From 89430a67517cf32238e0c98552dab47388be727c Mon Sep 17 00:00:00 2001 From: "srvproxy001.itguys.com.br" Date: Tue, 7 Oct 2025 14:23:31 -0300 Subject: [PATCH] =?UTF-8?q?[Auto-Sync]=20Atualiza=C3=A7=C3=A3o=20das=20con?= =?UTF-8?q?figura=C3=A7=C3=B5es=20em=20srvproxy001.itguys.com.br=20-=20202?= =?UTF-8?q?5-10-07=2014:23:31?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../monitoramento.itguys.com.br.conf | 168 ++++++++++++++++++ 1 file changed, 168 insertions(+) create mode 100644 nginx/sites-available/monitoramento.itguys.com.br.conf diff --git a/nginx/sites-available/monitoramento.itguys.com.br.conf b/nginx/sites-available/monitoramento.itguys.com.br.conf new file mode 100644 index 0000000..51e7d44 --- /dev/null +++ b/nginx/sites-available/monitoramento.itguys.com.br.conf @@ -0,0 +1,168 @@ +# ============================================================================== +# ARQUIVO: /etc/nginx/sites-available/monitoramento.itguys.com.br.conf +# AUTOR: Gemini (Especialista NGINX) +# DATA: 07/10/2025 (Corrigido para herança de proxy headers) +# +# CONTEXTO: +# Configuração consolidada e segura para Proxy Reverso do Grafana. +# Segue a estrutura centralizada: SSL/TLS e Headers diretos no arquivo. +# +# UPSTREAM: 172.16.254.13:3000 +# ============================================================================== + +# ------------------------------------------------------------------------------ +# UPSTREAM: Servidor Grafana +# ------------------------------------------------------------------------------ +upstream grafana_backend { + server 172.16.254.13:3000; + keepalive 64; +} + +# ------------------------------------------------------------------------------ +# BLOCO 1: Redirecionamento de HTTP (porta 80) para HTTPS +# ------------------------------------------------------------------------------ +server { + listen 80; + listen [::]:80; + server_name monitoramento.itguys.com.br; + + # Aplica o rate limiting (zona global_limit deve estar em nginx.conf) + limit_req zone=global_limit burst=20 nodelay; + + # Responde ao desafio do Let's Encrypt + location /.well-known/acme-challenge/ { + root /var/www/html; + } + + # Redireciona todo o resto para HTTPS + location / { + return 301 https://$host$request_uri; + } +} + +# ------------------------------------------------------------------------------ +# BLOCO 2: Servidor Principal - Proxy Reverso para Grafana (HTTPS) +# ------------------------------------------------------------------------------ +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name monitoramento.itguys.com.br; + + # ============================================================================ + # LOGS, LIMITAÇÃO E SEGURANÇA BÁSICA + # ============================================================================ + client_max_body_size 10M; + access_log /var/log/nginx/monitoramento.itguys.com.br.access.log; + error_log /var/log/nginx/monitoramento.itguys.com.br.error.log warn; + access_log /var/log/nginx/monitoramento.itguys.com.br.bad-bot.log if=$is_bad_bot; + + # Módulo de Segurança Global (Bloqueia bots e URIs suspeitas de nginx.conf) + if ($block_request) { + return 404; + } + + # Rate Limiting (zona global_limit deve estar em nginx.conf) + limit_req zone=global_limit burst=100 nodelay; + + # ============================================================================ + # CONFIGURAÇÕES DE SSL/TLS (Hardening) + # ============================================================================ + ssl_certificate /etc/letsencrypt/live/monitoramento.itguys.com.br/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/monitoramento.itguys.com.br/privkey.pem; + ssl_protocols TLSv1.3 TLSv1.2; + ssl_ciphers 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305'; + ssl_prefer_server_ciphers on; + ssl_ecdh_curve X25519:secp256r1:secp384r1; + ssl_session_timeout 1d; + ssl_dhparam /etc/nginx/dhparam.pem; + ssl_session_tickets off; + + # OCSP Stapling + ssl_stapling on; + ssl_stapling_verify on; + ssl_trusted_certificate /etc/letsencrypt/live/monitoramento.itguys.com.br/fullchain.pem; + resolver 8.8.8.8 8.8.4.4 valid=300s; + resolver_timeout 5s; + + # ============================================================================ + # HEADERS DE SEGURANÇA + # ============================================================================ + add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header Referrer-Policy "no-referrer" always; + add_header Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()" always; + + proxy_hide_header "X-Content-Type-Options"; + proxy_hide_header "X-Frame-Options"; + proxy_hide_header "Content-Security-Policy"; + + # ============================================================================ + # COMPRESSÃO + # ============================================================================ + brotli on; + brotli_comp_level 6; + brotli_min_length 256; + brotli_types application/atom+xml application/javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype application/x-font-ttf application/x-javascript application/xhtml+xml application/xml font/eot font/opentype font/otf font/truetype image/svg+xml image/x-icon text/css text/javascript text/plain text/xml; + gzip on; + gzip_vary on; + gzip_proxied any; + gzip_comp_level 6; + gzip_min_length 256; + gzip_types application/atom+xml application/javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype application/x-font-ttf application/x-javascript application/xhtml+xml application/xml font/eot font/opentype font/otf font/truetype image/svg+xml image/x-icon text/css text/javascript text/plain text/xml; + + # ---------------------------------------------------------------------------- + # ROTAS ESPECÍFICAS + # ---------------------------------------------------------------------------- + + # 1. Rota para assets estáticos do Grafana (/public/) - CACHE AGRESSIVO + location /public/ { + # --- BLOCO DE PROXY PADRÃO --- + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_http_version 1.1; + proxy_pass http://grafana_backend; + # Para assets estáticos, o buffer é benéfico + proxy_buffering on; + proxy_request_buffering on; + + # Headers de Cache + expires 7d; + add_header Cache-Control "public, immutable"; + } + + # 2. Rota para WebSockets do Grafana (/api/live/) - SEM CACHE, LONGO TIMEOUT + location /api/live/ { + # --- BLOCO DE PROXY PADRÃO --- + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_http_version 1.1; + proxy_pass http://grafana_backend; + proxy_buffering off; + proxy_request_buffering off; + + # --- HEADERS ESPECÍFICOS PARA WEBSOCKETS --- + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_read_timeout 86400s; # Timeout longo (24h) + } + + # 3. Rota principal para a aplicação (SEM CACHE) + location / { + # --- BLOCO DE PROXY PADRÃO --- + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_http_version 1.1; + proxy_pass http://grafana_backend; + proxy_buffering off; # Essencial para interatividade + proxy_request_buffering off; + proxy_read_timeout 90s; + proxy_send_timeout 90s; + } +}