cinnabarflower/mnemo_cards
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix

Browse source
This commit is contained in:
Dmitry 2025-12-03 03:13:30 +03:00
parent e33c8a9346
commit 8cc6bb3cc6
2 changed files with 80 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

70
mnemo_cards_admin/web/nginx.conf Normal file
View file

@ -0,0 +1,70 @@
# HTTP server (SSL will be configured later)
# server {
# listen 80;
# server_name admin.mnemo-cards.online;
#
# # Redirect HTTP to HTTPS
# return 301 https://$server_name$request_uri;
# }
server {
listen 80;
server_name admin.mnemo-cards.online;
# Note: SSL certificate not yet configured - using HTTP for now
# TODO: Set up Let's Encrypt certificate for HTTPS
# ssl_certificate /etc/letsencrypt/live/admin.mnemo-cards.online/fullchain.pem;
# ssl_certificate_key /etc/letsencrypt/live/admin.mnemo-cards.online/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
# Security headers (enhanced for admin panel)
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https://api.mnemo-cards.online;" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
# Root directory for admin panel
root /var/www/mnemo_cards_admin;
index index.html;
# Gzip compression
gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_types text/plain text/css text/xml text/javascript application/javascript application/json;
# Main location block
location / {
try_files $uri $uri/ /index.html;
# Cache static assets
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
expires 1h; # Shorter cache for admin panel
add_header Cache-Control "private, must-revalidate";
}
}
# Security - deny access to hidden files and sensitive paths
location ~ /\. {
deny all;
}
location ~ ^/admin/ {
deny all; # Prevent access to any /admin/ paths that might be exposed
}
# Rate limiting for admin panel
limit_req zone=admin burst=10 nodelay;
limit_req_status 429;
# Log admin access
access_log /var/log/nginx/admin_access.log;
error_log /var/log/nginx/admin_error.log;
}
# Rate limiting zone for admin panel
limit_req_zone $binary_remote_addr zone=admin:10m rate=5r/m;

14
tools/deploy/admin/deploy.sh Normal file → Executable file
View file

@ -84,16 +84,22 @@ ssh "$SERVER_USER@$SERVER_IP" << EOF
fi
# Test nginx configuration
nginx -t
/usr/sbin/nginx -t
# Restart nginx
systemctl restart nginx
systemctl enable nginx
# Configure firewall (ports should already be open)
ufw allow '$FIREWALL_ALLOW_NGINX'
ufw allow $FIREWALL_ALLOW_SSH
ufw --force enable
# Note: ufw may not be available in all environments
if command -v ufw &> /dev/null; then
ufw allow '$FIREWALL_ALLOW_NGINX' 2>/dev/null || true
ufw allow $FIREWALL_ALLOW_SSH 2>/dev/null || true
ufw --force enable 2>/dev/null || true
echo "✅ Firewall configured"
else
echo "ℹ️ UFW not available, skipping firewall configuration"
fi
echo "Admin panel deployment completed successfully!"
echo "Application is available at: https://admin.mnemo-cards.online"