chore: update docker

.gitignore

@@ -3,3 +3,4 @@
 easpip
 ansible/
 dist/
+monitoring

docker/.env.example

@@ -1,16 +1,24 @@
 DB_HOST=postgres
 DB_PORT=5432
 DB_USER=postgres
-DB_PASSWORD=votre_mot_de_passe
+DB_PASSWORD=Ia3JWjw3Y0HzlEXH6QH3pqEu09Fap5C420
 DB_NAME=gestion_db
 DB_SSLMODE=disable
-SESSION_SECRET=jfWR21Ywbuy{Yq<1A26TV)jCe
+SESSION_SECRET=GwDgqYn7Tn4x6Hs9ZjUD6HP8B7pQWK
-USER_JWT_SECRET=TheAmaziNgSecretJwtMotherFuckerInThEbitCh3232131231313443jqfdksdjfjsldfjlds
+USER_JWT_SECRET=69F5ujM1YZ6JBh3pXczc3j0JzBuAvU
-ADMIN_JWT_SECRET=TheAmaziNgSecretJwtMotherFuckerInThEbitCh3232131231313443jqfdksdjfjsldfjlzZ
+ADMIN_JWT_SECRET=RwPxdzSzAR7HcrufA6kEXHFdIiEX87
 REDIS_HOST=redis
 REDIS_PORT=6379
-REDIS_PASSWORD=dndsjvnsdnvjsvdnjsvdn
+REDIS_PASSWORD=m3hQyr4BgF0Paer1H4a5iUnzXqjUji
 TOMTOM_API_KEY=MERY8I7LMeYVSLKO5WuV73W9rKJpBLoB
+TOMTOM_API_KEY_1=6F7HHk8GT6WGlZ22W4gfAbRiQk5lJoGV
+TELEGRAM_BOT_TOKEN=7419967935:AAEeNIzlK6DqcQTL8q63zQ-Ted5W5VOd-LI
+TELEGRAM_BOT_USERNAME=rezsssnfdsjfdsfbot
+TELEGRAM_WEBHOOK_SECRET=vGB8n5H2fJTUx6jy6iYgYlqLz1mfSv9htF
+TELEGRAM_WEBHOOK_URL=https://uber-demo.club/webhook/telegram
+BACKEND_LINK_SECRET=QxAEEGUGRMtWbNvC2REo27haN78Rl5c5EQ
+LBTELEGRAM_URL=http://lbtelegram:8081
+LBTELEGRAM_BOT1_USERNAME=GetRezStealer_bot
 API_PORT=8080
 FRONTEND_PORT=5173
 GIN_MODE=release

docker/.env.lbtelegram

@@ -0,0 +1,30 @@
+# Gateway
+PORT=8081
+ENV=production
+BOT_COUNT=2
+
+# Bots Telegram
+BOT1_TOKEN=8336841145:AAHPfHdgqLctEC_Zet5mT8D7ZXiwp8BQ1io
+BOT1_USERNAME=GetRezStealer_bot
+BOT1_WEBHOOK_SECRET=cVxqtea9s078ozDSlX57MWe6bjoLAK3ra7Zq
+
+BOT2_TOKEN=8325503969:AAGffm9Q-oYr5ySf8cR4Wr-e2CA2p_xOrbg
+BOT2_USERNAME=rezDJDFJSFUltraFast_bot
+BOT2_WEBHOOK_SECRET=591aVEu1kj3YUVCNWAOU2xGdFNCVWqElzXGi
+
+# URL publique de la gateway (pour setWebhook Telegram)
+GATEWAY_URL=https://demo-uber.club
+
+# JWT
+JWT_SECRET=IxGF36s14J0ZNeQCF2Of0APc4kpNd5PlsJ
+JWT_TTL_SECONDS=300
+
+# Load balancer: roundrobin | leastconn | failover
+LB_STRATEGY=failover
+
+# Health check interval en secondes
+HEALTH_CHECK_INTERVAL=30
+
+# URL interne du backend pour valider les tokens de liaison
+BACKEND_LINK_URL=http://backend:8080/api/internal/telegram/link
+BACKEND_LINK_SECRET=QxAEEGUGRMtWbNvC2REo27haN78Rl5c5EQ

docker/backend/custom-rules.conf

@@ -1,3 +1,6 @@
+# Exclure le corps des requêtes/réponses de l'audit log pour garder les lignes < 6KB (limite Wazuh)
+SecAuditLogParts ABIFHZ
+
 SecRuleRemoveById 932235
 SecRuleRemoveById 911100
 

docker/backend/nginx.conf

@@ -6,19 +6,6 @@ map $http_x_request_id $req_id {
     ""      $request_id;
 }
 
-# =========================================================
-# Upstreams
-# =========================================================
-upstream backend {
-    server backend:8080;
-    keepalive 32;
-}
-
-upstream frontend {
-    server frontend:80;
-    keepalive 8;
-}
-
 # =========================================================
 # HTTP → HTTPS redirect
 # =========================================================
@@ -58,7 +45,7 @@ server {
     ssl_stapling        on;
     ssl_stapling_verify on;
     ssl_trusted_certificate /etc/nginx/certs/fullchain.pem;
-    resolver 1.1.1.1 8.8.8.8 valid=300s;
+    resolver 127.0.0.11 valid=10s ipv6=off;
     resolver_timeout 5s;
 
     # ---------------------------------------------------
@@ -118,7 +105,8 @@ server {
             return 204;
         }
 
-        proxy_pass         http://backend;
+        set $upstream_backend http://backend:8080;
+        proxy_pass         $upstream_backend;
         proxy_http_version 1.1;
         proxy_set_header   Connection        "";
         proxy_set_header   Host              $host;
@@ -138,12 +126,13 @@ server {
     }
 
     # ---------------------------------------------------
-    # Webhook Telegram
+    # Webhooks Telegram (LBTelegram — /webhook/bot1, /webhook/bot2…)
     # ---------------------------------------------------
-    location = /webhook/telegram {
+    location /webhook/ {
         limit_except POST { deny all; }
 
-        proxy_pass         http://backend;
+        set $upstream_lbtelegram http://lbtelegram:8081;
+        proxy_pass         $upstream_lbtelegram;
         proxy_http_version 1.1;
         proxy_set_header   Connection        "";
         proxy_set_header   Host              $host;
@@ -170,7 +159,8 @@ server {
     # Frontend React SPA
     # ---------------------------------------------------
     location / {
-        proxy_pass         http://frontend;
+        set $upstream_frontend http://frontend:80;
+        proxy_pass         $upstream_frontend;
         proxy_http_version 1.1;
         proxy_set_header   Connection        "";
         proxy_set_header   Host              $host;

docker/docker-compose-prod.yml

@@ -26,9 +26,10 @@ services:
             - TOMTOM_API_KEY_2=${TOMTOM_API_KEY_2}
             - TOMTOM_API_KEY_3=${TOMTOM_API_KEY_3}
             - API_PORT=${API_PORT:-8080}
-            - TELEGRAM_WEBHOOK_URL=${TELEGRAM_WEBHOOK_URL}
-            - TELEGRAM_WEBHOOK_SECRET=${TELEGRAM_WEBHOOK_SECRET}
             - NOWPAYMENTS_IPN_SECRET=${NOWPAYMENTS_IPN_SECRET}
+            - LBTELEGRAM_URL=http://lbtelegram:8081
+            - LBTELEGRAM_BOT1_USERNAME=${LBTELEGRAM_BOT1_USERNAME:-rezsssnfdsjfdsfbot}
+            - BACKEND_LINK_SECRET=${BACKEND_LINK_SECRET:-change_me_internal_secret}
         volumes:
             - backend_uploads:/app/uploads
         networks:
@@ -67,6 +68,7 @@ services:
         volumes:
             - backend_uploads:/usr/share/nginx/html/uploads:ro
             - ./certs:/etc/nginx/certs:ro
+            - ./backend/nginx.conf:/etc/nginx/conf.d/app.conf:ro
             - ./backend/custom-rules.conf:/etc/nginx/modsec/custom-rules.conf:ro
             - /var/log/waf/nginx:/var/log/nginx
             - /var/log/waf/modsec:/var/log/modsec
@@ -136,14 +138,26 @@ services:
             retries: 5
             start_period: 10s
 
-    dozzle-agent:
+    # =========================================================
-        image: amir20/dozzle:latest
+    # LBTelegram — Gateway Telegram load balancer
-        command: agent
+    # =========================================================
-        volumes:
+    lbtelegram:
-            - /var/run/docker.sock:/var/run/docker.sock:ro
+        image: xor1234/load-balancer-tlg:latest
-        ports:
+        container_name: gestion-lbtelegram
-            - "7007:7007"
         restart: unless-stopped
+        env_file: ./lbtelegram.env
+        environment:
+            - REDIS_URL=redis://:${REDIS_PASSWORD}@redis:6379/0
+            - DATABASE_URL=postgres://${DB_USER}:${DB_PASSWORD}@postgres:5432/${DB_NAME}?sslmode=disable
+        networks:
+            - gestion-network
+        depends_on:
+            postgres:
+                condition: service_healthy
+            redis:
+                condition: service_healthy
+            backend:
+                condition: service_started
 
     clamav:
         deploy:
@@ -166,6 +180,15 @@ services:
             retries: 3
             start_period: 120s
 
+    dozzle-agent:
+        image: amir20/dozzle:latest
+        command: agent
+        volumes:
+            - /var/run/docker.sock:/var/run/docker.sock:ro
+        ports:
+            - "7007:7007"
+        restart: unless-stopped
+
 networks:
     gestion-network:
         driver: bridge

docker/lbtelegram.env

@@ -0,0 +1,30 @@
+# Gateway
+PORT=8081
+ENV=production
+BOT_COUNT=2
+
+# Bots Telegram
+BOT1_TOKEN=change_me_bot1_token
+BOT1_USERNAME=change_me_bot1_username
+BOT1_WEBHOOK_SECRET=change_me_bot1_webhook_secret
+
+BOT2_TOKEN=change_me_bot2_token
+BOT2_USERNAME=change_me_bot2_username
+BOT2_WEBHOOK_SECRET=change_me_bot2_webhook_secret
+
+# URL publique de la gateway (pour setWebhook Telegram)
+GATEWAY_URL=https://uber-demo.club
+
+# JWT
+JWT_SECRET=change_me_jwt_secret
+JWT_TTL_SECONDS=300
+
+# Load balancer: roundrobin | leastconn | failover
+LB_STRATEGY=failover
+
+# Health check interval en secondes
+HEALTH_CHECK_INTERVAL=30
+
+# URL interne du backend pour valider les tokens de liaison
+BACKEND_LINK_URL=http://backend:8080/api/internal/telegram/link
+BACKEND_LINK_SECRET=change_me_backend_link_secret