testee

app/Http/Middleware/TrustProxies.php

@@ -12,7 +12,7 @@ class TrustProxies extends Middleware
      *
      * @var array<int, string>|string|null
      */
-    protected $proxies;
+    protected $proxies = '*';
 
     /**
      * The headers that should be used to detect proxies.

docker-compose.yml

@@ -8,7 +8,7 @@ services:
     environment:
       APP_ENV: production
       APP_DEBUG: "false"
-      APP_URL: http://localhost
+      APP_URL: https://tailandpaws.cloud-copp74.ru
       DB_CONNECTION: mysql
       DB_HOST: db
       DB_PORT: 3306

docker/entrypoint.sh

@@ -1,6 +1,12 @@
 #!/bin/sh
 set -e
 
+echo "Waiting for database..."
+until php -r "new PDO('mysql:host='.getenv('DB_HOST').';port='.(getenv('DB_PORT')?:3306), getenv('DB_USERNAME'), getenv('DB_PASSWORD'));" 2>/dev/null; do
+    echo "DB not ready, retrying in 2s..."
+    sleep 2
+done
+
 echo "Running database migrations..."
 php artisan migrate --force --no-interaction
 

docker/nginx/reverse-proxy.conf

@@ -0,0 +1,92 @@
+# ──────────────────────────────────────────────────────────────
+# Reverse-proxy для TailAndPaws
+# Сервер: отдельная машина с nginx + certbot
+# Приложение: другой сервер, порт 8080 (docker-compose)
+#
+# Расположение: /etc/nginx/sites-available/tailandpaws.conf
+# Симлинк:      ln -s /etc/nginx/sites-available/tailandpaws.conf /etc/nginx/sites-enabled/
+#
+# Получить сертификат (первый раз):
+#   sudo systemctl stop nginx
+#   sudo certbot certonly --standalone -d tailandpaws.cloud-copp74.ru
+#   sudo systemctl start nginx
+#
+# Авторенновление — добавить в crontab (sudo crontab -e):
+#   0 3 * * * certbot renew --pre-hook "systemctl stop nginx" --post-hook "systemctl start nginx" --quiet
+# ──────────────────────────────────────────────────────────────
+
+# HTTP → HTTPS redirect
+server {
+    listen 80;
+    listen [::]:80;
+    server_name tailandpaws.cloud-copp74.ru;
+
+    # Запрет прямого доступа, только редирект
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+# HTTPS
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name tailandpaws.cloud-copp74.ru;
+
+    # Certbot standalone сертификаты
+    ssl_certificate     /etc/letsencrypt/live/tailandpaws.cloud-copp74.ru/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/tailandpaws.cloud-copp74.ru/privkey.pem;
+
+    # Современные TLS настройки
+    ssl_protocols             TLSv1.2 TLSv1.3;
+    ssl_ciphers               ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers off;
+    ssl_session_cache         shared:SSL:10m;
+    ssl_session_timeout       1d;
+    ssl_session_tickets       off;
+
+    # HSTS — раскомментировать после проверки что HTTPS стабильно работает
+    # add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+
+    # Security headers
+    add_header X-Frame-Options        "SAMEORIGIN"                   always;
+    add_header X-Content-Type-Options "nosniff"                      always;
+    add_header X-XSS-Protection       "1; mode=block"                always;
+    add_header Referrer-Policy        "strict-origin-when-cross-origin" always;
+
+    # Логи
+    access_log /var/log/nginx/tailandpaws.access.log;
+    error_log  /var/log/nginx/tailandpaws.error.log warn;
+
+    # Размер тела запроса (загрузка файлов)
+    client_max_body_size 64M;
+
+    location / {
+        # !! Замените YOUR_APP_SERVER_IP на реальный IP сервера с docker
+        proxy_pass         http://YOUR_APP_SERVER_IP:8080;
+        proxy_http_version 1.1;
+
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Port  $server_port;
+
+        proxy_connect_timeout 60s;
+        proxy_send_timeout    60s;
+        proxy_read_timeout    60s;
+        proxy_buffering       off;
+
+        # WebSocket support
+        proxy_set_header Upgrade    $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+    }
+}
+
+# WebSocket upgrade map (нужен вне server-блока, на уровне http)
+# Добавьте в /etc/nginx/nginx.conf внутри блока http {}:
+#
+#   map $http_upgrade $connection_upgrade {
+#       default upgrade;
+#       ''      close;
+#   }