Xor290/projet_gestion_commande
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: fix

Browse Source
This commit is contained in:
Xor290
2026-06-14 18:18:37 +02:00
parent 6d4e0862ff
commit c471a2a734
13 changed files with 994 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker-prod/backend/Dockerfile
+76
View File
@@ -0,0 +1,76 @@
FROM golang:1.24-alpine AS builder
WORKDIR /app
# Installer les dépendances système
RUN apk add --no-cache git ca-certificates tzdata gcc musl-dev
# Copier go mod files
COPY backend/gestion/go.mod backend/gestion/go.sum ./
# Configurer Go et télécharger les dépendances
ENV GOPROXY=https://proxy.golang.org,direct
ENV GOSUMDB=sum.golang.org
ENV CGO_ENABLED=0
# Télécharger les dépendances
RUN go mod download
# Copier tout le code source
COPY backend/gestion/ .
# Build le binaire
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
-ldflags="-w -s -X main.Version=1.0.0 -X main.BuildTime=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
-o /app/server .
# =========================================================
# Stage 2: Runtime
# =========================================================
FROM alpine:latest AS runtime
# Installer les dépendances runtime
RUN apk --no-cache add ca-certificates tzdata wget
# Créer l'utilisateur avec UID/GID fixes
RUN addgroup -g 101 app && adduser -u 101 -S app -G app
WORKDIR /app
# Copier le binaire et les fichiers nécessaires
COPY --from=builder /app/server .
COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
# Copier l'entrypoint
COPY docker/backend/entrypoint.sh .
RUN chmod +x entrypoint.sh
RUN mkdir -p /app/uploads/images /app/uploads/videos && \
chown -R app:app /app
# Passer à l'utilisateur non-root
USER app
EXPOSE 8080
ENTRYPOINT ["./entrypoint.sh"]
# =========================================================
# Stage 3: WAF (Nginx + ModSecurity)
# =========================================================
FROM owasp/modsecurity-crs:nginx-alpine AS waf
# Toutes les opérations privilégiées en root
USER root
RUN mkdir -p /var/log/modsec /etc/nginx/certs && \
chown -R nginx:nginx /var/log/modsec /etc/nginx/certs /usr/share/nginx/html
COPY docker/backend/nginx.conf /etc/nginx/conf.d/app.conf
COPY docker/backend/custom-rules.conf /etc/nginx/modsec/custom-rules.conf
RUN echo "Include /etc/nginx/modsec/custom-rules.conf" > /etc/nginx/modsec/custom-includes.conf && \
rm -f /etc/nginx/templates/conf.d/default.conf.template || true
USER nginx
EXPOSE 80 443
CMD ["nginx", "-g", "daemon off;"]
docker-prod/backend/custom-rules.conf
+77
View File
@@ -0,0 +1,77 @@
# Exclure le corps des requêtes/réponses de l'audit log pour garder les lignes < 6KB (limite Wazuh)
SecAuditLogParts ABIFHZ
SecRuleRemoveById 932235
SecRuleRemoveById 911100
SecRule REQUEST_URI "@streq /api/v2/admin/protected/products" \
"id:399002,phase:2,nolog,pass,\
ctl:ruleRemoveById=920120,\
ctl:ruleRemoveById=920121"
SecRule REQUEST_URI "@beginsWith /uploads/" \
"id:1000,\
phase:1,\
pass,\
nolog,\
ctl:ruleEngine=Off"
SecRule IP:BANNED "@eq 1" \
"id:100000,phase:1,deny,status:403,log,\
msg:'IP is banned'"
SecRule IP:REPUTATION_SCORE "@ge 100" \
"id:100099,phase:1,deny,status:403,log,\
msg:'Critical reputation score',\
setvar:'ip.blocked=1',expirevar:'ip.blocked=86400'"
SecRule TX:SQL_INJECTION_SCORE "@ge 5" \
"id:100001,phase:2,deny,status:403,log,\
msg:'SQL Injection detected',\
setvar:'ip.banned=1',expirevar:'ip.banned=172800'"
SecRule TX:XSS_SCORE "@ge 5" \
"id:100010,phase:2,deny,status:403,log,\
msg:'XSS detected',\
setvar:'ip.banned=1',expirevar:'ip.banned=172800'"
SecRule TX:RCE_SCORE "@ge 5" \
"id:100020,phase:2,deny,status:403,log,\
msg:'RCE detected',\
setvar:'ip.banned=1',expirevar:'ip.banned=259200'"
SecRule TX:LFI_SCORE "@ge 5" \
"id:100030,phase:2,deny,status:403,log,\
msg:'LFI detected',\
setvar:'ip.banned=1',expirevar:'ip.banned=172800'"
SecRule TX:INBOUND_ANOMALY_SCORE "@ge 20" \
"id:100060,phase:2,deny,status:403,log,\
msg:'Critical anomaly score',\
setvar:'ip.banned=1',expirevar:'ip.banned=172800'"
SecRule REQUEST_URI "@streq /api/v1/panier/remove" \
"id:399010,phase:1,nolog,pass,\
ctl:ruleRemoveById=911100,ctl:ruleRemoveById=920350"
SecRule REQUEST_URI "@streq /api/v1/panier/clear" \
"id:399011,phase:1,nolog,pass,\
ctl:ruleRemoveById=911100,ctl:ruleRemoveById=920350"
SecRule REQUEST_URI "@streq /api/v2/admin/protected/products" \
"id:399001,phase:2,nolog,pass,\
ctl:ruleRemoveById=932235"
SecAction \
"id:400161,phase:1,nolog,pass,\
setvar:'ip.request_window_1sec=+1',\
expirevar:'ip.request_window_1sec=1'"
SecRule IP:REQUEST_WINDOW_1SEC "@gt 20" \
"id:400160,phase:1,deny,status:429,log,\
msg:'Too many requests'"
SecRule IP:REPUTATION_SCORE "@ge 100" \
"id:409999,phase:1,deny,status:403,log,\
msg:'Critical reputation score',\
setvar:'ip.blocked=1',expirevar:'ip.blocked=86400'"
docker-prod/backend/entrypoint.sh
Executable
+16
View File
@@ -0,0 +1,16 @@
#!/bin/sh
set -e
# Créer le dossier uploads s'il n'existe pas (le volume le crée en root)
# Puis créer les sous-dossiers
if [ ! -d "/app/uploads" ]; then
mkdir -p /app/uploads
fi
# Créer les sous-répertoires
mkdir -p /app/uploads/images /app/uploads/videos 2>/dev/null || true
echo "✅ Répertoires uploads prêts"
# Lancer l'application
exec ./server
docker-prod/backend/nginx.conf
+215
View File
@@ -0,0 +1,215 @@
# =========================================================
# Request ID correlation
# =========================================================
map $http_x_request_id $req_id {
default $http_x_request_id;
"" $request_id;
}
# =========================================================
# HTTP → HTTPS redirect
# =========================================================
server {
listen 80;
listen [::]:80;
server_name _;
return 301 https://$host$request_uri;
}
# =========================================================
# HTTPS — Hardened
# =========================================================
server {
listen 443 ssl;
listen [::]:443 ssl;
http2 on;
server_name _;
server_tokens off;
# ---------------------------------------------------
# TLS
# ---------------------------------------------------
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256;
ssl_prefer_server_ciphers off;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx/certs/fullchain.pem;
resolver 127.0.0.11 valid=10s ipv6=off;
resolver_timeout 5s;
# ---------------------------------------------------
# En-têtes de sécurité
# ---------------------------------------------------
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "0" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https:; frame-ancestors 'self';" always;
# ---------------------------------------------------
# Limites et timeouts
# ---------------------------------------------------
client_max_body_size 100M;
client_body_buffer_size 128k;
client_header_buffer_size 1k;
large_client_header_buffers 4 8k;
client_body_timeout 30s;
client_header_timeout 30s;
send_timeout 30s;
keepalive_timeout 65s;
# ---------------------------------------------------
# Gzip (statique uniquement — évite BREACH sur l'API)
# ---------------------------------------------------
gzip on;
gzip_vary on;
gzip_proxied any;
gzip_comp_level 5;
gzip_min_length 1000;
gzip_types text/plain text/css text/javascript application/javascript application/json image/svg+xml;
# ---------------------------------------------------
# ModSecurity WAF
# ---------------------------------------------------
modsecurity on;
modsecurity_rules_file /etc/nginx/modsec/custom-rules.conf;
# ---------------------------------------------------
# API backend Go
# ---------------------------------------------------
location /api/ {
limit_except GET POST PUT PATCH DELETE OPTIONS { deny all; }
if ($request_method = 'OPTIONS') {
add_header 'Access-Control-Allow-Origin' "$http_origin" always;
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always;
add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Request-ID' always;
add_header 'Access-Control-Allow-Credentials' 'true' always;
add_header 'Access-Control-Max-Age' 86400 always;
add_header 'Content-Length' 0;
add_header 'Content-Type' 'text/plain charset=UTF-8';
return 204;
}
set $upstream_backend http://backend:8080;
proxy_pass $upstream_backend;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Request-ID $req_id;
proxy_hide_header X-Powered-By;
proxy_connect_timeout 60s;
proxy_send_timeout 300s;
proxy_read_timeout 300s;
proxy_buffer_size 128k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
}
# ---------------------------------------------------
# Webhook Telegram principal → backend Go
# ---------------------------------------------------
location = /webhook/telegram {
limit_except POST { deny all; }
set $upstream_backend http://backend:8080;
proxy_pass $upstream_backend;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# ---------------------------------------------------
# Webhooks LBTelegram (/webhook/bot1, /webhook/bot2…)
# ---------------------------------------------------
location /webhook/ {
limit_except POST { deny all; }
set $upstream_lbtelegram http://lbtelegram:8081;
proxy_pass $upstream_lbtelegram;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# ---------------------------------------------------
# Fichiers uploadés (images / vidéos)
# ---------------------------------------------------
location /uploads/ {
alias /usr/share/nginx/html/uploads/;
expires 7d;
add_header Cache-Control "public, no-transform" always;
add_header X-Content-Type-Options "nosniff" always;
location ~* \.(php|pl|py|cgi|sh|rb|exe)$ {
deny all;
}
}
# ---------------------------------------------------
# Frontend React SPA
# ---------------------------------------------------
location / {
set $upstream_frontend http://frontend:80;
proxy_pass $upstream_frontend;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# ---------------------------------------------------
# Blocage fichiers sensibles
# ---------------------------------------------------
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
location ~* \.(env|git|sql|bak|log|conf|ini|sh)$ {
deny all;
access_log off;
log_not_found off;
}
location ~* (package\.json|package-lock\.json|yarn\.lock|Dockerfile|docker-compose)$ {
deny all;
access_log off;
log_not_found off;
}
# Bloquer scans WordPress / PHP courants
location ~* (wp-admin|wp-login|wp-content|xmlrpc|\.php)$ {
deny all;
access_log off;
log_not_found off;
}
}