netadmin/deploy/nginx-netadmin.conf

# NetAdmin — configuration Nginx
# Fichier : /etc/nginx/sites-available/netadmin
# Activer : ln -s /etc/nginx/sites-available/netadmin /etc/nginx/sites-enabled/

# ── Upstream backend ──────────────────────────────────────────────────────
upstream netadmin_backend {
    server 127.0.0.1:8000;
    keepalive 32;
}

# ── Redirection HTTP → HTTPS ──────────────────────────────────────────────
server {
    listen 80;
    listen [::]:80;
    server_name netadmin.example.fr;   # ← adapter
    return 301 https://$host$request_uri;
}

# ── HTTPS ─────────────────────────────────────────────────────────────────
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name netadmin.example.fr;   # ← adapter

    # ── Certificats SSL ──────────────────────────────────────────────────
    ssl_certificate     /etc/letsencrypt/live/netadmin.example.fr/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/netadmin.example.fr/privkey.pem;

    ssl_protocols             TLSv1.2 TLSv1.3;
    ssl_ciphers               ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache         shared:SSL:10m;
    ssl_session_timeout       1d;
    ssl_session_tickets       off;

    # HSTS (6 mois)
    add_header Strict-Transport-Security "max-age=15768000" always;

    # ── Restriction IP ──────────────────────────────────────────────────
    # Décommenter et adapter selon votre réseau
    # allow 192.168.1.0/24;     # réseau local
    # allow 10.0.0.0/8;         # VPN / WireGuard
    # deny all;

    # ── Headers sécurité ────────────────────────────────────────────────
    add_header X-Frame-Options           "SAMEORIGIN"   always;
    add_header X-Content-Type-Options    "nosniff"      always;
    add_header X-XSS-Protection          "1; mode=block" always;
    add_header Referrer-Policy           "strict-origin-when-cross-origin" always;

    # ── Logs ─────────────────────────────────────────────────────────────
    access_log /var/log/nginx/netadmin.access.log;
    error_log  /var/log/nginx/netadmin.error.log warn;

    # ── Frontend — fichiers statiques Vite ──────────────────────────────
    root  /var/www/netadmin;
    index index.html;

    location / {
        # React Router — toujours servir index.html
        try_files $uri $uri/ /index.html;

        # Cache assets buildés (hash dans le nom de fichier)
        location ~* \.(js|css|woff2?|ttf|eot|svg|ico|png|jpg|webp)$ {
            expires    1y;
            add_header Cache-Control "public, immutable";
            access_log off;
        }
    }

    # ── Backend API ──────────────────────────────────────────────────────
    location /api/ {
        proxy_pass         http://netadmin_backend/;
        proxy_http_version 1.1;
        proxy_set_header   Connection      "";
        proxy_set_header   Host            $host;
        proxy_set_header   X-Real-IP       $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;

        # Timeouts
        proxy_connect_timeout  10s;
        proxy_send_timeout     120s;
        proxy_read_timeout     120s;

        # Désactiver le buffering pour les SSE éventuels
        proxy_buffering    off;

        # Taille des uploads (DKIM keys, etc.)
        client_max_body_size 10m;
    }

    # ── Bloquer l'accès aux fichiers sensibles ──────────────────────────
    location ~ /\. {
        deny all;
    }
    location ~ \.(py|yaml|env|log|sql)$ {
        deny all;
    }
}