chore: update

templates/haproxy.cfg.j2

@@ -18,6 +18,10 @@ frontend fe_https
     mode http
     option forwardfor
     http-request set-header X-Forwarded-Proto https
+    # Force le Host envoye aux backends : sans ca, un scan/requete directe sur l'IP
+    # publique (Host: <IP> ou absent) fait grimper le score d'anomalie ModSecurity
+    # (rule 920280 "Missing a Host Header") et se fait bloquer en 403 cote WAF.
+    http-request set-header Host {{ domain_name }}
 
     # /api/* et /uploads/* -> pool backend (Go), tout le reste -> pool frontend (SPA)
     acl is_api path_beg /api/ /uploads/ /webhook/telegram /webhook/nowpayment
@@ -30,7 +34,7 @@ frontend fe_https
 # ============================================================
 backend be_api
     mode http
-    option httpchk GET /api/health
+    http-check send meth GET uri /api/health hdr Host {{ domain_name }}
     http-check expect status 200
 
     server prod-uber {{ hostvars['prod-uber']['vpn_ip'] }}:443 ssl verify none check inter 2s fall 3 rise 2
@@ -41,7 +45,7 @@ backend be_api
 # ============================================================
 backend be_frontend
     mode http
-    option httpchk GET /
+    http-check send meth GET uri / hdr Host {{ domain_name }}
     http-check expect status 200
 
     server prod-uber {{ hostvars['prod-uber']['vpn_ip'] }}:443 ssl verify none check inter 2s fall 3 rise 2

templates/ssh_harden_conf.j2

@@ -22,15 +22,18 @@ AddressFamily inet
 
 # Ciphers and keying
 #RekeyLimit default none
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
+KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
 
 # Logging
 #SyslogFacility AUTH
-#LogLevel INFO
+LogLevel VERBOSE
 
 # Authentication:
 AllowGroups {{ group_ssh }}
 AllowUsers {{ user_ssh }}
-#LoginGraceTime 2m
+LoginGraceTime 1m
 PermitRootLogin no
 #StrictModes yes
 MaxAuthTries 3
@@ -89,6 +92,7 @@ UsePAM yes
 #AllowTcpForwarding yes
 #GatewayPorts no
 X11Forwarding no
+DisableForwarding yes
 #X11DisplayOffset 10
 #X11UseLocalhost yes
 #PermitTTY yes
@@ -97,8 +101,8 @@ PrintMotd no
 #TCPKeepAlive yes
 #PermitUserEnvironment no
 #Compression delayed
-#ClientAliveInterval 0
-#ClientAliveCountMax 3
+ClientAliveInterval 15
+ClientAliveCountMax 3
 #UseDNS no
 #PidFile /run/sshd.pid
 MaxStartups 10:30:60