93 lines
3.9 KiB
Plaintext
93 lines
3.9 KiB
Plaintext
# ──────────────────────────────────────────────────────────────
|
||
# Reverse-proxy для TailAndPaws
|
||
# Сервер: отдельная машина с nginx + certbot
|
||
# Приложение: другой сервер, порт 8080 (docker-compose)
|
||
#
|
||
# Расположение: /etc/nginx/sites-available/tailandpaws.conf
|
||
# Симлинк: ln -s /etc/nginx/sites-available/tailandpaws.conf /etc/nginx/sites-enabled/
|
||
#
|
||
# Получить сертификат (первый раз):
|
||
# sudo systemctl stop nginx
|
||
# sudo certbot certonly --standalone -d tailandpaws.cloud-copp74.ru
|
||
# sudo systemctl start nginx
|
||
#
|
||
# Авторенновление — добавить в crontab (sudo crontab -e):
|
||
# 0 3 * * * certbot renew --pre-hook "systemctl stop nginx" --post-hook "systemctl start nginx" --quiet
|
||
# ──────────────────────────────────────────────────────────────
|
||
|
||
# HTTP → HTTPS redirect
|
||
server {
|
||
listen 80;
|
||
listen [::]:80;
|
||
server_name tailandpaws.cloud-copp74.ru;
|
||
|
||
# Запрет прямого доступа, только редирект
|
||
location / {
|
||
return 301 https://$host$request_uri;
|
||
}
|
||
}
|
||
|
||
# HTTPS
|
||
server {
|
||
listen 443 ssl;
|
||
listen [::]:443 ssl;
|
||
server_name tailandpaws.cloud-copp74.ru;
|
||
|
||
# Certbot standalone сертификаты
|
||
ssl_certificate /etc/letsencrypt/live/tailandpaws.cloud-copp74.ru/fullchain.pem;
|
||
ssl_certificate_key /etc/letsencrypt/live/tailandpaws.cloud-copp74.ru/privkey.pem;
|
||
|
||
# Современные TLS настройки
|
||
ssl_protocols TLSv1.2 TLSv1.3;
|
||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
|
||
ssl_prefer_server_ciphers off;
|
||
ssl_session_cache shared:SSL:10m;
|
||
ssl_session_timeout 1d;
|
||
ssl_session_tickets off;
|
||
|
||
# HSTS — раскомментировать после проверки что HTTPS стабильно работает
|
||
# add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
|
||
|
||
# Security headers
|
||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||
add_header X-Content-Type-Options "nosniff" always;
|
||
add_header X-XSS-Protection "1; mode=block" always;
|
||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||
|
||
# Логи
|
||
access_log /var/log/nginx/tailandpaws.access.log;
|
||
error_log /var/log/nginx/tailandpaws.error.log warn;
|
||
|
||
# Размер тела запроса (загрузка файлов)
|
||
client_max_body_size 64M;
|
||
|
||
location / {
|
||
# !! Замените YOUR_APP_SERVER_IP на реальный IP сервера с docker
|
||
proxy_pass http://YOUR_APP_SERVER_IP:8080;
|
||
proxy_http_version 1.1;
|
||
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_set_header X-Forwarded-Port $server_port;
|
||
|
||
proxy_connect_timeout 60s;
|
||
proxy_send_timeout 60s;
|
||
proxy_read_timeout 60s;
|
||
proxy_buffering off;
|
||
|
||
# WebSocket support
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection $connection_upgrade;
|
||
}
|
||
}
|
||
|
||
# WebSocket upgrade map (нужен вне server-блока, на уровне http)
|
||
# Добавьте в /etc/nginx/nginx.conf внутри блока http {}:
|
||
#
|
||
# map $http_upgrade $connection_upgrade {
|
||
# default upgrade;
|
||
# '' close;
|
||
# }
|