feat: add xavia-ota & rustfs & update INFRA.md

monitoring/docker-compose.yml

@@ -145,17 +145,53 @@ services:
         hostname: rustfs
         container_name: rustfs
         restart: unless-stopped
-        ports:
-            - 9000:9000
-            - 9001:9001
         volumes:
             - /mnt/data:/data
         environment:
-            - RUSTFS_ACCESS_KEY=rustfsadmin
-            - RUSTFS_SECRET_KEY=rustfsadmin
+            - RUSTFS_ACCESS_KEY=${RUSTFS_ACCESS_KEY:-rustfsadmin}
+            - RUSTFS_SECRET_KEY=${RUSTFS_SECRET_KEY:-rustfsadmin}
             - RUSTFS_SERVER_DOMAINS=rustfs.uber-stup.club
             - RUSTFS_CONSOLE_ENABLE=true
             - RUSTFS_ADDRESS=:9000
+            - RUSTFS_CONSOLE_ADDRESS=:9001
+        networks:
+            - monitoring_net
+
+    # ─── Xavia OTA — PostgreSQL ───────────────────────────────
+    xavia_db:
+        image: postgres:16-alpine
+        container_name: xavia_db
+        restart: unless-stopped
+        environment:
+            - POSTGRES_USER=${XAVIA_POSTGRES_USER:-xavia}
+            - POSTGRES_PASSWORD=${XAVIA_POSTGRES_PASSWORD}
+            - POSTGRES_DB=${XAVIA_POSTGRES_DB:-releases_db}
+        volumes:
+            - xavia_db_data:/var/lib/postgresql/data
+        networks:
+            - monitoring_net
+
+    # ─── Xavia OTA ────────────────────────────────────────────
+    xavia:
+        image: xaviaio/xavia-ota:latest
+        container_name: xavia
+        restart: unless-stopped
+        environment:
+            - HOST=https://ota.uber-stup.club
+            - BLOB_STORAGE_TYPE=local
+            - DB_TYPE=postgres
+            - ADMIN_PASSWORD=${XAVIA_ADMIN_PASSWORD}
+            - UPLOAD_KEY=${XAVIA_UPLOAD_KEY}
+            - PRIVATE_KEY_BASE_64=${XAVIA_PRIVATE_KEY_BASE_64}
+            - POSTGRES_USER=${XAVIA_POSTGRES_USER:-xavia}
+            - POSTGRES_PASSWORD=${XAVIA_POSTGRES_PASSWORD}
+            - POSTGRES_DB=${XAVIA_POSTGRES_DB:-releases_db}
+            - POSTGRES_HOST=xavia_db
+            - POSTGRES_PORT=5432
+        volumes:
+            - xavia_blobs:/app/blobs
+        depends_on:
+            - xavia_db
         networks:
             - monitoring_net
 networks:
@@ -163,6 +199,9 @@ networks:
         driver: bridge
 
 volumes:
+    # Xavia
+    xavia_db_data:
+    xavia_blobs:
     # Wazuh
     wazuh_api_configuration:
     wazuh_etc:

monitoring/nginx/nginx.conf

@@ -39,6 +39,84 @@ http {
         }
     }
 
+    # ── RustFS Console ──────────────────────────────────────
+    server {
+        listen 443 ssl;
+        server_name rustfs.uber-stup.club;
+
+        ssl_certificate     /etc/nginx/certs/fullchain.pem;
+        ssl_certificate_key /etc/nginx/certs/privkey.pem;
+        ssl_protocols       TLSv1.2 TLSv1.3;
+        ssl_ciphers         HIGH:!aNULL:!MD5;
+
+        access_log /var/log/nginx/rustfs_access.log;
+        error_log  /var/log/nginx/rustfs_error.log;
+
+        # Console web (port 9001)
+        location / {
+            proxy_pass         http://rustfs:9001;
+            proxy_http_version 1.1;
+            proxy_set_header   Host $host;
+            proxy_set_header   X-Real-IP $remote_addr;
+            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header   X-Forwarded-Proto $scheme;
+            proxy_set_header   Upgrade $http_upgrade;
+            proxy_set_header   Connection "upgrade";
+            proxy_read_timeout 300s;
+            client_max_body_size 500m;
+        }
+    }
+
+    # ── RustFS S3 API ───────────────────────────────────────
+    server {
+        listen 443 ssl;
+        server_name s3.uber-stup.club;
+
+        ssl_certificate     /etc/nginx/certs/fullchain.pem;
+        ssl_certificate_key /etc/nginx/certs/privkey.pem;
+        ssl_protocols       TLSv1.2 TLSv1.3;
+        ssl_ciphers         HIGH:!aNULL:!MD5;
+
+        access_log /var/log/nginx/rustfs_s3_access.log;
+        error_log  /var/log/nginx/rustfs_s3_error.log;
+
+        location / {
+            proxy_pass         http://rustfs:9000;
+            proxy_http_version 1.1;
+            proxy_set_header   Host $http_host;
+            proxy_set_header   X-Real-IP $remote_addr;
+            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header   X-Forwarded-Proto $scheme;
+            proxy_read_timeout 300s;
+            client_max_body_size 2g;
+        }
+    }
+
+    # ── Xavia OTA ───────────────────────────────────────────
+    server {
+        listen 443 ssl;
+        server_name ota.uber-stup.club;
+
+        ssl_certificate     /etc/nginx/certs/fullchain.pem;
+        ssl_certificate_key /etc/nginx/certs/privkey.pem;
+        ssl_protocols       TLSv1.2 TLSv1.3;
+        ssl_ciphers         HIGH:!aNULL:!MD5;
+
+        access_log /var/log/nginx/xavia_access.log;
+        error_log  /var/log/nginx/xavia_error.log;
+
+        location / {
+            proxy_pass         http://xavia:3000;
+            proxy_http_version 1.1;
+            proxy_set_header   Host $host;
+            proxy_set_header   X-Real-IP $remote_addr;
+            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header   X-Forwarded-Proto $scheme;
+            proxy_read_timeout 300s;
+            client_max_body_size 500m;
+        }
+    }
+
     # ── Wazuh Dashboard ─────────────────────────────────────
     server {
         listen 443 ssl;