f9fe0e3419
**Motivations:** - Partie connectée du skeleton accessible seulement si pairing satisfait + relais OK, avec page type skeleton (avatar, notifications). - Éviter « Aucun service disponible » : contrat présent en dur dans la page, transmis à l’iframe ; navigation évidente ou automatique vers login. - Sécuriser postMessage (origine UserWallet uniquement) ; déployer data sur le proxy et certificat data.certificator.4nkweb.com. - Vulgariser cryptographie (ECDH, AES-GCM, Schnorr, workflow, collecte signatures) ; documenter correctifs et architecture. **Root causes:** - Section connectée affichée sans vérifier pairing/relay ; possibilité de forger pairing-relay-status depuis la console. - Iframe masquée ou /login chargé avant réception du contrat → graphe vide, redirection vers /services. - Pas de contrôle d’origine sur les messages reçus ; pas de projet website-data ni config Nginx/certificat pour data. **Correctifs:** - Vérification msg.origin === USERWALLET_ORIGIN dans handleMessage (skeleton). - Si session mais pas pairingRelayStatus : afficher iframe pour réception du statut, message « Vérification du statut… ». - Contrat envoyé dès load iframe (init iframe.src = USERWALLET_ORIGIN) ; au clic « Se connecter », envoi contract + navigate-login (service, membre). - UserWallet : écoute navigate-login → navigation /login?service=&membre= ; LoginScreen avec service+membre en URL ne redirige plus vers /services, dispatch E_SELECT_SERVICE / E_SELECT_MEMBER. **Evolutions:** - Message pairing-relay-status (iframe → parent) ; canShowConnectedSection exige login + pairing OK + relay OK ; page connectée avec header avatar + icône notifications. - Skeleton : getLoginContext, sendNavigateLoginToIframe, onIframeLoad, loginRequested/iframeLoaded ; contrat envoyé avec serviceUuid, membreUuid. - UserWallet : PairingRelayStatusMessage, envoi depuis HomeScreen/LoginScreen ; type navigate-login, handleNavigateLogin dans useChannel. - Page cryptographie.html (workflow, algorithmes, collecte signatures) ; liens nav, build. - website-data (Vite, channel, config), start/service/install ; configure-nginx-proxy + Certbot pour data.certificator.4nkweb.com. - fixKnowledge (postmessage-origin, section-connectee-non-affichee) ; features (partie-connectee-pairing-relay, userwallet-iframe-key-isolation). **Pages affectées:** - website-skeleton (index, main, config, serviceContract, cryptographie, technique, membre, contrat, vite.config, README). - userwallet (HomeScreen, LoginScreen, useChannel, iframeChannel, relay, crypto, iframe, Pairing*, RelaySettings, WordInputGrid, syncUpdateGraph, specs/synthese). - website-data (nouveau), configure-nginx-proxy, docs DOMAINS_AND_PORTS README, features, fixKnowledge, userwallet features/docs.
392 lines
14 KiB
Bash
Executable File
392 lines
14 KiB
Bash
Executable File
#!/bin/bash
|
||
|
||
# Script de configuration Nginx pour les sous-domaines certificator.4nkweb.com
|
||
# Usage: ./configure-nginx-proxy.sh
|
||
|
||
set -e
|
||
|
||
PROXY_HOST="192.168.1.100"
|
||
PROXY_USER="ncantu"
|
||
NGINX_SITES_AVAILABLE="/etc/nginx/sites-available"
|
||
NGINX_SITES_ENABLED="/etc/nginx/sites-enabled"
|
||
CERTBOT_BIN="/usr/bin/certbot"
|
||
|
||
echo "=== Configuration Nginx pour certificator.4nkweb.com ==="
|
||
echo ""
|
||
|
||
# Vérifier que nous sommes sur le proxy ou que nous pouvons y accéder
|
||
# Note: Le script peut être exécuté localement ou via SSH
|
||
CURRENT_IP=$(hostname -I 2>/dev/null | awk '{print $1}' || echo "")
|
||
if [ "$CURRENT_IP" != "192.168.1.100" ] && [ -z "$SSH_CONNECTION" ]; then
|
||
echo "ℹ️ Ce script peut être exécuté sur le proxy (192.168.1.100)"
|
||
echo " Ou via SSH: ssh ${PROXY_USER}@${PROXY_HOST} 'sudo bash -s' < $0"
|
||
echo ""
|
||
fi
|
||
|
||
# Vérifier les permissions (sudo disponible pour ncantu)
|
||
if [ "$EUID" -ne 0 ]; then
|
||
if command -v sudo &> /dev/null && sudo -n true 2>/dev/null; then
|
||
echo "✅ Utilisation de sudo (droits non interactifs)"
|
||
# Le script continuera avec sudo pour les commandes nécessitant root
|
||
else
|
||
echo "⚠️ Ce script nécessite les permissions root pour configurer Nginx"
|
||
echo " Utilisez: sudo $0"
|
||
exit 1
|
||
fi
|
||
fi
|
||
|
||
# Fonction pour exécuter les commandes nécessitant root
|
||
SUDO_CMD=""
|
||
if [ "$EUID" -ne 0 ]; then
|
||
SUDO_CMD="sudo"
|
||
fi
|
||
|
||
echo "✅ Vérification de Nginx..."
|
||
# Vérifier Nginx (peut être dans /usr/sbin/nginx)
|
||
NGINX_BIN=""
|
||
if command -v nginx &> /dev/null; then
|
||
NGINX_BIN="nginx"
|
||
elif [ -f /usr/sbin/nginx ]; then
|
||
NGINX_BIN="/usr/sbin/nginx"
|
||
elif [ -f /usr/bin/nginx ]; then
|
||
NGINX_BIN="/usr/bin/nginx"
|
||
else
|
||
echo "❌ Nginx n'est pas installé"
|
||
exit 1
|
||
fi
|
||
echo " Nginx trouvé: ${NGINX_BIN}"
|
||
|
||
echo "✅ Vérification de Certbot..."
|
||
# Vérifier Certbot (peut être dans /usr/bin/certbot)
|
||
CERTBOT_BIN=""
|
||
if command -v certbot &> /dev/null; then
|
||
CERTBOT_BIN="certbot"
|
||
elif [ -f /usr/bin/certbot ]; then
|
||
CERTBOT_BIN="/usr/bin/certbot"
|
||
else
|
||
echo "⚠️ Certbot n'est pas installé. Installation..."
|
||
${SUDO_CMD} apt-get update
|
||
${SUDO_CMD} apt-get install -y certbot python3-certbot-nginx
|
||
CERTBOT_BIN="certbot"
|
||
fi
|
||
echo " Certbot trouvé: ${CERTBOT_BIN}"
|
||
|
||
# Créer les configurations Nginx pour chaque sous-domaine
|
||
|
||
# 1. Dashboard (port 3020)
|
||
echo ""
|
||
echo "📝 Configuration de dashboard.certificator.4nkweb.com..."
|
||
${SUDO_CMD} tee "${NGINX_SITES_AVAILABLE}/dashboard.certificator.4nkweb.com" > /dev/null << 'EOF'
|
||
# Dashboard Bitcoin Signet
|
||
server {
|
||
listen 80;
|
||
server_name dashboard.certificator.4nkweb.com;
|
||
|
||
# Logs
|
||
access_log /var/log/nginx/dashboard.certificator.4nkweb.com.access.log;
|
||
error_log /var/log/nginx/dashboard.certificator.4nkweb.com.error.log;
|
||
|
||
# Proxy vers le service Node.js (port 3020)
|
||
# Note: Les services tournent sur 192.168.1.105
|
||
location / {
|
||
proxy_pass http://192.168.1.105:3020;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection 'upgrade';
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_cache_bypass $http_upgrade;
|
||
proxy_read_timeout 300s;
|
||
proxy_connect_timeout 75s;
|
||
}
|
||
}
|
||
EOF
|
||
|
||
# 2. Faucet (port 3021)
|
||
echo "📝 Configuration de faucet.certificator.4nkweb.com..."
|
||
${SUDO_CMD} tee "${NGINX_SITES_AVAILABLE}/faucet.certificator.4nkweb.com" > /dev/null << 'EOF'
|
||
# API Faucet Bitcoin Signet
|
||
server {
|
||
listen 80;
|
||
server_name faucet.certificator.4nkweb.com;
|
||
|
||
# Logs
|
||
access_log /var/log/nginx/faucet.certificator.4nkweb.com.access.log;
|
||
error_log /var/log/nginx/faucet.certificator.4nkweb.com.error.log;
|
||
|
||
# Proxy vers le service Node.js (port 3021)
|
||
# Note: Les services tournent sur 192.168.1.105
|
||
location / {
|
||
proxy_pass http://192.168.1.105:3021;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection 'upgrade';
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_cache_bypass $http_upgrade;
|
||
proxy_read_timeout 300s;
|
||
proxy_connect_timeout 75s;
|
||
}
|
||
}
|
||
EOF
|
||
|
||
# 3. Anchorage (port 3010)
|
||
echo "📝 Configuration de anchorage.certificator.4nkweb.com..."
|
||
${SUDO_CMD} tee "${NGINX_SITES_AVAILABLE}/anchorage.certificator.4nkweb.com" > /dev/null << 'EOF'
|
||
# API Anchorage Bitcoin Signet
|
||
server {
|
||
listen 80;
|
||
server_name anchorage.certificator.4nkweb.com;
|
||
|
||
# Logs
|
||
access_log /var/log/nginx/anchorage.certificator.4nkweb.com.access.log;
|
||
error_log /var/log/nginx/anchorage.certificator.4nkweb.com.error.log;
|
||
|
||
# Proxy vers le service Node.js (port 3010)
|
||
# Note: Les services tournent sur 192.168.1.105
|
||
location / {
|
||
proxy_pass http://192.168.1.105:3010;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection 'upgrade';
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_cache_bypass $http_upgrade;
|
||
proxy_read_timeout 300s;
|
||
proxy_connect_timeout 75s;
|
||
}
|
||
}
|
||
EOF
|
||
|
||
# 4. Watermark (port 3022)
|
||
echo "📝 Configuration de watermark.certificator.4nkweb.com..."
|
||
${SUDO_CMD} tee "${NGINX_SITES_AVAILABLE}/watermark.certificator.4nkweb.com" > /dev/null << 'EOF'
|
||
# API Watermark Bitcoin Signet
|
||
server {
|
||
listen 80;
|
||
server_name watermark.certificator.4nkweb.com;
|
||
|
||
# Logs
|
||
access_log /var/log/nginx/watermark.certificator.4nkweb.com.access.log;
|
||
error_log /var/log/nginx/watermark.certificator.4nkweb.com.error.log;
|
||
|
||
# Proxy vers le service Node.js (port 3022)
|
||
# Note: Les services tournent sur 192.168.1.105
|
||
location / {
|
||
proxy_pass http://192.168.1.105:3022;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection 'upgrade';
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_cache_bypass $http_upgrade;
|
||
proxy_read_timeout 300s;
|
||
proxy_connect_timeout 75s;
|
||
}
|
||
}
|
||
EOF
|
||
|
||
# 5. UserWallet (port 3018)
|
||
echo "📝 Configuration de userwallet.certificator.4nkweb.com..."
|
||
${SUDO_CMD} tee "${NGINX_SITES_AVAILABLE}/userwallet.certificator.4nkweb.com" > /dev/null << 'EOF'
|
||
# UserWallet frontend (Vite)
|
||
server {
|
||
listen 80;
|
||
server_name userwallet.certificator.4nkweb.com;
|
||
|
||
# Logs
|
||
access_log /var/log/nginx/userwallet.certificator.4nkweb.com.access.log;
|
||
error_log /var/log/nginx/userwallet.certificator.4nkweb.com.error.log;
|
||
|
||
# Proxy vers le frontend UserWallet (port 3018) sur 192.168.1.105
|
||
location / {
|
||
proxy_pass http://192.168.1.105:3018;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection 'upgrade';
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_cache_bypass $http_upgrade;
|
||
proxy_read_timeout 300s;
|
||
proxy_connect_timeout 75s;
|
||
}
|
||
}
|
||
EOF
|
||
|
||
# 6. Website skeleton (port 3024)
|
||
echo "📝 Configuration de skeleton.certificator.4nkweb.com..."
|
||
${SUDO_CMD} tee "${NGINX_SITES_AVAILABLE}/skeleton.certificator.4nkweb.com" > /dev/null << 'EOF'
|
||
# Website skeleton (UserWallet iframe)
|
||
server {
|
||
listen 80;
|
||
server_name skeleton.certificator.4nkweb.com;
|
||
|
||
access_log /var/log/nginx/skeleton.certificator.4nkweb.com.access.log;
|
||
error_log /var/log/nginx/skeleton.certificator.4nkweb.com.error.log;
|
||
|
||
location / {
|
||
proxy_pass http://192.168.1.105:3024;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection 'upgrade';
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_cache_bypass $http_upgrade;
|
||
proxy_read_timeout 300s;
|
||
proxy_connect_timeout 75s;
|
||
}
|
||
}
|
||
EOF
|
||
|
||
# 7. Website data (port 3025)
|
||
echo "📝 Configuration de data.certificator.4nkweb.com..."
|
||
${SUDO_CMD} tee "${NGINX_SITES_AVAILABLE}/data.certificator.4nkweb.com" > /dev/null << 'EOF'
|
||
# Website data (iframe data, non clés)
|
||
server {
|
||
listen 80;
|
||
server_name data.certificator.4nkweb.com;
|
||
|
||
access_log /var/log/nginx/data.certificator.4nkweb.com.access.log;
|
||
error_log /var/log/nginx/data.certificator.4nkweb.com.error.log;
|
||
|
||
location / {
|
||
proxy_pass http://192.168.1.105:3025;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection 'upgrade';
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_cache_bypass $http_upgrade;
|
||
proxy_read_timeout 300s;
|
||
proxy_connect_timeout 75s;
|
||
}
|
||
}
|
||
EOF
|
||
|
||
# 8. Relay / api-relay (port 3019)
|
||
echo "📝 Configuration de relay.certificator.4nkweb.com..."
|
||
${SUDO_CMD} tee "${NGINX_SITES_AVAILABLE}/relay.certificator.4nkweb.com" > /dev/null << 'EOF'
|
||
# API Relay (UserWallet)
|
||
server {
|
||
listen 80;
|
||
server_name relay.certificator.4nkweb.com;
|
||
|
||
# Logs
|
||
access_log /var/log/nginx/relay.certificator.4nkweb.com.access.log;
|
||
error_log /var/log/nginx/relay.certificator.4nkweb.com.error.log;
|
||
|
||
# Proxy vers api-relay (port 3019) sur 192.168.1.105
|
||
location / {
|
||
proxy_pass http://192.168.1.105:3019;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection 'upgrade';
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_cache_bypass $http_upgrade;
|
||
proxy_read_timeout 300s;
|
||
proxy_connect_timeout 75s;
|
||
}
|
||
}
|
||
EOF
|
||
|
||
# Activer les sites
|
||
echo ""
|
||
echo "🔗 Activation des sites..."
|
||
${SUDO_CMD} ln -sf "${NGINX_SITES_AVAILABLE}/dashboard.certificator.4nkweb.com" "${NGINX_SITES_ENABLED}/dashboard.certificator.4nkweb.com"
|
||
${SUDO_CMD} ln -sf "${NGINX_SITES_AVAILABLE}/faucet.certificator.4nkweb.com" "${NGINX_SITES_ENABLED}/faucet.certificator.4nkweb.com"
|
||
${SUDO_CMD} ln -sf "${NGINX_SITES_AVAILABLE}/anchorage.certificator.4nkweb.com" "${NGINX_SITES_ENABLED}/anchorage.certificator.4nkweb.com"
|
||
${SUDO_CMD} ln -sf "${NGINX_SITES_AVAILABLE}/watermark.certificator.4nkweb.com" "${NGINX_SITES_ENABLED}/watermark.certificator.4nkweb.com"
|
||
${SUDO_CMD} ln -sf "${NGINX_SITES_AVAILABLE}/userwallet.certificator.4nkweb.com" "${NGINX_SITES_ENABLED}/userwallet.certificator.4nkweb.com"
|
||
${SUDO_CMD} ln -sf "${NGINX_SITES_AVAILABLE}/skeleton.certificator.4nkweb.com" "${NGINX_SITES_ENABLED}/skeleton.certificator.4nkweb.com"
|
||
${SUDO_CMD} ln -sf "${NGINX_SITES_AVAILABLE}/data.certificator.4nkweb.com" "${NGINX_SITES_ENABLED}/data.certificator.4nkweb.com"
|
||
${SUDO_CMD} ln -sf "${NGINX_SITES_AVAILABLE}/relay.certificator.4nkweb.com" "${NGINX_SITES_ENABLED}/relay.certificator.4nkweb.com"
|
||
|
||
# Tester la configuration Nginx
|
||
echo ""
|
||
echo "🔍 Test de la configuration Nginx..."
|
||
if ${SUDO_CMD} ${NGINX_BIN} -t; then
|
||
echo "✅ Configuration Nginx valide"
|
||
else
|
||
echo "❌ Erreur dans la configuration Nginx"
|
||
exit 1
|
||
fi
|
||
|
||
# Recharger Nginx (configuration HTTP uniquement pour l'instant)
|
||
echo ""
|
||
echo "🔄 Rechargement de Nginx (configuration HTTP)..."
|
||
${SUDO_CMD} systemctl reload nginx || ${SUDO_CMD} service nginx reload
|
||
|
||
# Générer les certificats SSL avec Certbot
|
||
echo ""
|
||
echo "🔐 Génération des certificats SSL avec Certbot..."
|
||
echo " Note: Certbot va automatiquement créer les configurations HTTPS"
|
||
echo ""
|
||
|
||
# Générer les certificats (un par un pour éviter les erreurs)
|
||
DOMAINS=(
|
||
"dashboard.certificator.4nkweb.com"
|
||
"faucet.certificator.4nkweb.com"
|
||
"anchorage.certificator.4nkweb.com"
|
||
"watermark.certificator.4nkweb.com"
|
||
"userwallet.certificator.4nkweb.com"
|
||
"skeleton.certificator.4nkweb.com"
|
||
"data.certificator.4nkweb.com"
|
||
"relay.certificator.4nkweb.com"
|
||
)
|
||
|
||
for domain in "${DOMAINS[@]}"; do
|
||
echo "📜 Génération du certificat pour ${domain}..."
|
||
# Certbot va automatiquement modifier la config pour ajouter HTTPS et redirection
|
||
if ${SUDO_CMD} ${CERTBOT_BIN} --nginx -d "${domain}" --non-interactive --agree-tos --email admin@4nkweb.com --redirect; then
|
||
echo "✅ Certificat généré et configuration HTTPS créée pour ${domain}"
|
||
else
|
||
echo "⚠️ Erreur lors de la génération du certificat pour ${domain}"
|
||
echo " Vous pouvez le générer manuellement avec:"
|
||
echo " sudo ${CERTBOT_BIN} --nginx -d ${domain}"
|
||
fi
|
||
done
|
||
|
||
# Recharger Nginx final
|
||
echo ""
|
||
echo "🔄 Rechargement final de Nginx..."
|
||
${SUDO_CMD} systemctl reload nginx || ${SUDO_CMD} service nginx reload
|
||
|
||
echo ""
|
||
echo "✅ Configuration terminée !"
|
||
echo ""
|
||
echo "📋 Résumé:"
|
||
echo " - dashboard.certificator.4nkweb.com -> http://192.168.1.105:3020"
|
||
echo " - faucet.certificator.4nkweb.com -> http://192.168.1.105:3021"
|
||
echo " - anchorage.certificator.4nkweb.com -> http://192.168.1.105:3010"
|
||
echo " - watermark.certificator.4nkweb.com -> http://192.168.1.105:3022"
|
||
echo " - userwallet.certificator.4nkweb.com -> http://192.168.1.105:3018"
|
||
echo " - skeleton.certificator.4nkweb.com -> http://192.168.1.105:3024"
|
||
echo " - data.certificator.4nkweb.com -> http://192.168.1.105:3025"
|
||
echo " - relay.certificator.4nkweb.com -> http://192.168.1.105:3019"
|
||
echo ""
|
||
echo "⚠️ Note: Si les services tournent sur une autre machine,"
|
||
echo " modifiez les IP dans les fichiers de configuration Nginx"
|
||
echo ""
|
||
echo "🔍 Vérification:"
|
||
echo " - Test Nginx: nginx -t"
|
||
echo " - Status: systemctl status nginx"
|
||
echo " - Logs: tail -f /var/log/nginx/*.error.log"
|
||
echo ""
|