diff --git a/INFRA.md b/INFRA.md index ff22d7a7..5e16acb2 100644 --- a/INFRA.md +++ b/INFRA.md @@ -55,11 +55,14 @@ graph TB %% ─── VPS Monitoring ───────────────────────────────────────── subgraph MonVPS["VPS Monitoring — uber-stup.club"] subgraph MonNet["Docker network : monitoring_net"] - MNGINX["🔀 Nginx RP\n:80 / :443 ← public\ndozzle.uber-stup.club\nwazuh.uber-stup.club"] + MNGINX["🔀 Nginx RP\n:80 / :443 ← public\ndozzle / wazuh\nrustfs / s3 / ota"] DOZZLE["📋 Dozzle\nLogs temps réel\n:8080 ← interne"] WAZUH_M["🔍 Wazuh Manager\n:1514 agents\n:1515 enroll\n:514 syslog"] WAZUH_I["🗂️ Wazuh Indexer\nOpenSearch :9200"] WAZUH_D["📊 Wazuh Dashboard\nKibana :5601"] + RUSTFS["🗃️ RustFS\nS3-compatible :9000\nConsole :9001"] + XAVIA["🚀 Xavia OTA\nNext.js :3000"] + XAVIA_DB["🗄️ PostgreSQL 16\nxavia_db ← interne"] end end @@ -100,11 +103,19 @@ graph TB DOCKERHUB -->|"docker pull"| BACK DOCKERHUB -->|"docker pull"| FRONT + %% ─── CI/CD mobile → OTA ──────────────────────────────────── + GHA_A -->|"eas build pre-prod"| XAVIA + GHA_C -->|"eas build pre-prod"| XAVIA + %% ─── Monitoring ───────────────────────────────────────────── MNGINX --> DOZZLE MNGINX --> WAZUH_D + MNGINX -->|"rustfs.uber-stup.club"| RUSTFS + MNGINX -->|"s3.uber-stup.club"| RUSTFS + MNGINX -->|"ota.uber-stup.club"| XAVIA WAZUH_D --> WAZUH_I WAZUH_M --> WAZUH_I + XAVIA --> XAVIA_DB DOZZLE -->|"remote agent :7007"| ProdVPS DOZZLE -->|"remote agent :7007"| PreProdVPS ``` @@ -196,11 +207,14 @@ Même stack que la production, déployé depuis la branche `pre-prod` via `SERVE | Conteneur | Image | Ports | Rôle | |---|---|---|---| -| `nginx` | `nginx:alpine` | **80, 443** (public) | Reverse proxy monitoring | +| `monitoring_nginx` | `nginx:alpine` | **80, 443** (public) | Reverse proxy monitoring | | `dozzle` | `amir20/dozzle:latest` | 8080 (interne) | Logs Docker temps réel | -| `wazuh.manager` | `wazuh/wazuh-manager:4.9.2` | 1514, 1515, 514/udp | SIEM — collecte agents | -| `wazuh.indexer` | `wazuh/wazuh-indexer:4.9.2` | 9200 (interne) | OpenSearch (stockage events) | -| `wazuh.dashboard` | `wazuh/wazuh-dashboard:4.9.2` | 5601 (interne) | Kibana (visualisation) | +| `wazuh.manager` | `wazuh/wazuh-manager:4.14.5` | 1514, 1515, 514/udp | SIEM — collecte agents | +| `wazuh.indexer` | `wazuh/wazuh-indexer:4.14.5` | 9200 (interne) | OpenSearch (stockage events) | +| `wazuh.dashboard` | `wazuh/wazuh-dashboard:4.14.5` | 5601 (interne) | Kibana (visualisation) | +| `rustfs` | `rustfs/rustfs:latest` | 9000 S3, 9001 console (internes) | Stockage objet S3-compatible (APKs) | +| `xavia` | `xaviaio/xavia-ota:latest` | 3000 (interne) | Serveur OTA Expo (Next.js) | +| `xavia_db` | `postgres:16-alpine` | 5432 (interne) | Base de données Xavia | ### Accès publics @@ -208,6 +222,25 @@ Même stack que la production, déployé depuis la branche `pre-prod` via `SERVE |---|---| | `https://dozzle.uber-stup.club` | Interface logs Docker | | `https://wazuh.uber-stup.club` | Dashboard SIEM Wazuh | +| `https://rustfs.uber-stup.club` | Console RustFS (stockage APKs) | +| `https://s3.uber-stup.club` | API S3 RustFS | +| `https://ota.uber-stup.club` | Dashboard & API Xavia OTA | + +### Xavia OTA — configuration app Expo + +```json +"updates": { + "url": "https://ota.uber-stup.club/api/manifest", + "codeSigningCertificate": "./certs/certificate.pem", + "codeSigningMetadata": { + "keyid": "main", + "algorithm": "rsa-v1_5-sha256" + } +} +``` + +Clé privée RSA 4096 stockée sur le serveur dans `/home/ubuntu/xavia-keys/private-key.pem`. +Le `certificate.pem` doit être commité dans le repo mobile sous `mobile/certs/certificate.pem`. ### Dozzle — agents distants diff --git a/monitoring/docker-compose.yml b/monitoring/docker-compose.yml index 93b3b8a2..9a750f73 100644 --- a/monitoring/docker-compose.yml +++ b/monitoring/docker-compose.yml @@ -145,17 +145,53 @@ services: hostname: rustfs container_name: rustfs restart: unless-stopped - ports: - - 9000:9000 - - 9001:9001 volumes: - /mnt/data:/data environment: - - RUSTFS_ACCESS_KEY=rustfsadmin - - RUSTFS_SECRET_KEY=rustfsadmin + - RUSTFS_ACCESS_KEY=${RUSTFS_ACCESS_KEY:-rustfsadmin} + - RUSTFS_SECRET_KEY=${RUSTFS_SECRET_KEY:-rustfsadmin} - RUSTFS_SERVER_DOMAINS=rustfs.uber-stup.club - RUSTFS_CONSOLE_ENABLE=true - RUSTFS_ADDRESS=:9000 + - RUSTFS_CONSOLE_ADDRESS=:9001 + networks: + - monitoring_net + + # ─── Xavia OTA — PostgreSQL ─────────────────────────────── + xavia_db: + image: postgres:16-alpine + container_name: xavia_db + restart: unless-stopped + environment: + - POSTGRES_USER=${XAVIA_POSTGRES_USER:-xavia} + - POSTGRES_PASSWORD=${XAVIA_POSTGRES_PASSWORD} + - POSTGRES_DB=${XAVIA_POSTGRES_DB:-releases_db} + volumes: + - xavia_db_data:/var/lib/postgresql/data + networks: + - monitoring_net + + # ─── Xavia OTA ──────────────────────────────────────────── + xavia: + image: xaviaio/xavia-ota:latest + container_name: xavia + restart: unless-stopped + environment: + - HOST=https://ota.uber-stup.club + - BLOB_STORAGE_TYPE=local + - DB_TYPE=postgres + - ADMIN_PASSWORD=${XAVIA_ADMIN_PASSWORD} + - UPLOAD_KEY=${XAVIA_UPLOAD_KEY} + - PRIVATE_KEY_BASE_64=${XAVIA_PRIVATE_KEY_BASE_64} + - POSTGRES_USER=${XAVIA_POSTGRES_USER:-xavia} + - POSTGRES_PASSWORD=${XAVIA_POSTGRES_PASSWORD} + - POSTGRES_DB=${XAVIA_POSTGRES_DB:-releases_db} + - POSTGRES_HOST=xavia_db + - POSTGRES_PORT=5432 + volumes: + - xavia_blobs:/app/blobs + depends_on: + - xavia_db networks: - monitoring_net networks: @@ -163,6 +199,9 @@ networks: driver: bridge volumes: + # Xavia + xavia_db_data: + xavia_blobs: # Wazuh wazuh_api_configuration: wazuh_etc: diff --git a/monitoring/nginx/nginx.conf b/monitoring/nginx/nginx.conf index 939ca807..3a847a36 100644 --- a/monitoring/nginx/nginx.conf +++ b/monitoring/nginx/nginx.conf @@ -39,6 +39,84 @@ http { } } + # ── RustFS Console ────────────────────────────────────── + server { + listen 443 ssl; + server_name rustfs.uber-stup.club; + + ssl_certificate /etc/nginx/certs/fullchain.pem; + ssl_certificate_key /etc/nginx/certs/privkey.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers HIGH:!aNULL:!MD5; + + access_log /var/log/nginx/rustfs_access.log; + error_log /var/log/nginx/rustfs_error.log; + + # Console web (port 9001) + location / { + proxy_pass http://rustfs:9001; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_read_timeout 300s; + client_max_body_size 500m; + } + } + + # ── RustFS S3 API ─────────────────────────────────────── + server { + listen 443 ssl; + server_name s3.uber-stup.club; + + ssl_certificate /etc/nginx/certs/fullchain.pem; + ssl_certificate_key /etc/nginx/certs/privkey.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers HIGH:!aNULL:!MD5; + + access_log /var/log/nginx/rustfs_s3_access.log; + error_log /var/log/nginx/rustfs_s3_error.log; + + location / { + proxy_pass http://rustfs:9000; + proxy_http_version 1.1; + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_read_timeout 300s; + client_max_body_size 2g; + } + } + + # ── Xavia OTA ─────────────────────────────────────────── + server { + listen 443 ssl; + server_name ota.uber-stup.club; + + ssl_certificate /etc/nginx/certs/fullchain.pem; + ssl_certificate_key /etc/nginx/certs/privkey.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers HIGH:!aNULL:!MD5; + + access_log /var/log/nginx/xavia_access.log; + error_log /var/log/nginx/xavia_error.log; + + location / { + proxy_pass http://xavia:3000; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_read_timeout 300s; + client_max_body_size 500m; + } + } + # ── Wazuh Dashboard ───────────────────────────────────── server { listen 443 ssl;