Xor290/projet_gestion_commande
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: update

Browse Source
This commit is contained in:
Xor290
2026-06-10 22:16:09 +02:00
parent 78bd98e72f
commit 40dac3a838
5 changed files with 246 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files
monitoring/s3-backup/.env
+2
View File
@@ -0,0 +1,2 @@
RUSTFS_ACCESS_KEY=iBacJPHUHSf6SMTnxrr
RUSTFS_SECRET_KEY=4jNzZhstv1WkwTwtvR4gHSbrx01m4sJl4LBBleeJ
monitoring/s3-backup/docker-compose.yml
+104
View File
@@ -0,0 +1,104 @@
services:
nginx:
image: nginx:alpine
container_name: s3_nginx
restart: unless-stopped
ports:
- "10.0.0.4:80:80"
- "10.0.0.4:8080:8080"
- "10.0.0.4:9000:9000"
- "10.0.0.4:9001:9001"
volumes:
- ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
- ./nginx/certs:/etc/nginx/certs:ro
- nginx_logs:/var/log/nginx
depends_on:
- minio
networks:
- s3_net
minio:
image: minio/minio:latest
container_name: s3_minio
restart: unless-stopped
hostname: minio
volumes:
- /mnt/data:/data
environment:
- MINIO_ROOT_USER=admin
- MINIO_ROOT_PASSWORD=admin@12345
- MINIO_ADDRESS=:9000
- MINIO_CONSOLE_ADDRESS=:9001
command: minio server /data --console-address :9001
networks:
- s3_net
dozzle-agent:
image: amir20/dozzle:latest
command: agent
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
ports:
- "7007:7007"
restart: unless-stopped
beszel-agent:
image: henrygd/beszel-agent:latest
container_name: beszel_agent
restart: unless-stopped
network_mode: host
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
environment:
PORT: "10001"
KEY: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEwRVn66crRDX5iL0bxNOnrp3OhTiXHKs+COx/bo5vmQ beszel-agent"
# ─── ClamAV Antivirus ─────────────────────────────────────────
clamav:
image: clamav/clamav:stable
container_name: s3_clamav
restart: unless-stopped
environment:
- FRESHCLAM_CHECKS=24
- CLAMD_SCAN_MAX_FILESIZE=200M
- CLAMD_SCAN_MAX_SCANSIZE=200M
volumes:
- clamav_db:/var/lib/clamav
- clamav_logs:/var/log/clamav
networks:
- s3_net
clamav-scanner:
image: clamav/clamav:stable
container_name: s3_clamav_scanner
restart: unless-stopped
depends_on:
- clamav
volumes:
- clamav_db:/var/lib/clamav:ro
- clamav_scan_logs:/var/log/clamav
- /mnt/data:/scan:ro
entrypoint: >
/bin/sh -c "
echo 'Waiting for virus definitions...' &&
until [ -f /var/lib/clamav/daily.cvd ] || [ -f /var/lib/clamav/daily.cld ]; do sleep 10; done &&
while true; do
DATE=$$(date +%Y%m%d_%H%M%S) &&
LOG=/var/log/clamav/scan-$$DATE.log &&
echo \"[$$DATE] Scan started\" | tee -a $$LOG &&
clamscan --recursive --infected --log=$$LOG /scan &&
echo \"[$$DATE] Scan complete\" | tee -a $$LOG &&
sleep 86400;
done"
networks:
- s3_net
networks:
s3_net:
driver: bridge
volumes:
nginx_logs:
clamav_db:
clamav_logs:
clamav_scan_logs:
monitoring/s3-backup/nginx/nginx.conf
+96
View File
@@ -0,0 +1,96 @@
worker_processes auto;
events {
worker_connections 1024;
}
http {
resolver 127.0.0.11 valid=10s ipv6=off;
# ── MinIO Console GUI HTTPS (VPN: 10.0.0.4:8080) ────────
server {
listen 8080 ssl;
server_name 10.0.0.4 _;
ssl_certificate /etc/nginx/certs/cert.pem;
ssl_certificate_key /etc/nginx/certs/key.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/minio_console_access.log;
error_log /var/log/nginx/minio_console_error.log;
location / {
proxy_pass http://minio:9001;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_buffering off;
proxy_read_timeout 300s;
client_max_body_size 500m;
}
}
# ── HTTP Redirect to HTTPS (VPN: 10.0.0.4:80) ────────────
server {
listen 80;
server_name _;
location / {
return 301 https://$host:8080$request_uri;
}
}
# ── MinIO Console Direct HTTPS (VPN: 10.0.0.4:9001) ──────
server {
listen 9001 ssl;
server_name 10.0.0.4 _;
ssl_certificate /etc/nginx/certs/cert.pem;
ssl_certificate_key /etc/nginx/certs/key.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/minio_console_direct_access.log;
error_log /var/log/nginx/minio_console_direct_error.log;
location / {
proxy_pass http://minio:9001;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_buffering off;
proxy_read_timeout 300s;
client_max_body_size 500m;
}
}
# ── MinIO S3 API HTTP (VPN: 10.0.0.4:9000) ────────────────
server {
listen 9000;
server_name 10.0.0.4 _;
access_log /var/log/nginx/minio_s3_api_access.log;
error_log /var/log/nginx/minio_s3_api_error.log;
location / {
proxy_pass http://minio:9000;
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto http;
proxy_buffering off;
proxy_read_timeout 300s;
client_max_body_size 2g;
}
}
}
monitoring/security/docker-compose-security.yml
+3 -1
View File
@@ -9,7 +9,7 @@ services:
environment:
DOZZLE_AUTH_PROVIDER: simple
DOZZLE_AUTH_TTL: 48h
DOZZLE_REMOTE_AGENT: "185.103.166.112:7007|pre-prod-uber|VPS,185.103.166.119:7007|prod-uber|VPS"
DOZZLE_REMOTE_AGENT: "185.103.166.112:7007|pre-prod-uber|VPS,185.103.166.119:7007|prod-uber|VPS,10.0.0.4:7007|backup-mln|VPN"
networks:
- monitoring_net
@@ -20,6 +20,8 @@ services:
ports:
- "80:80"
- "443:443"
- "8080:8080"
- "8090:8090"
volumes:
- ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
- ./nginx/certs:/etc/nginx/certs:ro
monitoring/security/nginx/nginx.conf
+41 -114
View File
@@ -7,77 +7,10 @@ events {
http {
resolver 127.0.0.11 valid=10s ipv6=off;
# Redirect HTTP -> HTTPS
# ── Dozzle (8080) ───────────────────────────────────────
server {
listen 80;
listen 8080 ssl;
server_name _;
return 301 https://$host$request_uri;
}
# ── Default server (by IP + path) ────────────────────────
server {
listen 443 ssl default_server;
server_name _;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
# Root → Wazuh Dashboard
location = / {
return 301 https://$host/wazuh;
}
# /wazuh → Wazuh Dashboard
location /wazuh/ {
set $upstream https://wazuh.dashboard:5601;
proxy_pass $upstream;
proxy_ssl_verify off;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 300s;
proxy_hide_header Content-Security-Policy;
}
# /dozzle → Dozzle
location /dozzle/ {
set $upstream http://dozzle:8080;
proxy_pass $upstream;
proxy_http_version 1.1;
proxy_buffering off;
proxy_cache off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 3600s;
}
# /beszel → Beszel
location /beszel/ {
set $upstream http://beszel:8090;
proxy_pass $upstream;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 3600s;
}
}
# ── Dozzle ──────────────────────────────────────────────
server {
listen 443 ssl;
server_name dozzle.demo-uber.xyz;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
@@ -88,10 +21,8 @@ http {
error_log /var/log/nginx/dozzle_error.log;
location / {
set $upstream http://dozzle:8080;
proxy_pass $upstream;
proxy_pass http://dozzle:8080;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_buffering off;
proxy_cache off;
proxy_set_header Host $host;
@@ -102,47 +33,10 @@ http {
}
}
# ── Wazuh Dashboard ─────────────────────────────────────
# ── Beszel (8090) ───────────────────────────────────────
server {
listen 443 ssl;
server_name wazuh.demo-uber.xyz;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/wazuh_access.log;
error_log /var/log/nginx/wazuh_error.log;
location / {
set $upstream https://wazuh.dashboard:5601;
proxy_pass $upstream;
proxy_ssl_verify off;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 300s;
proxy_hide_header Content-Security-Policy;
proxy_hide_header X-Frame-Options;
proxy_hide_header X-XSS-Protection;
}
}
# ── Beszel ──────────────────────────────────────────────
server {
listen 443 ssl;
server_name beszel.demo-uber.xyz;
listen 8090 ssl;
server_name _;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
@@ -153,8 +47,7 @@ http {
error_log /var/log/nginx/beszel_error.log;
location / {
set $upstream http://beszel:8090;
proxy_pass $upstream;
proxy_pass http://beszel:8090;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
@@ -165,4 +58,38 @@ http {
proxy_read_timeout 3600s;
}
}
# ── Wazuh (443) ──────────────────────────────────────────
server {
listen 443 ssl default_server;
server_name _;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/wazuh_access.log;
error_log /var/log/nginx/wazuh_error.log;
location / {
proxy_pass https://wazuh.dashboard:5601;
proxy_ssl_verify off;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 300s;
}
}
# ── HTTP Redirect to HTTPS ───────────────────────────────
server {
listen 80;
server_name _;
return 301 https://$host$request_uri;
}
}