Initial commit

v2_nginx/Dockerfile

@@ -0,0 +1,29 @@
+FROM nginx:alpine
+
+# Zeitzone setzen
+ENV TZ=Europe/Berlin
+RUN apk add --no-cache tzdata \
+    && ln -sf /usr/share/zoneinfo/Europe/Berlin /etc/localtime \
+    && echo "Europe/Berlin" > /etc/timezone
+
+# SSL-Verzeichnis erstellen
+RUN mkdir -p /etc/nginx/ssl
+
+# Default config entfernen
+RUN rm -f /etc/nginx/conf.d/default.conf
+
+# Nginx-Konfiguration kopieren
+COPY nginx.conf /etc/nginx/nginx.conf
+
+# SSL-Zertifikate kopieren
+COPY ssl/fullchain.pem /etc/nginx/ssl/
+COPY ssl/privkey.pem /etc/nginx/ssl/
+COPY ssl/dhparam.pem /etc/nginx/ssl/
+
+# Berechtigungen setzen
+RUN chmod 600 /etc/nginx/ssl/privkey.pem
+RUN chmod 644 /etc/nginx/ssl/dhparam.pem
+
+EXPOSE 80 443
+
+CMD ["nginx", "-g", "daemon off;"]

v2_nginx/Dockerfile.letsencrypt

@@ -0,0 +1,21 @@
+FROM nginx:alpine
+
+# Certbot für Let's Encrypt installieren
+RUN apk add --no-cache certbot certbot-nginx
+
+# SSL-Verzeichnis erstellen
+RUN mkdir -p /etc/nginx/ssl
+
+# Default config entfernen
+RUN rm -f /etc/nginx/conf.d/default.conf
+
+# Nginx-Konfiguration kopieren
+COPY nginx.conf /etc/nginx/nginx.conf
+
+# Entrypoint für Certbot
+COPY entrypoint-letsencrypt.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+EXPOSE 80 443
+
+ENTRYPOINT ["/entrypoint.sh"]

v2_nginx/entrypoint-letsencrypt.sh

@@ -0,0 +1,47 @@
+#!/bin/sh
+
+# Temporäre Nginx config für Let's Encrypt Challenge
+cat > /etc/nginx/conf.d/default.conf << EOF
+server {
+    listen 80;
+    server_name admin-panel-undso.z5m7q9dk3ah2v1plx6ju.com api-software-undso.z5m7q9dk3ah2v1plx6ju.com;
+    
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+    
+    location / {
+        return 301 https://\$host\$request_uri;
+    }
+}
+EOF
+
+# Nginx starten
+nginx
+
+# Let's Encrypt Zertifikate holen
+echo "Requesting Let's Encrypt certificates..."
+certbot certonly --webroot -w /var/www/certbot \
+    -d admin-panel-undso.z5m7q9dk3ah2v1plx6ju.com \
+    -d api-software-undso.z5m7q9dk3ah2v1plx6ju.com \
+    --non-interactive \
+    --agree-tos \
+    --email admin@z5m7q9dk3ah2v1plx6ju.com \
+    --no-eff-email
+
+# Prüfen ob erfolgreich
+if [ $? -eq 0 ]; then
+    echo "Certificates obtained successfully!"
+    
+    # Nginx stoppen
+    nginx -s stop
+    
+    # Kopiere die echte config
+    cp /etc/nginx/nginx.conf.real /etc/nginx/nginx.conf
+    
+    # Nginx mit SSL starten
+    nginx -g "daemon off;"
+else
+    echo "Failed to obtain certificates"
+    nginx -g "daemon off;"
+fi

v2_nginx/entrypoint.sh

@@ -0,0 +1,30 @@
+#!/bin/sh
+
+# Nginx im Hintergrund starten
+nginx
+
+# Warte bis Nginx läuft
+sleep 5
+
+# Versuche Let's Encrypt Zertifikate zu holen (nur in Produktion)
+if [ "$LETSENCRYPT_ENABLED" = "true" ]; then
+    echo "Requesting Let's Encrypt certificates..."
+    
+    # Admin Panel Zertifikat
+    certbot --nginx -d admin-panel-undso.z5m7q9dk3ah2v1plx6ju.com \
+        --non-interactive --agree-tos --email ${LETSENCRYPT_EMAIL} \
+        --redirect --expand --no-eff-email
+    
+    # API Server Zertifikat
+    certbot --nginx -d api-software-undso.z5m7q9dk3ah2v1plx6ju.com \
+        --non-interactive --agree-tos --email ${LETSENCRYPT_EMAIL} \
+        --redirect --expand --no-eff-email
+    
+    # Auto-renewal einrichten
+    echo "0 0,12 * * * root certbot renew --quiet" >> /etc/crontabs/root
+    crond
+fi
+
+# Nginx im Vordergrund halten
+nginx -s stop
+nginx -g "daemon off;"

v2_nginx/nginx.conf

@@ -0,0 +1,122 @@
+events {
+    worker_connections 1024;
+}
+
+http {
+    # Enable nginx status page for monitoring
+    server {
+        listen 8080;
+        server_name localhost;
+        
+        location /nginx_status {
+            stub_status on;
+            access_log off;
+            allow 127.0.0.1;
+            allow 172.16.0.0/12;  # Docker networks
+            deny all;
+        }
+    }
+    # Moderne SSL-Einstellungen für maximale Sicherheit
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
+    ssl_prefer_server_ciphers off;
+    
+    # SSL Session Einstellungen
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_tickets off;
+    
+    # OCSP Stapling
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    resolver 8.8.8.8 8.8.4.4 valid=300s;
+    resolver_timeout 5s;
+    
+    # DH parameters für Perfect Forward Secrecy
+    ssl_dhparam /etc/nginx/ssl/dhparam.pem;
+
+    # Admin Panel
+    server {
+        listen 80;
+        server_name admin-panel-undso.intelsight.de;
+        
+        # Redirect HTTP to HTTPS
+        return 301 https://$server_name$request_uri;
+    }
+
+    server {
+        listen 443 ssl;
+        server_name admin-panel-undso.intelsight.de;
+
+        # SSL-Zertifikate (echte Zertifikate)
+        ssl_certificate /etc/nginx/ssl/fullchain.pem;
+        ssl_certificate_key /etc/nginx/ssl/privkey.pem;
+
+        # Security Headers
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+        # Proxy-Einstellungen
+        location / {
+            proxy_pass http://admin-panel:5000;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            
+            # WebSocket support (falls benötigt)
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+        }
+        
+        # Auth Service API (internal only) - temporarily disabled
+        # location /api/v1/auth/ {
+        #     proxy_pass http://auth-service:5001/api/v1/auth/;
+        #     proxy_set_header Host $host;
+        #     proxy_set_header X-Real-IP $remote_addr;
+        #     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        #     proxy_set_header X-Forwarded-Proto $scheme;
+        #     proxy_set_header Authorization $http_authorization;
+        # }
+    }
+
+    # API Server (für später)
+    server {
+        listen 80;
+        server_name api-software-undso.intelsight.de;
+        
+        return 301 https://$server_name$request_uri;
+    }
+
+    server {
+        listen 443 ssl;
+        server_name api-software-undso.intelsight.de;
+
+        ssl_certificate /etc/nginx/ssl/fullchain.pem;
+        ssl_certificate_key /etc/nginx/ssl/privkey.pem;
+
+        # Security Headers
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+        location / {
+            proxy_pass http://license-server:8443;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            
+            # WebSocket support (falls benötigt)
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+        }
+    }
+}

v2_nginx/ssl/.gitignore

@@ -0,0 +1,10 @@
+# Ignore all SSL certificates
+*.pem
+*.crt
+*.key
+*.p12
+*.pfx
+
+# But keep the README
+!README.md
+!.gitignore

v2_nginx/ssl/README.md

@@ -0,0 +1,29 @@
+# SSL Certificate Directory
+
+This directory should contain the following files for SSL to work:
+
+1. **fullchain.pem** - The full certificate chain
+2. **privkey.pem** - The private key (keep this secure!)
+3. **dhparam.pem** - Diffie-Hellman parameters for enhanced security
+
+## For intelsight.de deployment:
+
+Copy your SSL certificates here:
+```bash
+cp /path/to/fullchain.pem ./
+cp /path/to/privkey.pem ./
+```
+
+Generate dhparam.pem if not exists:
+```bash
+openssl dhparam -out dhparam.pem 2048
+```
+
+## File Permissions:
+```bash
+chmod 644 fullchain.pem
+chmod 600 privkey.pem
+chmod 644 dhparam.pem
+```
+
+**IMPORTANT**: Never commit actual SSL certificates to the repository!