Xor290/projet_gestion_commande
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add xavia-ota & rustfs & update INFRA.md

Browse Source
This commit is contained in:
Xor290
2026-05-10 14:14:30 +02:00
parent 66ba61f986
commit c76dc2a187
3 changed files with 160 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
INFRA.md
+38 -5
View File
@@ -55,11 +55,14 @@ graph TB
%% ─── VPS Monitoring ─────────────────────────────────────────
subgraph MonVPS["VPS Monitoring — uber-stup.club"]
subgraph MonNet["Docker network : monitoring_net"]
MNGINX["🔀 Nginx RP\n:80 / :443 ← public\ndozzle.uber-stup.club\nwazuh.uber-stup.club"]
MNGINX["🔀 Nginx RP\n:80 / :443 ← public\ndozzle / wazuh\nrustfs / s3 / ota"]
DOZZLE["📋 Dozzle\nLogs temps réel\n:8080 ← interne"]
WAZUH_M["🔍 Wazuh Manager\n:1514 agents\n:1515 enroll\n:514 syslog"]
WAZUH_I["🗂️ Wazuh Indexer\nOpenSearch :9200"]
WAZUH_D["📊 Wazuh Dashboard\nKibana :5601"]
RUSTFS["🗃️ RustFS\nS3-compatible :9000\nConsole :9001"]
XAVIA["🚀 Xavia OTA\nNext.js :3000"]
XAVIA_DB["🗄️ PostgreSQL 16\nxavia_db ← interne"]
end
end
@@ -100,11 +103,19 @@ graph TB
DOCKERHUB -->|"docker pull"| BACK
DOCKERHUB -->|"docker pull"| FRONT
%% ─── CI/CD mobile → OTA ────────────────────────────────────
GHA_A -->|"eas build pre-prod"| XAVIA
GHA_C -->|"eas build pre-prod"| XAVIA
%% ─── Monitoring ─────────────────────────────────────────────
MNGINX --> DOZZLE
MNGINX --> WAZUH_D
MNGINX -->|"rustfs.uber-stup.club"| RUSTFS
MNGINX -->|"s3.uber-stup.club"| RUSTFS
MNGINX -->|"ota.uber-stup.club"| XAVIA
WAZUH_D --> WAZUH_I
WAZUH_M --> WAZUH_I
XAVIA --> XAVIA_DB
DOZZLE -->|"remote agent :7007"| ProdVPS
DOZZLE -->|"remote agent :7007"| PreProdVPS
```
@@ -196,11 +207,14 @@ Même stack que la production, déployé depuis la branche `pre-prod` via `SERVE
| Conteneur | Image | Ports | Rôle |
|---|---|---|---|
| `nginx` | `nginx:alpine` | **80, 443** (public) | Reverse proxy monitoring |
| `monitoring_nginx` | `nginx:alpine` | **80, 443** (public) | Reverse proxy monitoring |
| `dozzle` | `amir20/dozzle:latest` | 8080 (interne) | Logs Docker temps réel |
| `wazuh.manager` | `wazuh/wazuh-manager:4.9.2` | 1514, 1515, 514/udp | SIEM — collecte agents |
| `wazuh.indexer` | `wazuh/wazuh-indexer:4.9.2` | 9200 (interne) | OpenSearch (stockage events) |
| `wazuh.dashboard` | `wazuh/wazuh-dashboard:4.9.2` | 5601 (interne) | Kibana (visualisation) |
| `wazuh.manager` | `wazuh/wazuh-manager:4.14.5` | 1514, 1515, 514/udp | SIEM — collecte agents |
| `wazuh.indexer` | `wazuh/wazuh-indexer:4.14.5` | 9200 (interne) | OpenSearch (stockage events) |
| `wazuh.dashboard` | `wazuh/wazuh-dashboard:4.14.5` | 5601 (interne) | Kibana (visualisation) |
| `rustfs` | `rustfs/rustfs:latest` | 9000 S3, 9001 console (internes) | Stockage objet S3-compatible (APKs) |
| `xavia` | `xaviaio/xavia-ota:latest` | 3000 (interne) | Serveur OTA Expo (Next.js) |
| `xavia_db` | `postgres:16-alpine` | 5432 (interne) | Base de données Xavia |
### Accès publics
@@ -208,6 +222,25 @@ Même stack que la production, déployé depuis la branche `pre-prod` via `SERVE
|---|---|
| `https://dozzle.uber-stup.club` | Interface logs Docker |
| `https://wazuh.uber-stup.club` | Dashboard SIEM Wazuh |
| `https://rustfs.uber-stup.club` | Console RustFS (stockage APKs) |
| `https://s3.uber-stup.club` | API S3 RustFS |
| `https://ota.uber-stup.club` | Dashboard & API Xavia OTA |
### Xavia OTA — configuration app Expo
```json
"updates": {
"url": "https://ota.uber-stup.club/api/manifest",
"codeSigningCertificate": "./certs/certificate.pem",
"codeSigningMetadata": {
"keyid": "main",
"algorithm": "rsa-v1_5-sha256"
}
}
```
Clé privée RSA 4096 stockée sur le serveur dans `/home/ubuntu/xavia-keys/private-key.pem`.
Le `certificate.pem` doit être commité dans le repo mobile sous `mobile/certs/certificate.pem`.
### Dozzle — agents distants
monitoring/docker-compose.yml
+44 -5
View File
@@ -145,17 +145,53 @@ services:
hostname: rustfs
container_name: rustfs
restart: unless-stopped
ports:
- 9000:9000
- 9001:9001
volumes:
- /mnt/data:/data
environment:
- RUSTFS_ACCESS_KEY=rustfsadmin
- RUSTFS_SECRET_KEY=rustfsadmin
- RUSTFS_ACCESS_KEY=${RUSTFS_ACCESS_KEY:-rustfsadmin}
- RUSTFS_SECRET_KEY=${RUSTFS_SECRET_KEY:-rustfsadmin}
- RUSTFS_SERVER_DOMAINS=rustfs.uber-stup.club
- RUSTFS_CONSOLE_ENABLE=true
- RUSTFS_ADDRESS=:9000
- RUSTFS_CONSOLE_ADDRESS=:9001
networks:
- monitoring_net
# ─── Xavia OTA — PostgreSQL ───────────────────────────────
xavia_db:
image: postgres:16-alpine
container_name: xavia_db
restart: unless-stopped
environment:
- POSTGRES_USER=${XAVIA_POSTGRES_USER:-xavia}
- POSTGRES_PASSWORD=${XAVIA_POSTGRES_PASSWORD}
- POSTGRES_DB=${XAVIA_POSTGRES_DB:-releases_db}
volumes:
- xavia_db_data:/var/lib/postgresql/data
networks:
- monitoring_net
# ─── Xavia OTA ────────────────────────────────────────────
xavia:
image: xaviaio/xavia-ota:latest
container_name: xavia
restart: unless-stopped
environment:
- HOST=https://ota.uber-stup.club
- BLOB_STORAGE_TYPE=local
- DB_TYPE=postgres
- ADMIN_PASSWORD=${XAVIA_ADMIN_PASSWORD}
- UPLOAD_KEY=${XAVIA_UPLOAD_KEY}
- PRIVATE_KEY_BASE_64=${XAVIA_PRIVATE_KEY_BASE_64}
- POSTGRES_USER=${XAVIA_POSTGRES_USER:-xavia}
- POSTGRES_PASSWORD=${XAVIA_POSTGRES_PASSWORD}
- POSTGRES_DB=${XAVIA_POSTGRES_DB:-releases_db}
- POSTGRES_HOST=xavia_db
- POSTGRES_PORT=5432
volumes:
- xavia_blobs:/app/blobs
depends_on:
- xavia_db
networks:
- monitoring_net
networks:
@@ -163,6 +199,9 @@ networks:
driver: bridge
volumes:
# Xavia
xavia_db_data:
xavia_blobs:
# Wazuh
wazuh_api_configuration:
wazuh_etc:
monitoring/nginx/nginx.conf
+78
View File
@@ -39,6 +39,84 @@ http {
}
}
# ── RustFS Console ──────────────────────────────────────
server {
listen 443 ssl;
server_name rustfs.uber-stup.club;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/rustfs_access.log;
error_log /var/log/nginx/rustfs_error.log;
# Console web (port 9001)
location / {
proxy_pass http://rustfs:9001;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 300s;
client_max_body_size 500m;
}
}
# ── RustFS S3 API ───────────────────────────────────────
server {
listen 443 ssl;
server_name s3.uber-stup.club;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/rustfs_s3_access.log;
error_log /var/log/nginx/rustfs_s3_error.log;
location / {
proxy_pass http://rustfs:9000;
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 300s;
client_max_body_size 2g;
}
}
# ── Xavia OTA ───────────────────────────────────────────
server {
listen 443 ssl;
server_name ota.uber-stup.club;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/xavia_access.log;
error_log /var/log/nginx/xavia_error.log;
location / {
proxy_pass http://xavia:3000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 300s;
client_max_body_size 500m;
}
}
# ── Wazuh Dashboard ─────────────────────────────────────
server {
listen 443 ssl;