From 71e6377098913476e4c9e7c5fdcfa7218c5ff1cb Mon Sep 17 00:00:00 2001 From: "srvproxy001.itguys.com.br" Date: Sun, 21 Sep 2025 21:56:54 -0300 Subject: [PATCH] =?UTF-8?q?[Auto-Sync]=20Atualiza=C3=A7=C3=A3o=20das=20con?= =?UTF-8?q?figura=C3=A7=C3=B5es=20em=20srvproxy001.itguys.com.br=20-=20202?= =?UTF-8?q?5-09-21=2021:56:54?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ...m.br.conf => unifi.itguys.com.br.conf.BAD} | 0 .../unifi.itguys.com.br.conf.CLEAN | 137 ++++++++++++++++++ 2 files changed, 137 insertions(+) rename nginx/sites-available/{unifi.itguys.com.br.conf => unifi.itguys.com.br.conf.BAD} (100%) create mode 100644 nginx/sites-available/unifi.itguys.com.br.conf.CLEAN diff --git a/nginx/sites-available/unifi.itguys.com.br.conf b/nginx/sites-available/unifi.itguys.com.br.conf.BAD similarity index 100% rename from nginx/sites-available/unifi.itguys.com.br.conf rename to nginx/sites-available/unifi.itguys.com.br.conf.BAD diff --git a/nginx/sites-available/unifi.itguys.com.br.conf.CLEAN b/nginx/sites-available/unifi.itguys.com.br.conf.CLEAN new file mode 100644 index 0000000..722af38 --- /dev/null +++ b/nginx/sites-available/unifi.itguys.com.br.conf.CLEAN @@ -0,0 +1,137 @@ +# ========================================================================================= +# ARQUIVO: /etc/nginx/sites-available/unifi.itguys.com.br.conf +# AUTOR: Gemini (Especialista NGINX) - VERSAO 6 (OTIMIZADA COM CACHE) +# DATA: 21/09/2025 +# +# DESCRICAO: +# Configuracao otimizada com cache para arquivos estaticos, visando melhorar o +# desempenho e reduzir a carga no backend do UniFi Controller. +# +# MELHORIAS DESTA VERSAO: +# - OTIMIZACAO (CACHE): Foram adicionados blocos 'location' especificos para +# arquivos estaticos (.js, .css, imagens, fontes). +# - ESTRATEGIA DE CACHE: +# - Assets com hash no nome (ex: app.a1b2c3d4.js) sao considerados imutaveis +# e recebem um cache agressivo de longa duracao no navegador. +# - Assets comuns recebem um cache padrao. +# - MANUTENCAO: A logica funcional da API e dos WebSockets permanece intacta, +# garantindo que a estabilidade alcancada seja mantida. +# +# ========================================================================================= + +# --- DEFINICAO DOS BACKENDS --- +upstream unifi_backend_web { + server 172.16.254.123:8443; +} +upstream unifi_backend_inform { + server 172.16.254.123:8080; +} + +# ========================================================================================= +# BLOCO 1: Redirecionamento de HTTP (porta 80) para HTTPS +# ========================================================================================= +server { + listen 80; + listen [::]:80; + server_name unifi.itguys.com.br; + + location /.well-known/acme-challenge/ { + root /var/www/html; + } + location / { + return 301 https://$host$request_uri; + } +} + +# ========================================================================================= +# BLOCO 2: Servidor Principal - Proxy Reverso para a Interface Web (HTTPS) +# ========================================================================================= +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name unifi.itguys.com.br; + + # --- SSL E SEGURANCA --- + ssl_certificate /etc/letsencrypt/live/unifi.itguys.com.br/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/unifi.itguys.com.br/privkey.pem; + include /etc/nginx/snippets/ssl_params.conf; + add_header X-Frame-Options "SAMEORIGIN" always; + + # --- LOGS --- + access_log /var/log/nginx/unifi.itguys.com.br.access.log; + error_log /var/log/nginx/unifi.itguys.com.br.error.log warn; + + # --- PARAMETROS GERAIS --- + proxy_ssl_verify off; + include /etc/nginx/snippets/proxy_params.conf; + + # --- OTIMIZACAO DE CACHE PARA ASSETS ESTATICOS --- + + # Bloco para assets imutaveis (com hash no nome). + # Aplica um cache de longa duracao no navegador. + location ~* \.[a-z0-9]{8,}\.(css|js)$ { + include /etc/nginx/snippets/cache_immutable_static.conf; + proxy_pass https://unifi_backend_web; + # Adiciona os headers de seguranca tambem para os assets + proxy_set_header Origin ""; + proxy_set_header Referer $scheme://$host/; + } + + # Bloco para outros assets estaticos comuns. + # Aplica um cache padrao. + location ~* \.(?:css|js|jpe?g|png|gif|ico|svg|webp|avif|eot|ttf|woff|woff2|mp4|webm)$ { + include /etc/nginx/snippets/cache_static_assets.conf; + proxy_pass https://unifi_backend_web; + # Adiciona os headers de seguranca tambem para os assets + proxy_set_header Origin ""; + proxy_set_header Referer $scheme://$host/; + } + + # --- ROTA PARA A APLICACAO (SEM CACHE) --- + # Captura a pagina principal e todas as chamadas de API. + location / { + proxy_pass https://unifi_backend_web; + + # -- Cabecalhos Essenciais -- + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Origin ""; + proxy_set_header Referer $scheme://$host/; + } + + # --- ROTA DEDICADA PARA WEBSOCKETS (SEM CACHE) --- + location /wss/ { + proxy_pass https://unifi_backend_web; + + # -- Cabecalhos Essenciais -- + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + # -- Cabecalhos para Upgrade de Conexao -- + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "Upgrade"; + } +} +# ============================================================================== +# BLOCO 3: Servidor para o "Inform" dos Dispositivos (HTTP na porta 8080) +# ============================================================================== +server { + listen 8080; + listen [::]:8080; + server_name unifi.itguys.com.br; + + access_log /var/log/nginx/unifi-inform.log; + error_log /var/log/nginx/unifi-inform.error.log; + + location / { + include /etc/nginx/snippets/proxy_params.conf; + proxy_read_timeout 600s; + proxy_send_timeout 600s; + proxy_pass http://unifi_backend_inform; + } +}