From 7e20ba5c878e20ae19174735a9acc9bf26c41b47 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jo=C3=A3o=20Pedro=20Toledo?= Date: Tue, 27 Jan 2026 14:35:44 -0300 Subject: [PATCH] Cleanup: Remove configs (conf.d, snippets) from production branch (moved to sites-ativos) --- .gemini/TODO.md | 40 ------------------- Dockerfile | 4 +- docker-compose.yml | 9 +++-- nginx.conf | 46 --------------------- snippets/acme_challenge.conf | 9 ----- snippets/cache_zones.conf | 6 --- snippets/log_formats.conf | 77 ------------------------------------ snippets/rate_limit.conf | 6 --- snippets/security_maps.conf | 49 ----------------------- 9 files changed, 8 insertions(+), 238 deletions(-) delete mode 100644 .gemini/TODO.md delete mode 100644 nginx.conf delete mode 100644 snippets/acme_challenge.conf delete mode 100644 snippets/cache_zones.conf delete mode 100644 snippets/log_formats.conf delete mode 100644 snippets/rate_limit.conf delete mode 100644 snippets/security_maps.conf diff --git a/.gemini/TODO.md b/.gemini/TODO.md deleted file mode 100644 index a54a09b..0000000 --- a/.gemini/TODO.md +++ /dev/null @@ -1,40 +0,0 @@ -# Tarefas Pendentes e Melhorias Futuras - -## 1. Gestão Dinâmica de DNS -**Origem:** Migração de `legacy/hosts` -- **Problema:** O método atual usa `extra_hosts` no `docker-compose.yml`, que é estático e exige recriação do container para alterações. -- **Objetivo:** Mudar o modo de registro e atualização de DNS para ser mais dinâmico ou simples. -- **Ideias:** DNS containerizado (Bind/CoreDNS) ou Service Discovery. - -## 2. Revisão de Regras ModSecurity -**Origem:** Migração de `legacy/nginx/modsecurity/*.conf` (Regras Antigas) -- **Status:** ✅ Concluído. -- **Resolução:** Regras refatoradas para estrutura modular (`modsec_rules/`). WAF ativo e configurado via template injection para Gitea, Nextcloud, Exchange, Zabbix e outros. -- **Ação:** Monitorar logs (`modsec_audit.log`) para ajustes finos futuros. - -## 3. Atualizações Zero-Downtime (Sem Queda) -**Objetivo:** Criar um método para atualizar configurações de sites sem que clientes externos percam a conexão. -- **Status:** ✅ Concluído. -- **Solução Implementada:** Script `./scripts/reload.sh` que executa `nginx -t` e `nginx -s reload` (Reload Suave/Process-Level Blue-Green). -- **Como usar:** Execute `./scripts/reload.sh` após alterar qualquer `.conf`. - -## 4. Conexão Direta na Interface do Host -**Objetivo:** Configurar o proxy para rotear tráfego tanto internamente (entre containers Docker) quanto externamente (para serviços fora do Docker). -- **Status:** 🧪 Implementado - Aguardando Teste no Host -- **Solução Implementada:** - - Adicionado `host.docker.internal:host-gateway` no `docker-compose.yml` para ambos containers - - Criado `snippets/docker_resolver.conf` para resolução DNS dinâmica de containers - - Criado `conf.d/test-connectivity.conf` (temporário) com endpoints de teste - - Atualizado diagrama de arquitetura no `README.md` -- **Testes Necessários (no host de deploy):** - ```bash - # Rebuild e restart - docker compose build --no-cache nginx-proxy - docker compose down && docker compose up -d - - # Testar conectividade - docker compose exec nginx-proxy ping -c 2 10.10.253.254 - docker compose exec nginx-proxy ping -c 2 10.10.253.128 - ``` -- **Após Validação:** Deletar `conf.d/test-connectivity.conf` e marcar como ✅ Concluído. - diff --git a/Dockerfile b/Dockerfile index 36c1434..d266ee3 100644 --- a/Dockerfile +++ b/Dockerfile @@ -11,8 +11,8 @@ RUN ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log # Copy custom config (defaults, will be overriden by volumes) -COPY nginx.conf /etc/nginx/nginx.conf -COPY snippets/ /etc/nginx/snippets/ +# COPY nginx.conf /etc/nginx/nginx.conf <-- Removed: Managed in sites-ativos +# COPY snippets/ /etc/nginx/snippets/ <-- Removed: Managed in sites-ativos # Expose ports EXPOSE 80 443 diff --git a/docker-compose.yml b/docker-compose.yml index 0666e16..88ef278 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -8,9 +8,12 @@ services: - "80:80" - "443:443" volumes: - #- ./nginx.conf:/etc/nginx/nginx.conf # Removed to avoid file-mount errors in Portainer - - ./conf.d:/etc/nginx/conf.d - #- ./snippets:/etc/nginx/snippets # Removed to avoid empty-mount errors + # Configurations must be mounted from 'sites-ativos' (Git or Volume) + #- ./nginx.conf:/etc/nginx/nginx.conf + #- ./conf.d:/etc/nginx/conf.d + #- ./snippets:/etc/nginx/snippets + + # Persistent Data - ./ssl:/etc/nginx/ssl - nginx_logs:/var/log/nginx - nginx_cache:/var/cache/nginx diff --git a/nginx.conf b/nginx.conf deleted file mode 100644 index 4fa8235..0000000 --- a/nginx.conf +++ /dev/null @@ -1,46 +0,0 @@ -load_module modules/ngx_http_brotli_filter_module.so; -load_module modules/ngx_http_brotli_static_module.so; -load_module modules/ngx_http_headers_more_filter_module.so; - -user nginx; -worker_processes auto; -worker_rlimit_nofile 65535; - -error_log /var/log/nginx/error.log notice; -pid /var/run/nginx.pid; - -events { - worker_connections 16384; - multi_accept on; -} - -http { - include /etc/nginx/mime.types; - default_type application/octet-stream; - - sendfile on; - tcp_nopush on; - server_tokens off; - proxy_headers_hash_bucket_size 512; - client_max_body_size 0; - - keepalive_timeout 65; - - # SSL Settings - ssl_session_cache shared:SSL:50m; - ssl_session_timeout 1d; - ssl_session_tickets off; - - # Snippets - include /etc/nginx/snippets/security_maps.conf; - include /etc/nginx/snippets/log_formats.conf; - include /etc/nginx/snippets/cache_zones.conf; - include /etc/nginx/snippets/rate_limit.conf; - - # Logging - # Assumes 'detailed_proxy' is defined in log_formats.conf - access_log /var/log/nginx/access.log detailed_proxy; - - # Site Configurations - include /etc/nginx/conf.d/*.conf; -} diff --git a/snippets/acme_challenge.conf b/snippets/acme_challenge.conf deleted file mode 100644 index bf2ee5a..0000000 --- a/snippets/acme_challenge.conf +++ /dev/null @@ -1,9 +0,0 @@ -# ACME Challenge Snippet -# Include this in port 80 server blocks to allow Certbot validation - -location ^~ /.well-known/acme-challenge/ { - root /var/www/certbot; - try_files $uri =404; - allow all; - auth_basic off; -} diff --git a/snippets/cache_zones.conf b/snippets/cache_zones.conf deleted file mode 100644 index 07f3b8b..0000000 --- a/snippets/cache_zones.conf +++ /dev/null @@ -1,6 +0,0 @@ -# Dynamic Shared Cache Zone -# Single zone for all sites, separating content by Host + URI -proxy_cache_path /var/cache/nginx/dynamic_cache levels=1:2 keys_zone=dynamic_cache:50m max_size=10g inactive=7d use_temp_path=off; - -# Default Cache Key (ensure uniqueness per host) -proxy_cache_key "$scheme$request_method$host$request_uri"; diff --git a/snippets/log_formats.conf b/snippets/log_formats.conf deleted file mode 100644 index 0adca30..0000000 --- a/snippets/log_formats.conf +++ /dev/null @@ -1,77 +0,0 @@ -# Log Format Definitions -# Include this file in nginx.conf http block - -log_format detailed_proxy escape=json -'{' -# Timestamps e Identificadores -'"@timestamp":"$time_iso8601",' -'"time_local":"$time_local",' -'"msec":"$msec",' -'"request_id":"$request_id",' -'"hostname":"$hostname",' -'"worker_pid":$pid,' - -# Informações de Conexão e Cliente -'"remote_addr":"$remote_addr",' -'"remote_port":$remote_port,' -'"server_addr":"$server_addr",' -'"server_port":"$server_port",' -'"real_ip":"$http_x_forwarded_for",' -'"http_x_real_ip":"$http_x_real_ip",' -'"remote_user":"$remote_user",' - -# Detalhes da Requisição HTTP -'"request":"$request",' -'"request_method":"$request_method",' -'"scheme":"$scheme",' -'"server_protocol":"$server_protocol",' -'"host_header":"$host",' -'"request_uri":"$request_uri",' -'"uri":"$uri",' -'"document_uri":"$document_uri",' -'"args":"$args",' -'"query_string":"$query_string",' -'"request_length":$request_length,' - -# Headers da Requisição -'"http_referer":"$http_referer",' -'"http_user_agent":"$http_user_agent",' -'"http_accept_encoding":"$http_accept_encoding",' -'"http_accept_language":"$http_accept_language",' - -# Detalhes da Resposta -'"status":$status,' -'"body_bytes_sent":$body_bytes_sent,' -'"bytes_sent":$bytes_sent,' -'"sent_http_content_type":"$sent_http_content_type",' -'"sent_http_cache_control":"$sent_http_cache_control",' - -# Performance e Conexão -'"request_time":$request_time,' -'"connection":"$connection",' -'"connection_requests":$connection_requests,' - -# SSL/TLS -'"ssl_protocol":"$ssl_protocol",' -'"ssl_cipher":"$ssl_cipher",' -'"ssl_session_reused":"$ssl_session_reused",' - -# Upstream -'"upstream_addr":"$upstream_addr",' -'"upstream_status":"$upstream_status",' -'"upstream_connect_time":"$upstream_connect_time",' -'"upstream_header_time":"$upstream_header_time",' -'"upstream_response_time":"$upstream_response_time",' -'"upstream_cache_status":"$upstream_cache_status",' - -# Compressão -'"compression_ratio":"$gzip_ratio",' - -# Variáveis Customizadas -'"is_bad_bot":"$is_bad_bot",' -'"is_suspicious_uri":"$is_suspicious_uri",' -'"block_request":"$block_request",' -'"is_internal_ip":"$is_internal"' -'}'; - -log_format suspicious_bot 'SUSPICIOUS_BOT: $remote_addr - "$http_user_agent" - "$request"'; diff --git a/snippets/rate_limit.conf b/snippets/rate_limit.conf deleted file mode 100644 index b0e2aae..0000000 --- a/snippets/rate_limit.conf +++ /dev/null @@ -1,6 +0,0 @@ -# Rate Limit Zones -# Include this file in nginx.conf http block - -# Smart rate limiting - excludes internal IPs -limit_req_zone $limit_key zone=global_limit:20m rate=10r/s; -limit_req_zone $bad_bot_key zone=bad_bot_limit:10m rate=5r/m; diff --git a/snippets/security_maps.conf b/snippets/security_maps.conf deleted file mode 100644 index 44c3034..0000000 --- a/snippets/security_maps.conf +++ /dev/null @@ -1,49 +0,0 @@ -# Security Maps and Variables -# Include this file in nginx.conf http block - -# Bad Bot Detection -map $http_user_agent $is_bad_bot { - default 0; - ~*(nikto|sqlmap|wpscan|gobuster|dirbuster|feroxbuster|nessus|nmap|curl) 1; -} - -# Suspicious URI Detection -map $request_uri $is_suspicious_uri { - default 0; - ~*(\.env|\.git|/vendor/|/setup\.php|/\.well-known/|/phpmyadmin|/config\.php|composer\.json) 1; -} - -# Combined Block Request -map $is_bad_bot$is_suspicious_uri $block_request { - default 0; - ~1 1; -} - -# Internal IP Detection -geo $is_internal { - default 0; - 10.10.0.0/16 1; 10.11.0.0/16 1; 10.12.0.0/16 1; 172.16.0.0/16 1; - 45.169.73.155 1; 201.73.213.130 1; 177.74.160.17 1; 177.74.160.18 1; - 177.74.160.19 1; 177.74.160.20 1; 177.74.160.21 1; 177.74.160.22 1; - 177.74.160.23 1; 45.169.87.168 1; 45.169.87.169 1; 45.169.87.170 1; - 45.169.87.171 1; 45.169.87.172 1; 45.169.87.173 1; 45.169.87.174 1; - 45.169.87.175 1; 45.169.73.154 1; 201.73.213.129 1; -} - -# Rate Limit Key (excludes internal IPs) -map $is_internal $limit_key { - 0 $binary_remote_addr; - 1 ""; -} - -# Bad Bot Rate Limit Key -map $is_bad_bot $bad_bot_key { - 1 $binary_remote_addr; - default ""; -} - -# Cache Asset TTL -map $request_uri $cache_asset { - ~*\.(css|js|mjs|svg|gif|png|jpg|jpeg|ico|wasm|woff|woff2|ttf|otf)$ 1y; - default off; -}