From 44e584636ed180f70dc118f96ff94f78538d98f4 Mon Sep 17 00:00:00 2001 From: "srvproxy001.itguys.com.br" Date: Wed, 8 Oct 2025 22:48:31 -0300 Subject: [PATCH] =?UTF-8?q?[Auto-Sync]=20Atualiza=C3=A7=C3=A3o=20das=20con?= =?UTF-8?q?figura=C3=A7=C3=B5es=20em=20srvproxy001.itguys.com.br=20-=20202?= =?UTF-8?q?5-10-08=2022:48:31?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- nginx/sites-available/pralog.com.br.conf | 155 +++++++++++++++++++++++ 1 file changed, 155 insertions(+) create mode 100644 nginx/sites-available/pralog.com.br.conf diff --git a/nginx/sites-available/pralog.com.br.conf b/nginx/sites-available/pralog.com.br.conf new file mode 100644 index 0000000..c652890 --- /dev/null +++ b/nginx/sites-available/pralog.com.br.conf @@ -0,0 +1,155 @@ +# ==================================================================================== +# Configuração NGINX para: pralog.com.br (Proxy Reverso para WordPress) +# Data da Criação/Alteração: 2025-10-08 (v2 - Sem includes) +# +# Contexto: +# - Atua como proxy reverso para um backend WordPress em https://172.16.12.25. +# - Implementa cache de arquivos estáticos para otimizar a entrega. +# - Aplica regras de segurança robustas para mitigar bots maliciosos e ataques comuns. +# - Garante configuração SSL/TLS segura (nota A+ no SSL Labs). +# - Inclui rate limiting para proteger o endpoint de login. +# - Todas as diretivas são declaradas diretamente, sem 'includes'. +# ==================================================================================== + +# --- Definições Globais (fora do bloco 'server') --- +limit_req_zone $binary_remote_addr zone=wp_login:10m rate=5r/m; + +map $http_user_agent $block_bad_bots { + default 0; + "~*(sqlmap|nikto|wpscan|python-requests|curl|wget|nmap)" 1; + "~*(nessus|acunetix|masscan|zgrab)" 1; + "~*BLEXBot" 1; +} + +# --- Servidor HTTP (Porta 80) -> Redirecionamento para HTTPS --- +server { + listen 80; + listen [::]:80; + server_name pralog.com.br www.pralog.com.br; + + access_log /var/log/nginx/pralog.com.br.redirects.log; + error_log /var/log/nginx/pralog.com.br.redirects.error.log; + + return 301 https://$host$request_uri; +} + +# --- Servidor HTTPS (Porta 443) - Configuração Principal --- +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name pralog.com.br www.pralog.com.br; + + root /var/www/html; # Fallback + + # Logs Específicos do Site + access_log /var/log/nginx/pralog.com.br.access.log; + error_log /var/log/nginx/pralog.com.br.error.log warn; + + # ----------------------------------------------------------------- + # SSL/TLS - Configuração de Segurança + # ----------------------------------------------------------------- + # ATENÇÃO: Descomente e aponte para seus certificados quando estiverem prontos. + # Por enquanto, use um certificado autoassinado para testes. + # ssl_certificate /etc/ssl/certs/pralog_selfsigned.pem; + # ssl_certificate_key /etc/ssl/private/pralog_selfsigned.key; + + ssl_protocols TLSv1.2 TLSv1.3; + ssl_prefer_server_ciphers on; + ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384'; + ssl_session_timeout 1d; + ssl_session_tickets off; + + # NOTA: OCSP Stapling requer um certificado de uma CA confiável. Mantenha comentado com certificado autoassinado. + # ssl_stapling on; + # ssl_stapling_verify on; + # ssl_trusted_certificate /etc/letsencrypt/live/pralog.com.br/fullchain.pem; + + # ----------------------------------------------------------------- + # Headers de Segurança + # ----------------------------------------------------------------- + add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header Referrer-Policy "no-referrer-when-downgrade" always; + + # ----------------------------------------------------------------- + # Proteção Contra Bots e Acessos Indevidos + # ----------------------------------------------------------------- + if ($block_bad_bots) { + return 404; + } + + location ~ /\. { deny all; } + location ~* /(?:setup\.php|README\.md|readme\.html|license\.txt|wp-config-sample\.php|web\.config) { deny all; } + location ~* \.(env|git|svn|bak|sql|zip|tar\.gz)$ { deny all; } + location = /xmlrpc.php { deny all; } + + # Proteção contra força bruta na página de login + location = /wp-login.php { + limit_req zone=wp_login burst=3 nodelay; + + proxy_pass https://172.16.12.25; + + # Parâmetros do Proxy + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_ssl_server_name on; + proxy_ssl_name $host; + proxy_http_version 1.1; + proxy_set_header Connection "upgrade"; + proxy_read_timeout 90s; + proxy_buffering off; + } + + # ----------------------------------------------------------------- + # Cache para Arquivos Estáticos + # ----------------------------------------------------------------- + location ~* \.(jpg|jpeg|gif|png|webp|svg|ico|css|js|woff|woff2|ttf|eot)$ { + proxy_pass https://172.16.12.25; + + # Parâmetros do Proxy para estáticos + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_ssl_server_name on; + proxy_ssl_name $host; + + # Cache + expires 30d; + add_header Cache-Control "public"; + + # Performance + access_log off; + } + + # ----------------------------------------------------------------- + # Configuração Principal do Proxy Reverso para o WordPress + # ----------------------------------------------------------------- + location / { + proxy_pass https://172.16.12.25; + + # Headers essenciais para o proxy + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-Port $server_port; + + # Comunicação com o backend HTTPS + proxy_ssl_server_name on; + proxy_ssl_name $host; + + # Otimizações e Timeouts + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_connect_timeout 90s; + proxy_send_timeout 90s; + proxy_read_timeout 90s; + proxy_buffering off; + } +}