fix: refactor for Portainer GitOps compatibility (Dockerized configs + named volumes)

Dockerfile

@@ -1,10 +1,11 @@
 FROM alpine:latest
 
 # Install NGINX and tools
-RUN apk add --no-cache nginx nginx-mod-http-brotli nginx-mod-http-headers-more bind-tools openssl curl certbot
+RUN apk add --no-cache nginx nginx-mod-http-brotli nginx-mod-http-headers-more bind-tools openssl curl certbot git
 
 # Copy custom config
 COPY nginx.conf /etc/nginx/nginx.conf
+COPY conf.d/ /etc/nginx/conf.d/
 
 # Copy snippets
 COPY snippets/ /etc/nginx/snippets/

Dockerfile.fail2ban

@@ -0,0 +1,4 @@
+FROM crazymax/fail2ban:latest
+
+# Copy fail2ban configurations
+COPY fail2ban/ /data/

Dockerfile.modsec

@@ -0,0 +1,7 @@
+FROM owasp/modsecurity-crs:nginx-alpine
+
+# Copy custom configuration template
+COPY modsec.conf.template /etc/nginx/templates/modsecurity.d/modsecurity.conf.template
+
+# Copy custom rules
+COPY modsec_rules/ /etc/nginx/custom_rules/

conf.d/atendimento.itguys.com.br.conf

@@ -0,0 +1,89 @@
+# ==============================================================================
+# ARQUIVO: /etc/nginx/sites-available/atendimento.itguys.com.br.conf
+# AUTOR:   Gemini (Especialista NGINX)
+# DATA:    23/01/2026
+#
+# DESCRIÇÃO:
+# Configuração de Proxy Reverso para Chatwoot (Atendimento).
+# ==============================================================================
+
+upstream atendimento_backend {
+    server host.docker.internal:8082;
+}
+
+# ==============================================================================
+# BLOCO 1: Redirecionamento de HTTP para HTTPS
+# ==============================================================================
+server {
+    listen 80;
+    include /etc/nginx/snippets/acme_challenge.conf;
+    listen [::]:80;
+    server_name atendimento.itguys.com.br;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/html;
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+# ==============================================================================
+# BLOCO 2: Servidor Principal (HTTPS)
+# ==============================================================================
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name atendimento.itguys.com.br;
+
+    # --- Logs ---
+    access_log /var/log/nginx/atendimento.itguys.com.br.access.log detailed_proxy;
+    error_log /var/log/nginx/atendimento.itguys.com.br.error.log warn;
+
+    # --- Configurações de SSL/TLS ---
+    ssl_certificate /etc/letsencrypt/live/atendimento.itguys.com.br/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/atendimento.itguys.com.br/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/atendimento.itguys.com.br/fullchain.pem;
+    
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:SSL:60m;
+    ssl_session_tickets off;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers off;
+    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
+    ssl_stapling on;
+    ssl_stapling_verify on;
+
+    # --- Cabeçalhos de Segurança ---
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "no-referrer-when-downgrade" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: *.gravatar.com; font-src 'self' data:; connect-src 'self' wss: https:; manifest-src 'self' data:; object-src 'none'; frame-ancestors 'self';" always;
+
+    # --- Configurações de Proxy e WebSockets (Chatwoot) ---
+    location / {
+        proxy_pass http://atendimento_backend;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        
+        # Timeouts para evitar desconexões em WebSockets
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+    }
+    
+    # Rota para assets estáticos (opcional, mas recomendado)
+    location ~* \.(css|js|jpg|jpeg|png|gif|ico|svg|webp|woff2?)$ {
+        proxy_pass http://atendimento_backend;
+        proxy_cache off; # Chatwoot gerencia seu próprio cache geralmente, ou ajustar conforme necessidade
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        access_log off;
+    }
+}

conf.d/gps.oestepan.com.br.conf

@@ -0,0 +1,121 @@
+# ==============================================================================
+# ARQUIVO: /etc/nginx/sites-available/gps.oestepan.com.br.conf
+# AUTOR:   Gemini (Especialista NGINX)
+# DATA:    26/01/2026
+#
+# CONTEXTO:
+# Proxy Reverso para Traccar GPS (OESTEPAN).
+# Suporte essencial para WebSockets (/api/socket) para rastreamento em tempo real.
+#
+# UPSTREAM: host.docker.internal:8082 (Container Traccar no Host)
+# ==============================================================================
+
+# ------------------------------------------------------------------------------
+# UPSTREAM: Servidor Traccar
+# ------------------------------------------------------------------------------
+upstream traccar_backend {
+    # 'host.docker.internal' funciona graças ao 'extra_hosts' no docker-compose.yml
+    # Certifique-se que o Traccar está expondo a porta 8082 no host.
+    server host.docker.internal:8082;
+    keepalive 32;
+}
+
+# ------------------------------------------------------------------------------
+# BLOCO 1: Redirecionamento de HTTP (porta 80) para HTTPS
+# ------------------------------------------------------------------------------
+server {
+    listen 80;
+    listen [::]:80;
+    server_name gps.oestepan.com.br;
+
+    include /etc/nginx/snippets/acme_challenge.conf;
+
+    # Aplica o rate limiting global
+    limit_req zone=global_limit burst=20 nodelay;
+
+    # Responde ao desafio do Let's Encrypt
+    location /.well-known/acme-challenge/ {
+        root /var/www/html;
+    }
+
+    # Redireciona todo o resto para HTTPS
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+# ------------------------------------------------------------------------------
+# BLOCO 2: Servidor Principal - Proxy Reverso para Traccar (HTTPS)
+# ------------------------------------------------------------------------------
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name gps.oestepan.com.br;
+
+    # ============================================================================
+    # LOGS E LIMITAÇÃO
+    # ============================================================================
+    client_max_body_size 50M; # Ajustado para possíveis uploads de firmware/imagem
+    access_log /var/log/nginx/gps.oestepan.com.br.access.log detailed_proxy;
+    error_log /var/log/nginx/gps.oestepan.com.br.error.log warn;
+    
+    # Módulo de Segurança Global
+    if ($block_request) {
+        return 404;
+    }
+
+    limit_req zone=global_limit burst=100 nodelay;
+
+    # ============================================================================
+    # CONFIGURAÇÕES DE SSL/TLS
+    # ============================================================================
+    ssl_certificate /etc/letsencrypt/live/gps.oestepan.com.br/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/gps.oestepan.com.br/privkey.pem;
+    ssl_protocols TLSv1.3 TLSv1.2;
+    ssl_ciphers 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305';
+    ssl_prefer_server_ciphers on;
+    ssl_session_timeout 1d;
+    ssl_session_tickets off;
+
+    # HSTS e Segurança
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+
+    # ============================================================================
+    # ROTAS ESPECÍFICAS
+    # ============================================================================
+
+    # 1. WebSocket (CRÍTICO PARA O TRACCAR)
+    # A rota /api/socket é usada para comunicação em tempo real
+    location /api/socket {
+        proxy_pass http://traccar_backend;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        
+        proxy_read_timeout 86400s; # Timeout de 24h para manter conexão aberta
+        proxy_send_timeout 86400s;
+        
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # 2. Rota Principal
+    location / {
+        proxy_pass http://traccar_backend;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        
+        # Otimizações para API/Web
+        proxy_buffering off; # Recomendado para apps interativos
+        proxy_request_buffering off;
+        proxy_read_timeout 90s;
+    }
+}

conf.d/test-connectivity.conf

@@ -5,6 +5,7 @@
 
 server {
     listen 8080;
+    include /etc/nginx/snippets/acme_challenge.conf;
     server_name localhost test-connectivity;
 
     # Health check simples

docker-compose.yml

@@ -3,7 +3,9 @@ services:
   # ModSecurity WAF (Frente do NGINX)
   # ============================================
   modsecurity:
-    image: owasp/modsecurity-crs:nginx-alpine
+    build:
+      context: .
+      dockerfile: Dockerfile.modsec
     container_name: modsecurity-waf
     restart: always
     ports:
@@ -15,10 +17,8 @@ services:
       - ANOMALY_INBOUND=5
       - ANOMALY_OUTBOUND=4
     volumes:
-      - ./ssl:/etc/nginx/ssl:ro
+      - ssl_data:/etc/nginx/ssl:ro
       - modsec_logs:/var/log/modsecurity
-      - ./modsec_rules:/etc/nginx/custom_rules
-      - ./modsec.conf.template:/etc/nginx/templates/modsecurity.d/modsecurity.conf.template
     depends_on:
       - nginx-proxy
     extra_hosts:
@@ -47,13 +47,11 @@ services:
     environment:
       - HOST_PUBLIC_IP=${HOST_PUBLIC_IP}
     volumes:
-      - ./conf.d:/etc/nginx/conf.d
+      - ssl_data:/etc/nginx/ssl
-      - ./ssl:/etc/nginx/ssl
-      - ./snippets:/etc/nginx/snippets
       - nginx_cache:/var/cache/nginx
       - nginx_logs:/var/log/nginx
-      - ./certbot/conf:/etc/letsencrypt
+      - certbot_data_conf:/etc/letsencrypt
-      - ./certbot/www:/var/www/certbot
+      - certbot_data_www:/var/www/certbot
     extra_hosts:
       - "host.docker.internal:host-gateway"
       - "server-254:10.10.253.254"
@@ -74,7 +72,9 @@ services:
   # Fail2ban (Lê logs e bane IPs)
   # ============================================
   fail2ban:
-    image: crazymax/fail2ban:latest
+    build:
+      context: .
+      dockerfile: Dockerfile.fail2ban
     container_name: fail2ban
     restart: always
     network_mode: host
@@ -82,7 +82,6 @@ services:
       - NET_ADMIN
       - NET_RAW
     volumes:
-      - ./fail2ban:/data
       - nginx_logs:/var/log/nginx:ro
       - modsec_logs:/var/log/modsecurity:ro
 
@@ -90,3 +89,6 @@ volumes:
   nginx_cache:
   nginx_logs:
   modsec_logs:
+  ssl_data:
+  certbot_data_conf:
+  certbot_data_www:

scripts/git_sync.sh

@@ -0,0 +1,55 @@
+#!/bin/sh
+# ==============================================================================
+# SCRIPT: git_sync.sh
+# AUTHOR: Gemini (Automated)
+# PURPOSE: Pull latest changes from git and reload Nginx if successful
+# CRON: Scheduled in pre-flight.sh
+# ==============================================================================
+
+REPO_DIR="/opt/repo"
+# URL Encoded Password for 'o3!VV3H6qBg^rucv2UvF6mdK$NWyNj@3'
+# ! = %21, ^ = %5E, $ = %24, @ = %40
+GIT_USER="gitea-deploy"
+GIT_PASS="o3%21VV3H6qBg%5Erucv2UvF6mdK%24NWyNj%403"
+GIT_REPO="git.itguys.com.br/joao.goncalves/NgixProxy_Pathfinder.git"
+BRANCH="producao"
+GIT_URL="https://${GIT_USER}:${GIT_PASS}@${GIT_REPO}"
+
+echo "[Git-Sync] $(date): Starting sync process..."
+
+if [ ! -d "$REPO_DIR" ]; then
+    echo "[Git-Sync] ERROR: Repository directory $REPO_DIR does not exist."
+    exit 1
+fi
+
+# Trust the directory (fix for 'dubious ownership' in container)
+git config --global --add safe.directory "$REPO_DIR"
+
+cd "$REPO_DIR"
+
+# Fetch and Pull
+OUTPUT=$(git pull "$GIT_URL" "$BRANCH" 2>&1)
+EXIT_CODE=$?
+
+echo "[Git-Sync] Output: $OUTPUT"
+
+if [ $EXIT_CODE -ne 0 ]; then
+    echo "[Git-Sync] ERROR: Git pull failed."
+    exit $EXIT_CODE
+fi
+
+if echo "$OUTPUT" | grep -q "Already up to date"; then
+    echo "[Git-Sync] No changes detected."
+    exit 0
+else
+    echo "[Git-Sync] Changes detected. Validating Nginx config..."
+    
+    if nginx -t; then
+        echo "[Git-Sync] Configuration valid. Reloading Nginx..."
+        nginx -s reload
+        echo "[Git-Sync] Reload successful."
+    else
+        echo "[Git-Sync] CRITICAL: Nginx configuration test failed! Not reloading."
+        exit 1
+    fi
+fi

scripts/pre-flight.sh

@@ -35,7 +35,9 @@ echo "[Pre-Flight] Running SSL renewal check..."
 /scripts/renew_ssl.sh
 
 # Setup Daily Cron for Renewal (run at 01:00)
-echo "0 1 * * * /scripts/renew_ssl.sh >> /var/log/nginx/ssl_renew.log 2>&1" > /etc/crontabs/root
+# Setup Daily Cron for Renewal (run at 01:00)
+echo "0 1 * * * /scripts/renew_ssl.sh >> /var/log/nginx/ssl_renew.log 2>&1" >> /etc/crontabs/root
+
 # Start Crond in background
 crond -b -l 8