diff --git a/.gitignore b/.gitignore index 470d00d0..0cca1328 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ easpip ansible/ dist/ +monitoring diff --git a/docker/.env.example b/docker/.env.example index 9bb16927..2673b66b 100644 --- a/docker/.env.example +++ b/docker/.env.example @@ -1,16 +1,24 @@ DB_HOST=postgres DB_PORT=5432 DB_USER=postgres -DB_PASSWORD=votre_mot_de_passe +DB_PASSWORD=Ia3JWjw3Y0HzlEXH6QH3pqEu09Fap5C420 DB_NAME=gestion_db DB_SSLMODE=disable -SESSION_SECRET=jfWR21Ywbuy{Yq<1A26TV)jCe -USER_JWT_SECRET=TheAmaziNgSecretJwtMotherFuckerInThEbitCh3232131231313443jqfdksdjfjsldfjlds -ADMIN_JWT_SECRET=TheAmaziNgSecretJwtMotherFuckerInThEbitCh3232131231313443jqfdksdjfjsldfjlzZ +SESSION_SECRET=GwDgqYn7Tn4x6Hs9ZjUD6HP8B7pQWK +USER_JWT_SECRET=69F5ujM1YZ6JBh3pXczc3j0JzBuAvU +ADMIN_JWT_SECRET=RwPxdzSzAR7HcrufA6kEXHFdIiEX87 REDIS_HOST=redis REDIS_PORT=6379 -REDIS_PASSWORD=dndsjvnsdnvjsvdnjsvdn +REDIS_PASSWORD=m3hQyr4BgF0Paer1H4a5iUnzXqjUji TOMTOM_API_KEY=MERY8I7LMeYVSLKO5WuV73W9rKJpBLoB +TOMTOM_API_KEY_1=6F7HHk8GT6WGlZ22W4gfAbRiQk5lJoGV +TELEGRAM_BOT_TOKEN=7419967935:AAEeNIzlK6DqcQTL8q63zQ-Ted5W5VOd-LI +TELEGRAM_BOT_USERNAME=rezsssnfdsjfdsfbot +TELEGRAM_WEBHOOK_SECRET=vGB8n5H2fJTUx6jy6iYgYlqLz1mfSv9htF +TELEGRAM_WEBHOOK_URL=https://uber-demo.club/webhook/telegram +BACKEND_LINK_SECRET=QxAEEGUGRMtWbNvC2REo27haN78Rl5c5EQ +LBTELEGRAM_URL=http://lbtelegram:8081 +LBTELEGRAM_BOT1_USERNAME=GetRezStealer_bot API_PORT=8080 FRONTEND_PORT=5173 GIN_MODE=release diff --git a/docker/.env.lbtelegram b/docker/.env.lbtelegram new file mode 100644 index 00000000..c6af6483 --- /dev/null +++ b/docker/.env.lbtelegram @@ -0,0 +1,30 @@ +# Gateway +PORT=8081 +ENV=production +BOT_COUNT=2 + +# Bots Telegram +BOT1_TOKEN=8336841145:AAHPfHdgqLctEC_Zet5mT8D7ZXiwp8BQ1io +BOT1_USERNAME=GetRezStealer_bot +BOT1_WEBHOOK_SECRET=cVxqtea9s078ozDSlX57MWe6bjoLAK3ra7Zq + +BOT2_TOKEN=8325503969:AAGffm9Q-oYr5ySf8cR4Wr-e2CA2p_xOrbg +BOT2_USERNAME=rezDJDFJSFUltraFast_bot +BOT2_WEBHOOK_SECRET=591aVEu1kj3YUVCNWAOU2xGdFNCVWqElzXGi + +# URL publique de la gateway (pour setWebhook Telegram) +GATEWAY_URL=https://demo-uber.club + +# JWT +JWT_SECRET=IxGF36s14J0ZNeQCF2Of0APc4kpNd5PlsJ +JWT_TTL_SECONDS=300 + +# Load balancer: roundrobin | leastconn | failover +LB_STRATEGY=failover + +# Health check interval en secondes +HEALTH_CHECK_INTERVAL=30 + +# URL interne du backend pour valider les tokens de liaison +BACKEND_LINK_URL=http://backend:8080/api/internal/telegram/link +BACKEND_LINK_SECRET=QxAEEGUGRMtWbNvC2REo27haN78Rl5c5EQ diff --git a/docker/backend/custom-rules.conf b/docker/backend/custom-rules.conf index ce800c19..c2aaeb37 100644 --- a/docker/backend/custom-rules.conf +++ b/docker/backend/custom-rules.conf @@ -1,3 +1,6 @@ +# Exclure le corps des requêtes/réponses de l'audit log pour garder les lignes < 6KB (limite Wazuh) +SecAuditLogParts ABIFHZ + SecRuleRemoveById 932235 SecRuleRemoveById 911100 diff --git a/docker/backend/nginx.conf b/docker/backend/nginx.conf index 2518edd7..69c73f62 100644 --- a/docker/backend/nginx.conf +++ b/docker/backend/nginx.conf @@ -6,19 +6,6 @@ map $http_x_request_id $req_id { "" $request_id; } -# ========================================================= -# Upstreams -# ========================================================= -upstream backend { - server backend:8080; - keepalive 32; -} - -upstream frontend { - server frontend:80; - keepalive 8; -} - # ========================================================= # HTTP → HTTPS redirect # ========================================================= @@ -58,7 +45,7 @@ server { ssl_stapling on; ssl_stapling_verify on; ssl_trusted_certificate /etc/nginx/certs/fullchain.pem; - resolver 1.1.1.1 8.8.8.8 valid=300s; + resolver 127.0.0.11 valid=10s ipv6=off; resolver_timeout 5s; # --------------------------------------------------- @@ -118,7 +105,8 @@ server { return 204; } - proxy_pass http://backend; + set $upstream_backend http://backend:8080; + proxy_pass $upstream_backend; proxy_http_version 1.1; proxy_set_header Connection ""; proxy_set_header Host $host; @@ -138,12 +126,13 @@ server { } # --------------------------------------------------- - # Webhook Telegram + # Webhooks Telegram (LBTelegram — /webhook/bot1, /webhook/bot2…) # --------------------------------------------------- - location = /webhook/telegram { + location /webhook/ { limit_except POST { deny all; } - proxy_pass http://backend; + set $upstream_lbtelegram http://lbtelegram:8081; + proxy_pass $upstream_lbtelegram; proxy_http_version 1.1; proxy_set_header Connection ""; proxy_set_header Host $host; @@ -170,7 +159,8 @@ server { # Frontend React SPA # --------------------------------------------------- location / { - proxy_pass http://frontend; + set $upstream_frontend http://frontend:80; + proxy_pass $upstream_frontend; proxy_http_version 1.1; proxy_set_header Connection ""; proxy_set_header Host $host; diff --git a/docker/docker-compose-prod.yml b/docker/docker-compose-prod.yml index 92007d63..13c77dab 100644 --- a/docker/docker-compose-prod.yml +++ b/docker/docker-compose-prod.yml @@ -26,9 +26,10 @@ services: - TOMTOM_API_KEY_2=${TOMTOM_API_KEY_2} - TOMTOM_API_KEY_3=${TOMTOM_API_KEY_3} - API_PORT=${API_PORT:-8080} - - TELEGRAM_WEBHOOK_URL=${TELEGRAM_WEBHOOK_URL} - - TELEGRAM_WEBHOOK_SECRET=${TELEGRAM_WEBHOOK_SECRET} - NOWPAYMENTS_IPN_SECRET=${NOWPAYMENTS_IPN_SECRET} + - LBTELEGRAM_URL=http://lbtelegram:8081 + - LBTELEGRAM_BOT1_USERNAME=${LBTELEGRAM_BOT1_USERNAME:-rezsssnfdsjfdsfbot} + - BACKEND_LINK_SECRET=${BACKEND_LINK_SECRET:-change_me_internal_secret} volumes: - backend_uploads:/app/uploads networks: @@ -67,6 +68,7 @@ services: volumes: - backend_uploads:/usr/share/nginx/html/uploads:ro - ./certs:/etc/nginx/certs:ro + - ./backend/nginx.conf:/etc/nginx/conf.d/app.conf:ro - ./backend/custom-rules.conf:/etc/nginx/modsec/custom-rules.conf:ro - /var/log/waf/nginx:/var/log/nginx - /var/log/waf/modsec:/var/log/modsec @@ -136,14 +138,26 @@ services: retries: 5 start_period: 10s - dozzle-agent: - image: amir20/dozzle:latest - command: agent - volumes: - - /var/run/docker.sock:/var/run/docker.sock:ro - ports: - - "7007:7007" + # ========================================================= + # LBTelegram — Gateway Telegram load balancer + # ========================================================= + lbtelegram: + image: xor1234/load-balancer-tlg:latest + container_name: gestion-lbtelegram restart: unless-stopped + env_file: ./lbtelegram.env + environment: + - REDIS_URL=redis://:${REDIS_PASSWORD}@redis:6379/0 + - DATABASE_URL=postgres://${DB_USER}:${DB_PASSWORD}@postgres:5432/${DB_NAME}?sslmode=disable + networks: + - gestion-network + depends_on: + postgres: + condition: service_healthy + redis: + condition: service_healthy + backend: + condition: service_started clamav: deploy: @@ -166,6 +180,15 @@ services: retries: 3 start_period: 120s + dozzle-agent: + image: amir20/dozzle:latest + command: agent + volumes: + - /var/run/docker.sock:/var/run/docker.sock:ro + ports: + - "7007:7007" + restart: unless-stopped + networks: gestion-network: driver: bridge diff --git a/docker/lbtelegram.env b/docker/lbtelegram.env new file mode 100644 index 00000000..b91d7cda --- /dev/null +++ b/docker/lbtelegram.env @@ -0,0 +1,30 @@ +# Gateway +PORT=8081 +ENV=production +BOT_COUNT=2 + +# Bots Telegram +BOT1_TOKEN=change_me_bot1_token +BOT1_USERNAME=change_me_bot1_username +BOT1_WEBHOOK_SECRET=change_me_bot1_webhook_secret + +BOT2_TOKEN=change_me_bot2_token +BOT2_USERNAME=change_me_bot2_username +BOT2_WEBHOOK_SECRET=change_me_bot2_webhook_secret + +# URL publique de la gateway (pour setWebhook Telegram) +GATEWAY_URL=https://uber-demo.club + +# JWT +JWT_SECRET=change_me_jwt_secret +JWT_TTL_SECONDS=300 + +# Load balancer: roundrobin | leastconn | failover +LB_STRATEGY=failover + +# Health check interval en secondes +HEALTH_CHECK_INTERVAL=30 + +# URL interne du backend pour valider les tokens de liaison +BACKEND_LINK_URL=http://backend:8080/api/internal/telegram/link +BACKEND_LINK_SECRET=change_me_backend_link_secret