Stefan Mogeritsch
f402fbaf19
Umfangreiches Refactoring der Projektkonfiguration zur klaren Trennung von Build-, Runtime- und Applikations-Logik. Änderungen im Detail: - Struktur: Neuorganisation des `config/` Verzeichnisses in logische Bereiche: - `config/docker`: Reine Infrastruktur-Configs (Postgres, Redis, Nginx, Monitoring). - `config/quality`: Statische Code-Analyse (Detekt, Lint). - `config/app`: Gemeinsame Spring-Boot-Konfigurationen. - Docker Compose: - Einführung von Profilen (`infra`, `backend`, `ops`, `gui`, `tools`) für gezieltes Starten von Teilbereichen. - Anpassung aller Volume-Pfade auf die neue Struktur. - Spring Boot Config: - Zentralisierung gemeinsamer Einstellungen (Datasource, Redis, JPA) in `config/app/base-application.yml`. - Parametrisierung der Hosts für nahtlosen Wechsel zwischen Docker und Localhost. - Bereinigung der service-spezifischen `application.yaml` Dateien (z.B. Ping-Service). - Cleanup: Entfernen redundanter "Ghost-Files" (`versions.toml`, `central.toml`, `config/.env`), um eine echte Single Source of Truth (SSoT) zu gewährleisten.
134 lines
3.7 KiB
Plaintext
134 lines
3.7 KiB
Plaintext
# Nginx Production Configuration
|
|
# =============================================================================
|
|
# This configuration provides secure reverse proxy with SSL termination,
|
|
# security headers, and performance optimizations for production
|
|
# =============================================================================
|
|
|
|
user nginx;
|
|
worker_processes auto;
|
|
error_log /var/log/nginx/error.log warn;
|
|
pid /var/run/nginx.pid;
|
|
|
|
# Performance and Security Settings
|
|
worker_rlimit_nofile 65535;
|
|
|
|
events {
|
|
worker_connections 4096;
|
|
use epoll;
|
|
multi_accept on;
|
|
}
|
|
|
|
http {
|
|
# Basic Settings
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
|
|
# Performance Settings
|
|
sendfile on;
|
|
tcp_nopush on;
|
|
tcp_nodelay on;
|
|
keepalive_timeout 65;
|
|
types_hash_max_size 2048;
|
|
server_tokens off;
|
|
|
|
# Buffer Settings
|
|
client_body_buffer_size 128k;
|
|
client_max_body_size 10m;
|
|
client_header_buffer_size 1k;
|
|
large_client_header_buffers 4 4k;
|
|
output_buffers 1 32k;
|
|
postpone_output 1460;
|
|
|
|
# Timeout Settings
|
|
client_body_timeout 12;
|
|
client_header_timeout 12;
|
|
send_timeout 10;
|
|
|
|
# Gzip Compression
|
|
gzip on;
|
|
gzip_vary on;
|
|
gzip_min_length 10240;
|
|
gzip_proxied expired no-cache no-store private must-revalidate auth;
|
|
gzip_types
|
|
text/plain
|
|
text/css
|
|
text/xml
|
|
text/javascript
|
|
application/x-javascript
|
|
application/xml+rss
|
|
application/javascript
|
|
application/json
|
|
application/xml
|
|
application/rss+xml
|
|
application/atom+xml
|
|
image/svg+xml;
|
|
|
|
# Security Headers
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "no-referrer-when-downgrade" always;
|
|
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
# Rate Limiting
|
|
limit_req_zone $binary_remote_addr zone=login:10m rate=10r/m;
|
|
limit_req_zone $binary_remote_addr zone=api:10m rate=100r/m;
|
|
limit_req_zone $binary_remote_addr zone=general:10m rate=1000r/m;
|
|
|
|
# Logging Format
|
|
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
|
'$status $body_bytes_sent "$http_referer" '
|
|
'"$http_user_agent" "$http_x_forwarded_for" '
|
|
'$request_time $upstream_response_time';
|
|
|
|
access_log /var/log/nginx/access.log main;
|
|
|
|
# SSL Configuration
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
|
|
ssl_prefer_server_ciphers off;
|
|
ssl_session_cache shared:SSL:10m;
|
|
ssl_session_timeout 10m;
|
|
ssl_session_tickets off;
|
|
ssl_stapling on;
|
|
ssl_stapling_verify on;
|
|
|
|
# Upstream Definitions
|
|
upstream keycloak {
|
|
server keycloak:8443;
|
|
keepalive 32;
|
|
}
|
|
|
|
upstream grafana {
|
|
server grafana:3000;
|
|
keepalive 32;
|
|
}
|
|
|
|
upstream prometheus {
|
|
server prometheus:9090;
|
|
keepalive 32;
|
|
}
|
|
|
|
# HTTP to HTTPS Redirect
|
|
server {
|
|
listen 80;
|
|
server_name _;
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
# Health Check Endpoint
|
|
server {
|
|
listen 80;
|
|
server_name localhost;
|
|
location /health {
|
|
access_log off;
|
|
return 200 "healthy\n";
|
|
add_header Content-Type text/plain;
|
|
}
|
|
}
|
|
|
|
# Include additional server configurations
|
|
include /etc/nginx/conf.d/*.conf;
|
|
}
|