feat: add xavia-ota & rustfs & update INFRA.md

INFRA.md

@@ -55,11 +55,14 @@ graph TB
     %% ─── VPS Monitoring ─────────────────────────────────────────
     subgraph MonVPS["VPS Monitoring — uber-stup.club"]
         subgraph MonNet["Docker network : monitoring_net"]
-            MNGINX["🔀 Nginx RP\n:80 / :443 ← public\ndozzle.uber-stup.club\nwazuh.uber-stup.club"]
+            MNGINX["🔀 Nginx RP\n:80 / :443 ← public\ndozzle / wazuh\nrustfs / s3 / ota"]
             DOZZLE["📋 Dozzle\nLogs temps réel\n:8080 ← interne"]
             WAZUH_M["🔍 Wazuh Manager\n:1514 agents\n:1515 enroll\n:514 syslog"]
             WAZUH_I["🗂️ Wazuh Indexer\nOpenSearch :9200"]
             WAZUH_D["📊 Wazuh Dashboard\nKibana :5601"]
+            RUSTFS["🗃️ RustFS\nS3-compatible :9000\nConsole :9001"]
+            XAVIA["🚀 Xavia OTA\nNext.js :3000"]
+            XAVIA_DB["🗄️ PostgreSQL 16\nxavia_db ← interne"]
         end
     end
 
@@ -100,11 +103,19 @@ graph TB
     DOCKERHUB -->|"docker pull"| BACK
     DOCKERHUB -->|"docker pull"| FRONT
 
+    %% ─── CI/CD mobile → OTA ────────────────────────────────────
+    GHA_A -->|"eas build pre-prod"| XAVIA
+    GHA_C -->|"eas build pre-prod"| XAVIA
+
     %% ─── Monitoring ─────────────────────────────────────────────
     MNGINX --> DOZZLE
     MNGINX --> WAZUH_D
+    MNGINX -->|"rustfs.uber-stup.club"| RUSTFS
+    MNGINX -->|"s3.uber-stup.club"| RUSTFS
+    MNGINX -->|"ota.uber-stup.club"| XAVIA
     WAZUH_D --> WAZUH_I
     WAZUH_M --> WAZUH_I
+    XAVIA --> XAVIA_DB
     DOZZLE  -->|"remote agent :7007"| ProdVPS
     DOZZLE  -->|"remote agent :7007"| PreProdVPS
 ```
@@ -196,11 +207,14 @@ Même stack que la production, déployé depuis la branche `pre-prod` via `SERVE
 
 | Conteneur | Image | Ports | Rôle |
 |---|---|---|---|
-| `nginx` | `nginx:alpine` | **80, 443** (public) | Reverse proxy monitoring |
+| `monitoring_nginx` | `nginx:alpine` | **80, 443** (public) | Reverse proxy monitoring |
 | `dozzle` | `amir20/dozzle:latest` | 8080 (interne) | Logs Docker temps réel |
-| `wazuh.manager` | `wazuh/wazuh-manager:4.9.2` | 1514, 1515, 514/udp | SIEM — collecte agents |
+| `wazuh.manager` | `wazuh/wazuh-manager:4.14.5` | 1514, 1515, 514/udp | SIEM — collecte agents |
-| `wazuh.indexer` | `wazuh/wazuh-indexer:4.9.2` | 9200 (interne) | OpenSearch (stockage events) |
+| `wazuh.indexer` | `wazuh/wazuh-indexer:4.14.5` | 9200 (interne) | OpenSearch (stockage events) |
-| `wazuh.dashboard` | `wazuh/wazuh-dashboard:4.9.2` | 5601 (interne) | Kibana (visualisation) |
+| `wazuh.dashboard` | `wazuh/wazuh-dashboard:4.14.5` | 5601 (interne) | Kibana (visualisation) |
+| `rustfs` | `rustfs/rustfs:latest` | 9000 S3, 9001 console (internes) | Stockage objet S3-compatible (APKs) |
+| `xavia` | `xaviaio/xavia-ota:latest` | 3000 (interne) | Serveur OTA Expo (Next.js) |
+| `xavia_db` | `postgres:16-alpine` | 5432 (interne) | Base de données Xavia |
 
 ### Accès publics
 
@@ -208,6 +222,25 @@ Même stack que la production, déployé depuis la branche `pre-prod` via `SERVE
 |---|---|
 | `https://dozzle.uber-stup.club` | Interface logs Docker |
 | `https://wazuh.uber-stup.club` | Dashboard SIEM Wazuh |
+| `https://rustfs.uber-stup.club` | Console RustFS (stockage APKs) |
+| `https://s3.uber-stup.club` | API S3 RustFS |
+| `https://ota.uber-stup.club` | Dashboard & API Xavia OTA |
+
+### Xavia OTA — configuration app Expo
+
+```json
+"updates": {
+  "url": "https://ota.uber-stup.club/api/manifest",
+  "codeSigningCertificate": "./certs/certificate.pem",
+  "codeSigningMetadata": {
+    "keyid": "main",
+    "algorithm": "rsa-v1_5-sha256"
+  }
+}
+```
+
+Clé privée RSA 4096 stockée sur le serveur dans `/home/ubuntu/xavia-keys/private-key.pem`.
+Le `certificate.pem` doit être commité dans le repo mobile sous `mobile/certs/certificate.pem`.
 
 ### Dozzle — agents distants
 

monitoring/docker-compose.yml

@@ -145,17 +145,53 @@ services:
         hostname: rustfs
         container_name: rustfs
         restart: unless-stopped
-        ports:
-            - 9000:9000
-            - 9001:9001
         volumes:
             - /mnt/data:/data
         environment:
-            - RUSTFS_ACCESS_KEY=rustfsadmin
+            - RUSTFS_ACCESS_KEY=${RUSTFS_ACCESS_KEY:-rustfsadmin}
-            - RUSTFS_SECRET_KEY=rustfsadmin
+            - RUSTFS_SECRET_KEY=${RUSTFS_SECRET_KEY:-rustfsadmin}
             - RUSTFS_SERVER_DOMAINS=rustfs.uber-stup.club
             - RUSTFS_CONSOLE_ENABLE=true
             - RUSTFS_ADDRESS=:9000
+            - RUSTFS_CONSOLE_ADDRESS=:9001
+        networks:
+            - monitoring_net
+
+    # ─── Xavia OTA — PostgreSQL ───────────────────────────────
+    xavia_db:
+        image: postgres:16-alpine
+        container_name: xavia_db
+        restart: unless-stopped
+        environment:
+            - POSTGRES_USER=${XAVIA_POSTGRES_USER:-xavia}
+            - POSTGRES_PASSWORD=${XAVIA_POSTGRES_PASSWORD}
+            - POSTGRES_DB=${XAVIA_POSTGRES_DB:-releases_db}
+        volumes:
+            - xavia_db_data:/var/lib/postgresql/data
+        networks:
+            - monitoring_net
+
+    # ─── Xavia OTA ────────────────────────────────────────────
+    xavia:
+        image: xaviaio/xavia-ota:latest
+        container_name: xavia
+        restart: unless-stopped
+        environment:
+            - HOST=https://ota.uber-stup.club
+            - BLOB_STORAGE_TYPE=local
+            - DB_TYPE=postgres
+            - ADMIN_PASSWORD=${XAVIA_ADMIN_PASSWORD}
+            - UPLOAD_KEY=${XAVIA_UPLOAD_KEY}
+            - PRIVATE_KEY_BASE_64=${XAVIA_PRIVATE_KEY_BASE_64}
+            - POSTGRES_USER=${XAVIA_POSTGRES_USER:-xavia}
+            - POSTGRES_PASSWORD=${XAVIA_POSTGRES_PASSWORD}
+            - POSTGRES_DB=${XAVIA_POSTGRES_DB:-releases_db}
+            - POSTGRES_HOST=xavia_db
+            - POSTGRES_PORT=5432
+        volumes:
+            - xavia_blobs:/app/blobs
+        depends_on:
+            - xavia_db
         networks:
             - monitoring_net
 networks:
@@ -163,6 +199,9 @@ networks:
         driver: bridge
 
 volumes:
+    # Xavia
+    xavia_db_data:
+    xavia_blobs:
     # Wazuh
     wazuh_api_configuration:
     wazuh_etc:

monitoring/nginx/nginx.conf

@@ -39,6 +39,84 @@ http {
         }
     }
 
+    # ── RustFS Console ──────────────────────────────────────
+    server {
+        listen 443 ssl;
+        server_name rustfs.uber-stup.club;
+
+        ssl_certificate     /etc/nginx/certs/fullchain.pem;
+        ssl_certificate_key /etc/nginx/certs/privkey.pem;
+        ssl_protocols       TLSv1.2 TLSv1.3;
+        ssl_ciphers         HIGH:!aNULL:!MD5;
+
+        access_log /var/log/nginx/rustfs_access.log;
+        error_log  /var/log/nginx/rustfs_error.log;
+
+        # Console web (port 9001)
+        location / {
+            proxy_pass         http://rustfs:9001;
+            proxy_http_version 1.1;
+            proxy_set_header   Host $host;
+            proxy_set_header   X-Real-IP $remote_addr;
+            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header   X-Forwarded-Proto $scheme;
+            proxy_set_header   Upgrade $http_upgrade;
+            proxy_set_header   Connection "upgrade";
+            proxy_read_timeout 300s;
+            client_max_body_size 500m;
+        }
+    }
+
+    # ── RustFS S3 API ───────────────────────────────────────
+    server {
+        listen 443 ssl;
+        server_name s3.uber-stup.club;
+
+        ssl_certificate     /etc/nginx/certs/fullchain.pem;
+        ssl_certificate_key /etc/nginx/certs/privkey.pem;
+        ssl_protocols       TLSv1.2 TLSv1.3;
+        ssl_ciphers         HIGH:!aNULL:!MD5;
+
+        access_log /var/log/nginx/rustfs_s3_access.log;
+        error_log  /var/log/nginx/rustfs_s3_error.log;
+
+        location / {
+            proxy_pass         http://rustfs:9000;
+            proxy_http_version 1.1;
+            proxy_set_header   Host $http_host;
+            proxy_set_header   X-Real-IP $remote_addr;
+            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header   X-Forwarded-Proto $scheme;
+            proxy_read_timeout 300s;
+            client_max_body_size 2g;
+        }
+    }
+
+    # ── Xavia OTA ───────────────────────────────────────────
+    server {
+        listen 443 ssl;
+        server_name ota.uber-stup.club;
+
+        ssl_certificate     /etc/nginx/certs/fullchain.pem;
+        ssl_certificate_key /etc/nginx/certs/privkey.pem;
+        ssl_protocols       TLSv1.2 TLSv1.3;
+        ssl_ciphers         HIGH:!aNULL:!MD5;
+
+        access_log /var/log/nginx/xavia_access.log;
+        error_log  /var/log/nginx/xavia_error.log;
+
+        location / {
+            proxy_pass         http://xavia:3000;
+            proxy_http_version 1.1;
+            proxy_set_header   Host $host;
+            proxy_set_header   X-Real-IP $remote_addr;
+            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header   X-Forwarded-Proto $scheme;
+            proxy_read_timeout 300s;
+            client_max_body_size 500m;
+        }
+    }
+
     # ── Wazuh Dashboard ─────────────────────────────────────
     server {
         listen 443 ssl;