chore: update

docker/frontend/custom-rules.conf

@@ -0,0 +1,74 @@
+SecRuleRemoveById 932235
+SecRuleRemoveById 911100
+
+SecRule REQUEST_URI "@streq /api/v2/admin/protected/products" \
+  "id:399002,phase:2,nolog,pass,\
+   ctl:ruleRemoveById=920120,\
+   ctl:ruleRemoveById=920121"
+
+SecRule REQUEST_URI "@beginsWith /uploads/" \
+    "id:1000,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ctl:ruleEngine=Off"
+
+SecRule IP:BANNED "@eq 1" \
+  "id:100000,phase:1,deny,status:403,log,\
+   msg:'IP is banned'"
+
+SecRule IP:REPUTATION_SCORE "@ge 100" \
+  "id:100099,phase:1,deny,status:403,log,\
+   msg:'Critical reputation score',\
+   setvar:'ip.blocked=1',expirevar:'ip.blocked=86400'"
+
+SecRule TX:SQL_INJECTION_SCORE "@ge 5" \
+  "id:100001,phase:2,deny,status:403,log,\
+   msg:'SQL Injection detected',\
+   setvar:'ip.banned=1',expirevar:'ip.banned=172800'"
+
+SecRule TX:XSS_SCORE "@ge 5" \
+  "id:100010,phase:2,deny,status:403,log,\
+   msg:'XSS detected',\
+   setvar:'ip.banned=1',expirevar:'ip.banned=172800'"
+
+SecRule TX:RCE_SCORE "@ge 5" \
+  "id:100020,phase:2,deny,status:403,log,\
+   msg:'RCE detected',\
+   setvar:'ip.banned=1',expirevar:'ip.banned=259200'"
+
+SecRule TX:LFI_SCORE "@ge 5" \
+  "id:100030,phase:2,deny,status:403,log,\
+   msg:'LFI detected',\
+   setvar:'ip.banned=1',expirevar:'ip.banned=172800'"
+
+SecRule TX:INBOUND_ANOMALY_SCORE "@ge 20" \
+  "id:100060,phase:2,deny,status:403,log,\
+   msg:'Critical anomaly score',\
+   setvar:'ip.banned=1',expirevar:'ip.banned=172800'"
+
+SecRule REQUEST_URI "@streq /api/v1/panier/remove" \
+  "id:399010,phase:1,nolog,pass,\
+   ctl:ruleRemoveById=911100,ctl:ruleRemoveById=920350"
+
+SecRule REQUEST_URI "@streq /api/v1/panier/clear" \
+  "id:399011,phase:1,nolog,pass,\
+   ctl:ruleRemoveById=911100,ctl:ruleRemoveById=920350"
+
+SecRule REQUEST_URI "@streq /api/v2/admin/protected/products" \
+  "id:399001,phase:2,nolog,pass,\
+   ctl:ruleRemoveById=932235"
+
+SecAction \
+  "id:400161,phase:1,nolog,pass,\
+   setvar:'ip.request_window_1sec=+1',\
+   expirevar:'ip.request_window_1sec=1'"
+
+SecRule IP:REQUEST_WINDOW_1SEC "@gt 20" \
+  "id:400160,phase:1,deny,status:429,log,\
+   msg:'Too many requests'"
+
+SecRule IP:REPUTATION_SCORE "@ge 100" \
+  "id:409999,phase:1,deny,status:403,log,\
+   msg:'Critical reputation score',\
+   setvar:'ip.blocked=1',expirevar:'ip.blocked=86400'"

docker/frontend/nginx.conf

@@ -7,20 +7,16 @@ map $http_x_request_id $req_id {
 }
 
 # =========================================================
-# Upstream backend
+# Backend distant
 # =========================================================
 upstream backend {
-    server backend:8080 max_fails=3 fail_timeout=30s;
+    server uber-stup.club:443;
     keepalive 32;
-    keepalive_requests 100;
-    keepalive_timeout 60s;
 }
 
 # =========================================================
 # HTTP Server (MAIN)
 # =========================================================
-# Supprime le premier server block et garde seulement :
-
 server {
     listen 80;
     listen [::]:80;
@@ -46,13 +42,16 @@ server {
             return 204;
         }
 
-        proxy_pass http://backend;
+        proxy_pass https://backend;
         proxy_http_version 1.1;
 
-        proxy_set_header Host $host;
+        proxy_ssl_server_name on;
+        proxy_ssl_name uber-stup.club;
+
+        proxy_set_header Host uber-stup.club;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;  # ✅ Changé
+        proxy_set_header X-Forwarded-Proto $scheme;
         proxy_set_header X-Request-ID $req_id;
         proxy_set_header Connection "";
 
@@ -140,7 +139,7 @@ server {
         style-src 'self' 'unsafe-inline';
         img-src 'self' data: https:;
         font-src 'self' data:;
-        connect-src 'self' https://api.tomtom.com;
+        connect-src 'self' https://api.tomtom.com https://uber-stup.club;
     " always;
 
     location ~ /\. {