From 8cc6bb3cc663fe3bf7adff0f1d107f25c68c06af Mon Sep 17 00:00:00 2001
From: Dmitry <cinnabarflower@gmail.com>
Date: Wed, 3 Dec 2025 03:13:30 +0300
Subject: [PATCH] fix

---
 mnemo_cards_admin/web/nginx.conf | 70 ++++++++++++++++++++++++++++++++
 tools/deploy/admin/deploy.sh     | 14 +++++--
 2 files changed, 80 insertions(+), 4 deletions(-)
 create mode 100644 mnemo_cards_admin/web/nginx.conf
 mode change 100644 => 100755 tools/deploy/admin/deploy.sh

diff --git a/mnemo_cards_admin/web/nginx.conf b/mnemo_cards_admin/web/nginx.conf
new file mode 100644
index 0000000..ef426cb
--- /dev/null
+++ b/mnemo_cards_admin/web/nginx.conf
@@ -0,0 +1,70 @@
+# HTTP server (SSL will be configured later)
+# server {
+#     listen 80;
+#     server_name admin.mnemo-cards.online;
+#
+#     # Redirect HTTP to HTTPS
+#     return 301 https://$server_name$request_uri;
+# }
+
+server {
+    listen 80;
+    server_name admin.mnemo-cards.online;
+
+    # Note: SSL certificate not yet configured - using HTTP for now
+    # TODO: Set up Let's Encrypt certificate for HTTPS
+    # ssl_certificate /etc/letsencrypt/live/admin.mnemo-cards.online/fullchain.pem;
+    # ssl_certificate_key /etc/letsencrypt/live/admin.mnemo-cards.online/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers off;
+
+    # Security headers (enhanced for admin panel)
+    add_header X-Frame-Options "DENY" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https://api.mnemo-cards.online;" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+    # Root directory for admin panel
+    root /var/www/mnemo_cards_admin;
+    index index.html;
+
+    # Gzip compression
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 1024;
+    gzip_types text/plain text/css text/xml text/javascript application/javascript application/json;
+
+    # Main location block
+    location / {
+        try_files $uri $uri/ /index.html;
+
+        # Cache static assets
+        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+            expires 1h;  # Shorter cache for admin panel
+            add_header Cache-Control "private, must-revalidate";
+        }
+    }
+
+    # Security - deny access to hidden files and sensitive paths
+    location ~ /\. {
+        deny all;
+    }
+
+    location ~ ^/admin/ {
+        deny all;  # Prevent access to any /admin/ paths that might be exposed
+    }
+
+    # Rate limiting for admin panel
+    limit_req zone=admin burst=10 nodelay;
+    limit_req_status 429;
+
+    # Log admin access
+    access_log /var/log/nginx/admin_access.log;
+    error_log /var/log/nginx/admin_error.log;
+}
+
+# Rate limiting zone for admin panel
+limit_req_zone $binary_remote_addr zone=admin:10m rate=5r/m;
diff --git a/tools/deploy/admin/deploy.sh b/tools/deploy/admin/deploy.sh
old mode 100644
new mode 100755
index 992895f..ceffe0e
--- a/tools/deploy/admin/deploy.sh
+++ b/tools/deploy/admin/deploy.sh
@@ -84,16 +84,22 @@ ssh "$SERVER_USER@$SERVER_IP" << EOF
     fi
 
     # Test nginx configuration
-    nginx -t
+    /usr/sbin/nginx -t
 
     # Restart nginx
     systemctl restart nginx
     systemctl enable nginx
 
     # Configure firewall (ports should already be open)
-    ufw allow '$FIREWALL_ALLOW_NGINX'
-    ufw allow $FIREWALL_ALLOW_SSH
-    ufw --force enable
+    # Note: ufw may not be available in all environments
+    if command -v ufw &> /dev/null; then
+        ufw allow '$FIREWALL_ALLOW_NGINX' 2>/dev/null || true
+        ufw allow $FIREWALL_ALLOW_SSH 2>/dev/null || true
+        ufw --force enable 2>/dev/null || true
+        echo "✅ Firewall configured"
+    else
+        echo "ℹ️  UFW not available, skipping firewall configuration"
+    fi
 
     echo "Admin panel deployment completed successfully!"
     echo "Application is available at: https://admin.mnemo-cards.online"