joao.goncalves
/
NgixProxy_Pathfinder
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(modsec/nginx): disable unicode map and fix http2 warnings

This commit is contained in:
João Pedro Toledo Goncalves 2026-01-27 09:41:27 -03:00
parent 5f6baaf5c2
commit 6ddf679e9c
3 changed files with 37 additions and 67 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

97
conf.d/gps.oestepan.com.br.conf
View File

@ -1,92 +1,42 @@
# ============================================================================== # ==============================================================================
# ARQUIVO: /etc/nginx/sites-available/gps.oestepan.com.br.conf # ARQUIVO: /etc/nginx/sites-available/gps.oestepan.com.br.conf
# AUTOR: Gemini (Especialista NGINX) # AUTOR: Gemini (Especialista NGINX)
# DATA: 26/01/2026 # DATA: 27/01/2026
# #
# CONTEXTO: # CONTEXTO:
# Proxy Reverso para Traccar GPS (OESTEPAN). # Proxy Reverso para Traccar GPS (OESTEPAN).
# Suporte essencial para WebSockets (/api/socket) para rastreamento em tempo real. # ModSecurity (WAF) termina o SSL e envia tráfego descriptografado para a porta 8080.
#
# UPSTREAM: host.docker.internal:8082 (Container Traccar no Host)
# ============================================================================== # ==============================================================================
# ------------------------------------------------------------------------------
# UPSTREAM: Servidor Traccar
# ------------------------------------------------------------------------------
upstream traccar_backend { upstream traccar_backend {
# 'host.docker.internal' funciona graças ao 'extra_hosts' no docker-compose.yml
# Certifique-se que o Traccar está expondo a porta 8082 no host.
server host.docker.internal:8083; server host.docker.internal:8083;
keepalive 32; keepalive 32;
} }
# ------------------------------------------------------------------------------ # ------------------------------------------------------------------------------
# BLOCO 1: Redirecionamento de HTTP (porta 80) para HTTPS # BLOCO PRINCIPAL: Porta 8080 (Tráfego vindo do ModSecurity)
# ------------------------------------------------------------------------------ # ------------------------------------------------------------------------------
server { server {
listen 80; listen 8080;
listen [::]:80; listen [::]:8080;
server_name gps.oestepan.com.br; server_name gps.oestepan.com.br;
include /etc/nginx/snippets/acme_challenge.conf; include /etc/nginx/snippets/acme_challenge.conf;
# Aplica o rate limiting global
limit_req zone=global_limit burst=20 nodelay; limit_req zone=global_limit burst=20 nodelay;
# Responde ao desafio do Let's Encrypt
# Redireciona todo o resto para HTTPS
location / {
return 301 https://$host$request_uri;
}
}
# ------------------------------------------------------------------------------
# BLOCO 2: Servidor Principal - Proxy Reverso para Traccar (HTTPS)
# ------------------------------------------------------------------------------
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name gps.oestepan.com.br;
# ============================================================================ # ============================================================================
# LOGS E LIMITAÇÃO # LOGS
# ============================================================================ # ============================================================================
client_max_body_size 50M; # Ajustado para possíveis uploads de firmware/imagem client_max_body_size 50M;
access_log /var/log/nginx/gps.oestepan.com.br.access.log detailed_proxy; access_log /var/log/nginx/gps.oestepan.com.br.access.log detailed_proxy;
error_log /var/log/nginx/gps.oestepan.com.br.error.log warn; error_log /var/log/nginx/gps.oestepan.com.br.error.log warn;
# Módulo de Segurança Global
if ($block_request) {
return 404;
}
limit_req zone=global_limit burst=100 nodelay;
# ============================================================================ # ============================================================================
# CONFIGURAÇÕES DE SSL/TLS # ROTAS (Sem SSL pois o WAF já terminou a encriptação)
# ============================================================================
ssl_certificate /etc/letsencrypt/live/gps.oestepan.com.br/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/gps.oestepan.com.br/privkey.pem;
ssl_protocols TLSv1.3 TLSv1.2;
ssl_ciphers 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305';
ssl_prefer_server_ciphers on;
ssl_session_timeout 1d;
ssl_session_tickets off;
# HSTS e Segurança
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
# ============================================================================
# ROTAS ESPECÍFICAS
# ============================================================================ # ============================================================================
# 1. WebSocket (CRÍTICO PARA O TRACCAR) # 1. WebSocket
# A rota /api/socket é usada para comunicação em tempo real
location /api/socket { location /api/socket {
proxy_pass http://traccar_backend; proxy_pass http://traccar_backend;
proxy_http_version 1.1; proxy_http_version 1.1;
@ -94,12 +44,12 @@ server {
proxy_set_header Connection "upgrade"; proxy_set_header Connection "upgrade";
proxy_set_header Host $host; proxy_set_header Host $host;
proxy_read_timeout 86400s; # Timeout de 24h para manter conexão aberta proxy_read_timeout 86400s;
proxy_send_timeout 86400s; proxy_send_timeout 86400s;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Proto https; # Informa ao backend que é HTTPS
} }
# 2. Rota Principal # 2. Rota Principal
@ -109,11 +59,30 @@ server {
proxy_set_header Host $host; proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Proto https; # Informa ao backend que é HTTPS
# Otimizações para API/Web proxy_buffering off;
proxy_buffering off; # Recomendado para apps interativos
proxy_request_buffering off; proxy_request_buffering off;
proxy_read_timeout 90s; proxy_read_timeout 90s;
} }
} }
# ------------------------------------------------------------------------------
# BLOCO DUMMY: Apenas para que o script renew_ssl.sh encontre os caminhos do SSL
# ------------------------------------------------------------------------------
server {
listen 443 ssl;
listen [::]:443 ssl;
http2 on;
server_name gps.oestepan.com.br;
# Important: These paths MUST be in /etc/nginx/ssl/ (shared volume)
# so ModSecurity can access them. renew_ssl.sh will copy the certs here.
ssl_certificate /etc/nginx/ssl/gps.oestepan.com.br.fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/gps.oestepan.com.br.privkey.pem;
# Retorna 444 (No Response) se alguém tentar conectar direto (bypass WAF)
location / {
return 444;
}
}

2
modsec.conf.template
View File

@ -24,7 +24,7 @@ SecAuditLogType ${MODSEC_AUDIT_LOG_TYPE}
SecAuditLog ${MODSEC_AUDIT_LOG} SecAuditLog ${MODSEC_AUDIT_LOG}
SecArgumentSeparator ${MODSEC_ARGUMENT_SEPARATOR} SecArgumentSeparator ${MODSEC_ARGUMENT_SEPARATOR}
SecCookieFormat ${MODSEC_COOKIE_FORMAT} SecCookieFormat ${MODSEC_COOKIE_FORMAT}
SecUnicodeMapFile unicode.mapping ${MODSEC_UNICODE_MAPPING} # SecUnicodeMapFile unicode.mapping ${MODSEC_UNICODE_MAPPING}
SecStatusEngine ${MODSEC_STATUS_ENGINE} SecStatusEngine ${MODSEC_STATUS_ENGINE}
# Additional directives # Additional directives

5
modsec_conf/gps.oestepan.com.br.conf
View File

@ -14,8 +14,9 @@ server {
} }
server { server {
listen 443 ssl http2; listen 443 ssl;
listen [::]:443 ssl http2; listen [::]:443 ssl;
http2 on;
server_name gps.oestepan.com.br; server_name gps.oestepan.com.br;
# SSL Config (Certs from shared volume) # SSL Config (Certs from shared volume)