diff --git a/conf.d/atendimento.itguys.com.br.conf b/conf.d/atendimento.itguys.com.br.conf
new file mode 100644
index 0000000..519879d
--- /dev/null
+++ b/conf.d/atendimento.itguys.com.br.conf
@@ -0,0 +1,89 @@
+# ==============================================================================
+# ARQUIVO: /etc/nginx/sites-available/atendimento.itguys.com.br.conf
+# AUTOR:   Gemini (Especialista NGINX)
+# DATA:    23/01/2026
+#
+# DESCRIÇÃO:
+# Configuração de Proxy Reverso para Chatwoot (Atendimento).
+# ==============================================================================
+
+upstream atendimento_backend {
+    server host.docker.internal:8082;
+}
+
+# ==============================================================================
+# BLOCO 1: Redirecionamento de HTTP para HTTPS
+# ==============================================================================
+server {
+    listen 80;
+    include /etc/nginx/snippets/acme_challenge.conf;
+    listen [::]:80;
+    server_name atendimento.itguys.com.br;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/html;
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+# ==============================================================================
+# BLOCO 2: Servidor Principal (HTTPS)
+# ==============================================================================
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name atendimento.itguys.com.br;
+
+    # --- Logs ---
+    access_log /var/log/nginx/atendimento.itguys.com.br.access.log detailed_proxy;
+    error_log /var/log/nginx/atendimento.itguys.com.br.error.log warn;
+
+    # --- Configurações de SSL/TLS ---
+    ssl_certificate /etc/letsencrypt/live/atendimento.itguys.com.br/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/atendimento.itguys.com.br/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/atendimento.itguys.com.br/fullchain.pem;
+    
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:SSL:60m;
+    ssl_session_tickets off;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers off;
+    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
+    ssl_stapling on;
+    ssl_stapling_verify on;
+
+    # --- Cabeçalhos de Segurança ---
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "no-referrer-when-downgrade" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: *.gravatar.com; font-src 'self' data:; connect-src 'self' wss: https:; manifest-src 'self' data:; object-src 'none'; frame-ancestors 'self';" always;
+
+    # --- Configurações de Proxy e WebSockets (Chatwoot) ---
+    location / {
+        proxy_pass http://atendimento_backend;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        
+        # Timeouts para evitar desconexões em WebSockets
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+    }
+    
+    # Rota para assets estáticos (opcional, mas recomendado)
+    location ~* \.(css|js|jpg|jpeg|png|gif|ico|svg|webp|woff2?)$ {
+        proxy_pass http://atendimento_backend;
+        proxy_cache off; # Chatwoot gerencia seu próprio cache geralmente, ou ajustar conforme necessidade
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        access_log off;
+    }
+}
diff --git a/conf.d/gps.oestepan.com.br.conf b/conf.d/gps.oestepan.com.br.conf
new file mode 100644
index 0000000..2b2d5fc
--- /dev/null
+++ b/conf.d/gps.oestepan.com.br.conf
@@ -0,0 +1,121 @@
+# ==============================================================================
+# ARQUIVO: /etc/nginx/sites-available/gps.oestepan.com.br.conf
+# AUTOR:   Gemini (Especialista NGINX)
+# DATA:    26/01/2026
+#
+# CONTEXTO:
+# Proxy Reverso para Traccar GPS (OESTEPAN).
+# Suporte essencial para WebSockets (/api/socket) para rastreamento em tempo real.
+#
+# UPSTREAM: host.docker.internal:8082 (Container Traccar no Host)
+# ==============================================================================
+
+# ------------------------------------------------------------------------------
+# UPSTREAM: Servidor Traccar
+# ------------------------------------------------------------------------------
+upstream traccar_backend {
+    # 'host.docker.internal' funciona graças ao 'extra_hosts' no docker-compose.yml
+    # Certifique-se que o Traccar está expondo a porta 8082 no host.
+    server host.docker.internal:8082;
+    keepalive 32;
+}
+
+# ------------------------------------------------------------------------------
+# BLOCO 1: Redirecionamento de HTTP (porta 80) para HTTPS
+# ------------------------------------------------------------------------------
+server {
+    listen 80;
+    listen [::]:80;
+    server_name gps.oestepan.com.br;
+
+    include /etc/nginx/snippets/acme_challenge.conf;
+
+    # Aplica o rate limiting global
+    limit_req zone=global_limit burst=20 nodelay;
+
+    # Responde ao desafio do Let's Encrypt
+    location /.well-known/acme-challenge/ {
+        root /var/www/html;
+    }
+
+    # Redireciona todo o resto para HTTPS
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+# ------------------------------------------------------------------------------
+# BLOCO 2: Servidor Principal - Proxy Reverso para Traccar (HTTPS)
+# ------------------------------------------------------------------------------
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name gps.oestepan.com.br;
+
+    # ============================================================================
+    # LOGS E LIMITAÇÃO
+    # ============================================================================
+    client_max_body_size 50M; # Ajustado para possíveis uploads de firmware/imagem
+    access_log /var/log/nginx/gps.oestepan.com.br.access.log detailed_proxy;
+    error_log /var/log/nginx/gps.oestepan.com.br.error.log warn;
+    
+    # Módulo de Segurança Global
+    if ($block_request) {
+        return 404;
+    }
+
+    limit_req zone=global_limit burst=100 nodelay;
+
+    # ============================================================================
+    # CONFIGURAÇÕES DE SSL/TLS
+    # ============================================================================
+    ssl_certificate /etc/letsencrypt/live/gps.oestepan.com.br/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/gps.oestepan.com.br/privkey.pem;
+    ssl_protocols TLSv1.3 TLSv1.2;
+    ssl_ciphers 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305';
+    ssl_prefer_server_ciphers on;
+    ssl_session_timeout 1d;
+    ssl_session_tickets off;
+
+    # HSTS e Segurança
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+
+    # ============================================================================
+    # ROTAS ESPECÍFICAS
+    # ============================================================================
+
+    # 1. WebSocket (CRÍTICO PARA O TRACCAR)
+    # A rota /api/socket é usada para comunicação em tempo real
+    location /api/socket {
+        proxy_pass http://traccar_backend;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        
+        proxy_read_timeout 86400s; # Timeout de 24h para manter conexão aberta
+        proxy_send_timeout 86400s;
+        
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # 2. Rota Principal
+    location / {
+        proxy_pass http://traccar_backend;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        
+        # Otimizações para API/Web
+        proxy_buffering off; # Recomendado para apps interativos
+        proxy_request_buffering off;
+        proxy_read_timeout 90s;
+    }
+}
diff --git a/conf.d/test-connectivity.conf b/conf.d/test-connectivity.conf
index b7a5337..4c56d89 100644
--- a/conf.d/test-connectivity.conf
+++ b/conf.d/test-connectivity.conf
@@ -5,6 +5,7 @@
 
 server {
     listen 8080;
+    include /etc/nginx/snippets/acme_challenge.conf;
     server_name localhost test-connectivity;
 
     # Health check simples
diff --git a/fail2ban/db/fail2ban.sqlite3 b/fail2ban/db/fail2ban.sqlite3
index d9b223b..52ea410 100644
Binary files a/fail2ban/db/fail2ban.sqlite3 and b/fail2ban/db/fail2ban.sqlite3 differ