Xor290/projet_gestion_commande

Fork 0

Files

T

Xor290 c76dc2a187 feat: add xavia-ota & rustfs & update INFRA.md

2026-05-10 14:14:30 +02:00

14 KiB

Raw Blame History

Infrastructure — Projet Gestion Commande

Schéma global

graph TB
    %% ─── Clients ───────────────────────────────────────────────
    subgraph Clients["Clients"]
        WEB["🌐 Web\nReact / Vite\n(frontend-prep)"]
        MOB["📱 Mobile client\nReact Native / Expo\n(mobile/)"]
        ADM["📱 Mobile admin\nReact Native / Expo\n(frontend-admin/)"]
    end

    %% ─── Services externes ──────────────────────────────────────
    subgraph External["Services externes"]
        TOMTOM["TomTom API\nMaps & routing"]
        TELEGRAM["Telegram\nBot / Webhooks"]
        NOWPAY["NowPayments\nCrypto IPN"]
        DOCKERHUB["Docker Hub\nxor1234/backend-mln\nxor1234/frontend-mln"]
        EAS["Expo EAS\nAPK builds"]
    end

    %% ─── CI/CD ──────────────────────────────────────────────────
    subgraph CICD["CI/CD — GitHub Actions"]
        GHA_B_PP["backend-build.yml (pre-prod)\nlint → build → docker → SSH deploy"]
        GHA_F_PP["frontend-web-build.yml (pre-prod)\nlint → build → docker → SSH deploy"]
        GHA_B["backend-build.yml (main)\nlint → build → docker → SSH deploy"]
        GHA_F["frontend-web-build.yml (main)\nlint → build → docker → SSH deploy"]
        GHA_A["frontend-admin-build.yml\ntypecheck → EAS APK"]
        GHA_C["frontend-client-build.yml\ntypecheck → EAS APK"]
    end

    %% ─── VPS Pre-prod ───────────────────────────────────────────
    subgraph PreProdVPS["VPS Pre-prod"]
        subgraph GestionNetPP["Docker network : gestion-network"]
            WAF_PP["🛡️ WAF\nnginx + ModSecurity CRS\n:80 / :443 ← public"]
            BACK_PP["⚙️ Backend\nGo 1.24 + Gin\n:8080 ← interne"]
            FRONT_PP["🖥️ Frontend\nReact SPA — nginx\n:80 ← interne"]
            PG_PP["🗄️ PostgreSQL 16\n← interne"]
            REDIS_PP["⚡ Redis 7\n← interne"]
        end
    end

    %% ─── VPS Production ─────────────────────────────────────────
    subgraph ProdVPS["VPS Production — mln-uber.club"]
        subgraph GestionNet["Docker network : gestion-network"]
            WAF["🛡️ WAF\nnginx + ModSecurity CRS\nParanoia L2\n:80 / :443 ← public"]
            BACK["⚙️ Backend\nGo 1.24 + Gin\n:8080 ← interne"]
            FRONT["🖥️ Frontend\nReact SPA — nginx\n:80 ← interne"]
            PG["🗄️ PostgreSQL 16\ngestion_db\n← interne"]
            REDIS["⚡ Redis 7\nSessions · Queue · Cache\n256 MB LRU ← interne"]
        end
    end

    %% ─── VPS Monitoring ─────────────────────────────────────────
    subgraph MonVPS["VPS Monitoring — uber-stup.club"]
        subgraph MonNet["Docker network : monitoring_net"]
            MNGINX["🔀 Nginx RP\n:80 / :443 ← public\ndozzle / wazuh\nrustfs / s3 / ota"]
            DOZZLE["📋 Dozzle\nLogs temps réel\n:8080 ← interne"]
            WAZUH_M["🔍 Wazuh Manager\n:1514 agents\n:1515 enroll\n:514 syslog"]
            WAZUH_I["🗂️ Wazuh Indexer\nOpenSearch :9200"]
            WAZUH_D["📊 Wazuh Dashboard\nKibana :5601"]
            RUSTFS["🗃️ RustFS\nS3-compatible :9000\nConsole :9001"]
            XAVIA["🚀 Xavia OTA\nNext.js :3000"]
            XAVIA_DB["🗄️ PostgreSQL 16\nxavia_db ← interne"]
        end
    end

    %% ─── Flux clients ───────────────────────────────────────────
    WEB  -->|HTTPS| WAF
    MOB  -->|HTTPS| WAF
    ADM  -->|HTTPS| WAF

    %% ─── Routage WAF ────────────────────────────────────────────
    WAF -->|"/api/*"| BACK
    WAF -->|"/* SPA"| FRONT
    WAF -->|"/uploads/*"| BACK

    %% ─── Backend ↔ données ──────────────────────────────────────
    BACK --> PG
    BACK --> REDIS

    %% ─── Backend ↔ services externes ────────────────────────────
    BACK -->|"Geocoding / ETA"| TOMTOM
    BACK -->|"Webhook"| TELEGRAM
    BACK -->|"IPN callback"| NOWPAY

    %% ─── CI/CD ──────────────────────────────────────────────────
    GHA_B_PP -->|"push :latest + :waf"| DOCKERHUB
    GHA_F_PP -->|"push :latest"| DOCKERHUB
    GHA_B_PP -->|"SSH deploy (SERVER_HOST)"| PreProdVPS
    GHA_F_PP -->|"SSH deploy (SERVER_HOST)"| PreProdVPS
    GHA_B -->|"push :latest + :waf"| DOCKERHUB
    GHA_F -->|"push :latest"| DOCKERHUB
    GHA_B -->|"SSH deploy (SERVER_HOST_PROD)"| ProdVPS
    GHA_F -->|"SSH deploy (SERVER_HOST_PROD)"| ProdVPS
    GHA_A -->|"eas build android"| EAS
    GHA_C -->|"eas build android"| EAS
    DOCKERHUB -->|"docker pull"| WAF_PP
    DOCKERHUB -->|"docker pull"| BACK_PP
    DOCKERHUB -->|"docker pull"| FRONT_PP
    DOCKERHUB -->|"docker pull"| WAF
    DOCKERHUB -->|"docker pull"| BACK
    DOCKERHUB -->|"docker pull"| FRONT

    %% ─── CI/CD mobile → OTA ────────────────────────────────────
    GHA_A -->|"eas build pre-prod"| XAVIA
    GHA_C -->|"eas build pre-prod"| XAVIA

    %% ─── Monitoring ─────────────────────────────────────────────
    MNGINX --> DOZZLE
    MNGINX --> WAZUH_D
    MNGINX -->|"rustfs.uber-stup.club"| RUSTFS
    MNGINX -->|"s3.uber-stup.club"| RUSTFS
    MNGINX -->|"ota.uber-stup.club"| XAVIA
    WAZUH_D --> WAZUH_I
    WAZUH_M --> WAZUH_I
    XAVIA --> XAVIA_DB
    DOZZLE  -->|"remote agent :7007"| ProdVPS
    DOZZLE  -->|"remote agent :7007"| PreProdVPS

VPS Production

Domaine : mln-uber.club

Services

Conteneur	Image	Ports	Rôle
`gestion-waf`	`xor1234/backend-mln:waf`	80, 443 (public)	Reverse proxy + WAF ModSecurity
`gestion-backend`	`xor1234/backend-mln:latest`	8080 (interne)	API Go/Gin
`gestion-frontend`	`xor1234/frontend-mln:latest`	80 (interne)	SPA React/Vite
`gestion-postgres`	`postgres:16-alpine`	5432 (interne)	Base de données principale
`gestion-redis`	`redis:7-alpine`	6379 (interne)	Cache · Sessions · File livreurs

Flux de trafic

flowchart TD
    INET["🌐 Internet"] -->|":443 TLS 1.2/1.3"| WAF

    subgraph WAF["🛡️ WAF — nginx + ModSecurity CRS L2"]
        W1["Rate limit : 20 req/s/IP"]
        W2["HSTS 2 ans · CSP · X-Frame"]
        W3["Ban auto : SQLi / XSS / LFI / RCE"]
    end

    WAF -->|"/api/*"| BACK["⚙️ Backend\nGo / Gin :8080"]
    WAF -->|"/* SPA"| FRONT["🖥️ Frontend\nnginx :80"]
    WAF -->|"/uploads/*\n(fichiers statiques)"| BACK

    BACK --> PG["🗄️ PostgreSQL 16"]
    BACK --> REDIS["⚡ Redis 7\nSessions · Queue · Cache"]

Volumes persistants

Volume	Usage
`postgres_data`	Données PostgreSQL
`redis_data`	Persistance Redis (AOF)
`backend_uploads`	Fichiers uploadés — monté en `:ro` dans le WAF pour `/uploads/`

Variables d'environnement requises

Variable	Valeur par défaut	Description
`DB_PASSWORD`	—	Mot de passe PostgreSQL
`DB_NAME`	`gestion_db`	Nom de la base
`SESSION_SECRET`	—	Secret session Gin
`USER_JWT_SECRET`	—	JWT clients
`USER_JWT_SECRET_OLD`	—	JWT clients (rotation)
`ADMIN_JWT_SECRET`	—	JWT admin/cabine
`ADMIN_JWT_SECRET_OLD`	—	JWT admin (rotation)
`REDIS_PASSWORD`	—	Mot de passe Redis
`TOMTOM_API_KEY`	—	Clé TomTom Maps
`TELEGRAM_WEBHOOK_URL`	—	URL webhook Telegram
`TELEGRAM_WEBHOOK_SECRET`	—	Secret webhook Telegram
`NOWPAYMENTS_IPN_SECRET`	—	Secret IPN NowPayments

VPS Pre-prod

Même stack que la production, déployé depuis la branche pre-prod via SERVER_HOST / SERVER_SSH_KEY.

Services

Conteneur	Image	Ports	Rôle
`gestion-waf`	`xor1234/backend-mln:waf`	80, 443 (public)	WAF ModSecurity
`gestion-backend`	`xor1234/backend-mln:latest`	8080 (interne)	API Go/Gin
`gestion-frontend`	`xor1234/frontend-mln:latest`	80 (interne)	SPA React/Vite
`gestion-postgres`	`postgres:16-alpine`	5432 (interne)	Base de données
`gestion-redis`	`redis:7-alpine`	6379 (interne)	Cache · Sessions

VPS Monitoring

Domaine : uber-stup.club

Services

Conteneur	Image	Ports	Rôle
`monitoring_nginx`	`nginx:alpine`	80, 443 (public)	Reverse proxy monitoring
`dozzle`	`amir20/dozzle:latest`	8080 (interne)	Logs Docker temps réel
`wazuh.manager`	`wazuh/wazuh-manager:4.14.5`	1514, 1515, 514/udp	SIEM — collecte agents
`wazuh.indexer`	`wazuh/wazuh-indexer:4.14.5`	9200 (interne)	OpenSearch (stockage events)
`wazuh.dashboard`	`wazuh/wazuh-dashboard:4.14.5`	5601 (interne)	Kibana (visualisation)
`rustfs`	`rustfs/rustfs:latest`	9000 S3, 9001 console (internes)	Stockage objet S3-compatible (APKs)
`xavia`	`xaviaio/xavia-ota:latest`	3000 (interne)	Serveur OTA Expo (Next.js)
`xavia_db`	`postgres:16-alpine`	5432 (interne)	Base de données Xavia

Accès publics

URL	Service
`https://dozzle.uber-stup.club`	Interface logs Docker
`https://wazuh.uber-stup.club`	Dashboard SIEM Wazuh
`https://rustfs.uber-stup.club`	Console RustFS (stockage APKs)
`https://s3.uber-stup.club`	API S3 RustFS
`https://ota.uber-stup.club`	Dashboard & API Xavia OTA

Xavia OTA — configuration app Expo

"updates": {
  "url": "https://ota.uber-stup.club/api/manifest",
  "codeSigningCertificate": "./certs/certificate.pem",
  "codeSigningMetadata": {
    "keyid": "main",
    "algorithm": "rsa-v1_5-sha256"
  }
}

Clé privée RSA 4096 stockée sur le serveur dans /home/ubuntu/xavia-keys/private-key.pem. Le certificate.pem doit être commité dans le repo mobile sous mobile/certs/certificate.pem.

Dozzle — agents distants

graph LR
    DOZZLE["📋 Dozzle\nuber-stup.club"] -->|":7007"| A1["VPS Production\n5.181.0.112"]
    DOZZLE -->|":7007"| A2["VPS Pre-prod\n185.234.9.102"]

CI/CD

Pipeline backend (pre-prod & main)

flowchart TD
    PUSH["push backend/**"] --> LINT["lint\ngolangci-lint"]
    LINT --> BUILD["build\ngo build ./..."]
    BUILD --> ARTIFACT["artifact\nbackend-binary 7j"]
    BUILD --> DOCKER{"push only?"}
    DOCKER -->|oui| D1["docker build runtime\n→ xor1234/backend-mln:latest"]
    DOCKER -->|oui| D2["docker build waf\n→ xor1234/backend-mln:waf"]
    D1 --> DEPLOY["SSH deploy\ndocker compose pull backend waf\ndocker compose up -d --no-deps backend waf"]
    D2 --> DEPLOY

    style DOCKER fill:#f0f0f0

Pipeline frontend web (pre-prod & main)

flowchart TD
    PUSH["push frontend-prep/**\nou docker/frontend/**"] --> LINT["lint-typecheck\ntsc + eslint"]
    LINT --> BUILD["build\nnpm run build"]
    BUILD --> ARTIFACT["artifact\nfrontend-web-dist 7j"]
    BUILD --> DOCKER{"push only?"}
    DOCKER -->|oui| D1["docker build\n→ xor1234/frontend-mln:latest"]
    D1 --> DEPLOY["SSH deploy\ndocker compose pull frontend\ndocker compose up -d --no-deps frontend"]

    style DOCKER fill:#f0f0f0

Pipeline mobile (main uniquement)

flowchart TD
    PUSH_A["push frontend-admin/**"] --> TC_A["typecheck\ntsc --noEmit"]
    TC_A --> EAS_A["EAS build android\n--profile production"]
    EAS_A --> APK_A["artifact\nadmin-panel-android-prod-apk 14j"]

    PUSH_C["push mobile/**"] --> TC_C["typecheck\ntsc --noEmit"]
    TC_C --> EAS_C["EAS build android\n--profile production"]
    EAS_C --> APK_C["artifact\nclient-android-prod-apk 14j"]

Secrets GitHub requis

Secret	Branche	Usage
`DOCKERHUB_USERNAME`	main + pre-prod	Login Docker Hub
`DOCKERHUB_TOKEN`	main + pre-prod	Token Docker Hub
`SERVER_HOST`	pre-prod	IP/hostname VPS pre-prod
`SERVER_HOST_PROD`	main	IP/hostname VPS production
`SERVER_USER`	main + pre-prod	Utilisateur SSH
`SERVER_SSH_KEY`	pre-prod	Clé privée SSH ED25519 pre-prod
`SERVER_SSH_KEY_PROD`	main	Clé privée SSH ED25519 prod
`COMPOSE_PATH`	main + pre-prod	Chemin absolu docker-compose-prod.yml
`EXPO_TOKEN`	main	Token Expo EAS
`EXPO_PROJECT_ID`	main	ID projet EAS admin
`EXPO_PROJECT_ID_CLIENT`	main	ID projet EAS client
`VITE_TOMTOM_API_KEY`	main + pre-prod	Clé TomTom pour build frontend

Backend — architecture interne

graph TD
    MAIN["main.go\ninit DB · Redis · services · Gin"] --> ROUTES["routes/routes.go\npublic · client · admin · cabine · livreur"]
    ROUTES --> HANDLERS["handlers/\nauth · commands · delivery\npanier · notifications · payments"]
    HANDLERS --> MODELS["models/\nstructs GORM"]
    HANDLERS --> DB["db/\nconnexion · migrations · queries"]
    HANDLERS --> SERVICES["services/\nTomTom · Telegram · NowPayments"]
    MAIN --> WORKERS["workers/\ncron_auto_assign 5min\npayment_checker 2min\nqueue_cleanup 5min"]
    MAIN --> MW["middleware/\nsession · block · clock"]

Rôles utilisateurs

Rôle	Accès
`client`	Panier, commandes, profil, suivi
`admin`	Gestion complète (commandes, produits, livreurs, stats)
`cabine`	Mise à jour statut commandes + notification client
`livreur`	Tableau de bord livraisons, GPS, statut

14 KiB Raw Blame History

Infrastructure — Projet Gestion Commande

Schéma global

VPS Production

Services

Flux de trafic

Volumes persistants

Variables d'environnement requises

VPS Pre-prod

Services

VPS Monitoring

Services

Accès publics

Xavia OTA — configuration app Expo

Dozzle — agents distants

CI/CD

Pipeline backend (pre-prod & main)

Pipeline frontend web (pre-prod & main)

Pipeline mobile (main uniquement)

Secrets GitHub requis

Backend — architecture interne

Rôles utilisateurs

14 KiB

Raw Blame History