
echo "🧪 Test de résolution DNS..."
|
||||||
|
sleep 2
|
||||||
|
|
||||||
|
# Test des noms Docker
|
||||||
|
for hostname in "tor.4nk.local" "bitcoin.4nk.local" "coffre-front.4nk.local"; do
|
||||||
|
echo -n " Test $hostname: "
|
||||||
|
if nslookup -port=5353 "$hostname" 127.0.0.1 > /dev/null 2>&1; then
|
||||||
|
echo "✅ OK"
|
||||||
|
else
|
||||||
|
echo "❌ Échec"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
echo "📋 Configuration dnsmasq:"
|
||||||
|
echo " - Port: 5353"
|
||||||
|
echo " - Interface: 127.0.0.1"
|
||||||
|
echo " - Configuration: $DNSMASQ_CONF"
|
||||||
|
echo " - PID: $DNSMASQ_PID"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "🔧 Pour utiliser dnsmasq, configurez votre système:"
|
||||||
|
echo " - Ajoutez 'nameserver 127.0.0.1' dans /etc/resolv.conf"
|
||||||
|
echo " - Ou utilisez: nslookup -port=5353 <nom> 127.0.0.1"
|
||||||
|
echo ""
|
||||||
|
echo "🛑 Pour arrêter: kill $DNSMASQ_PID"
|
||||||
Loading…
x
Reference in New Issue
Block a user