مشروع: واجهة Nginx أمامية للإنتاج

# Install Nginx and Certbot (Debian/Ubuntu) apt-get update && apt-get install -y nginx certbot python3-certbot-nginx # Create directory structure mkdir -p /etc/nginx/conf.d mkdir -p /var/cache/nginx/app_cache mkdir -p /var/log/nginx mkdir -p /var/www/app/public # Set cache directory ownership chown -R www-data:www-data /var/cache/nginx # Obtain a TLS certificate (DNS must already point to this server) certbot certonly --nginx -d example.com -d www.example.com \ --non-interactive --agree-tos -m ops@example.com

# /etc/nginx/nginx.conf user www-data; worker_processes auto; worker_rlimit_nofile 65535; pid /run/nginx.pid; events { worker_connections 4096; use epoll; multi_accept on; } http { # --- MIME & basics --- include /etc/nginx/mime.types; default_type application/octet-stream; sendfile on; tcp_nopush on; tcp_nodelay on; # --- Keep-alive --- keepalive_timeout 65; keepalive_requests 1000; # --- Buffers (tune to match your app response sizes) --- client_body_buffer_size 16k; client_max_body_size 50m; proxy_buffer_size 16k; proxy_buffers 4 64k; proxy_busy_buffers_size 128k; # --- Gzip compression --- gzip on; gzip_vary on; gzip_proxied any; gzip_comp_level 6; gzip_min_length 1024; gzip_types text/plain text/css application/json application/javascript application/xml text/xml image/svg+xml font/woff2; # --- Rate-limiting zones (shared memory) --- limit_req_zone $binary_remote_addr zone=api:10m rate=30r/s; limit_req_zone $binary_remote_addr zone=auth:10m rate=5r/m; # --- Proxy cache zone (disk-backed, 1GB max) --- proxy_cache_path /var/cache/nginx/app_cache levels=1:2 keys_zone=app_cache:20m max_size=1g inactive=60m use_temp_path=off; # --- Structured JSON log format --- log_format json_combined escape=json '{' '"time":"$time_iso8601",' '"ip":"$remote_addr",' '"method":"$request_method",' '"uri":"$uri",' '"status":"$status",' '"bytes":"$body_bytes_sent",' '"rt":"$request_time",' '"upstream_rt":"$upstream_response_time",' '"cache":"$upstream_cache_status",' '"ua":"$http_user_agent"' '}'; access_log /var/log/nginx/access.log json_combined; error_log /var/log/nginx/error.log warn; server_tokens off; include /etc/nginx/conf.d/*.conf; }

# /etc/nginx/conf.d/example.conf # ── Upstream pool ────────────────────────────────────────────────────────── upstream app_backend { server 127.0.0.1:8000; keepalive 32; keepalive_requests 100; keepalive_timeout 60s; } # ── HTTP → HTTPS redirect ────────────────────────────────────────────────── server { listen 80; listen [::]:80; server_name example.com www.example.com; location /.well-known/acme-challenge/ { root /var/www/certbot; } location / { return 301 https://example.com$request_uri; } } # ── www → apex redirect ─────────────────────────────────────────────────── server { listen 443 ssl; listen [::]:443 ssl; http2 on; server_name www.example.com; ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; return 301 https://example.com$request_uri; } # ── Primary HTTPS vhost ──────────────────────────────────────────────────── server { listen 443 ssl; listen [::]:443 ssl; http2 on; server_name example.com; root /var/www/app/public; # ── TLS ─────────────────────────────────────────────────────────── ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384; ssl_prefer_server_ciphers off; ssl_session_cache shared:SSL:10m; ssl_session_timeout 1d; ssl_session_tickets off; ssl_stapling on; ssl_stapling_verify on; resolver 1.1.1.1 8.8.8.8 valid=300s; resolver_timeout 5s; # ── Security headers ─────────────────────────────────────────────── add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Content-Type-Options "nosniff" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always; add_header Content-Security-Policy "default-src \'self\'; script-src \'self\' \'unsafe-inline\'; style-src \'self\' \'unsafe-inline\'; img-src \'self\' data: https:; font-src \'self\'; connect-src \'self\'; frame-ancestors \'self\';" always; # ── Proxy cache defaults ─────────────────────────────────────────── proxy_cache app_cache; proxy_cache_valid 200 302 10m; proxy_cache_valid 404 1m; proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504; proxy_cache_lock on; add_header X-Cache-Status $upstream_cache_status; # ── Common proxy headers ─────────────────────────────────────────── proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Connection ""; # ── Static assets ───────────────────────────────────────────────── location ~* \.(css|js|woff2|woff|ttf|ico|png|jpg|jpeg|gif|svg|webp|avif|pdf|zip)$ { expires 1y; add_header Cache-Control "public, immutable"; access_log off; gzip_static on; } # ── Auth endpoints ──────────────────────────────────────────────── location ~* ^/(login|register|password|api/auth) { limit_req zone=auth burst=5 nodelay; limit_req_status 429; proxy_pass http://app_backend; proxy_cache off; } # ── API endpoints ───────────────────────────────────────────────── location /api/ { limit_req zone=api burst=60 nodelay; limit_req_status 429; proxy_pass http://app_backend; proxy_cache off; proxy_no_cache 1; proxy_cache_bypass 1; } # ── Default ─────────────────────────────────────────────────────── location / { limit_req zone=api burst=60 nodelay; try_files $uri $uri/ @proxy; } location @proxy { proxy_pass http://app_backend; proxy_cache_methods GET HEAD; proxy_cache_bypass $http_authorization $cookie_session; proxy_no_cache $http_authorization $cookie_session; } # ── Healthcheck ─────────────────────────────────────────────────── location = /healthz { access_log off; proxy_pass http://app_backend; proxy_cache off; } # ── Block attack paths ───────────────────────────────────────────── location ~ /\. { deny all; } location ~* \.(php|asp|aspx|jsp|cgi)$ { deny all; } error_page 429 /errors/429.html; error_page 502 503 504 /errors/50x.html; location ^~ /errors/ { internal; root /var/www/app; } access_log /var/log/nginx/example_access.log json_combined; error_log /var/log/nginx/example_error.log warn; }

# 1. Syntax check — ALWAYS do this before reloading nginx -t # 2. Zero-downtime reload systemctl reload nginx # 3. Confirm TLS and HTTP/2 curl -I https://example.com # 4. Check HSTS header curl -sI https://example.com | grep -i strict # 5. Probe cache — first: MISS, second: HIT curl -sI https://example.com/about | grep X-Cache-Status curl -sI https://example.com/about | grep X-Cache-Status # 6. Verify rate limiting on auth (expect 429 after 5 requests) for i in $(seq 1 20); do curl -o /dev/null -sw "%{http_code}\n" -X POST https://example.com/login done

# /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh #!/bin/bash set -e nginx -t && systemctl reload nginx chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh # Test the full renewal flow without actually renewing certbot renew --dry-run