111 lines
4.5 KiB
Text
111 lines
4.5 KiB
Text
# Reverse proxy + TLS edge for «Контракт-чек».
|
|
# Variables ${NGINX_SERVER_NAME} are expanded by the nginx Docker entrypoint
|
|
# from files in /etc/nginx/templates/*.template. Mount this directory:
|
|
#
|
|
# ./deploy/nginx/templates:/etc/nginx/templates:ro
|
|
#
|
|
# Do not run `nginx -t` directly on this .template file; render it first with
|
|
# envsubst or start the container.
|
|
|
|
# ── Upstreams ───────────────────────────────────────────────────────────────
|
|
# In Docker Compose the `api` hostname resolves via the project network.
|
|
upstream api {
|
|
server api:8000;
|
|
}
|
|
|
|
# ── Logging ─────────────────────────────────────────────────────────────────
|
|
log_format contract_check '$remote_addr - $remote_user [$time_local] "$request" '
|
|
'$status $body_bytes_sent "$http_referer" '
|
|
'"$http_user_agent" "$http_x_forwarded_for" '
|
|
'rt=$request_time cid=$http_x_correlation_id';
|
|
|
|
access_log /var/log/nginx/access.log contract_check;
|
|
|
|
# Body limit: contracts may be large PDFs/DOCX (default 50 MiB).
|
|
client_max_body_size 50M;
|
|
|
|
# ── HTTP → HTTPS redirect (certbot handles LE challenge inline) ───────────────
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name ${NGINX_SERVER_NAME};
|
|
|
|
location /.well-known/acme-challenge/ {
|
|
root /var/www/certbot;
|
|
}
|
|
|
|
location / {
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
}
|
|
|
|
# ── HTTPS server ──────────────────────────────────────────────────────────────
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
http2 on;
|
|
server_name ${NGINX_SERVER_NAME};
|
|
|
|
ssl_certificate /etc/letsencrypt/live/${NGINX_SERVER_NAME}/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/${NGINX_SERVER_NAME}/privkey.pem;
|
|
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
|
|
ssl_prefer_server_ciphers on;
|
|
ssl_session_cache shared:SSL:10m;
|
|
ssl_session_timeout 1d;
|
|
|
|
# Security headers
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
|
|
# Public endpoints: health, metrics, B2B API, auth, document analysis.
|
|
# /metrics is intentionally exposed here for external Prometheus scrape;
|
|
# lock it down at the firewall (or remove this block if metrics must stay
|
|
# private and are scraped by an in-compose Prometheus).
|
|
location ~ ^/(healthz|readyz|metrics|api/|admin/|docs|openapi.json) {
|
|
proxy_pass http://api;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-Port $server_port;
|
|
proxy_set_header X-Correlation-Id $http_x_correlation_id;
|
|
|
|
proxy_connect_timeout 10s;
|
|
proxy_send_timeout 30s;
|
|
proxy_read_timeout 120s;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
# Webhook endpoint for future payment providers (ЮKassa, etc.).
|
|
# Kept separate so it's easy to add IP allow-listing or extra logging.
|
|
location /webhook/ {
|
|
proxy_pass http://api/api/v1/webhooks/;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
proxy_connect_timeout 10s;
|
|
proxy_send_timeout 30s;
|
|
proxy_read_timeout 60s;
|
|
}
|
|
|
|
# Static web SPA (future). Placeholder: serve pre-built static assets.
|
|
# location / {
|
|
# root /usr/share/nginx/html;
|
|
# try_files $uri $uri/ /index.html;
|
|
# }
|
|
|
|
# Default: 404. Remove this when the static web SPA is enabled above.
|
|
location / {
|
|
return 404;
|
|
}
|
|
}
|