gnx/GNX-WEB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

updates

Browse Source
This commit is contained in:
Iliyan Angelov
2025-12-10 01:36:00 +02:00
parent 2f6dca736a
commit 6a9e823402
84 changed files with 5293 additions and 1836 deletions
Download Patch File Download Diff File Expand all files Collapse all files

87
nginx-gnxsoft.conf
View File

@@ -1,23 +1,26 @@
# Production Nginx Configuration for GNX Soft
# Place this in /etc/nginx/sites-available/gnxsoft
# Symlink to /etc/nginx/sites-enabled/gnxsoft
#
# DEPLOYMENT NOTES:
# 1. Frontend: Next.js production build runs on port 3000
# - Build: npm run build
# - Start: npm start (or use PM2: pm2 start npm --name "gnxsoft-frontend" -- start)
# 2. Backend: Django runs on port 8000 (internal only)
# - Use Gunicorn: gunicorn gnx.wsgi:application --bind 127.0.0.1:8000
# - Or PM2: pm2 start gunicorn --name "gnxsoft-backend" -- gnx.wsgi:application --bind 127.0.0.1:8000
# DEPLOYMENT NOTES (Host Deployment):
# 1. Frontend: Next.js production build runs on port 1087
# - Build: cd frontEnd && npm run build
# - Start: Use start-services.sh script or PM2: PORT=1087 pm2 start npm --name "gnxsoft-frontend" -- start
# 2. Backend: Django runs on port 1086 (internal only)
# - Use start-services.sh script or PM2: gunicorn gnx.wsgi:application --bind 127.0.0.1:1086 --workers 3
# 3. Database: PostgreSQL on host (port 5433 to avoid conflict with Docker instance on 5432)
# 4. Use install-postgresql.sh to install and configure PostgreSQL
# 5. Use start-services.sh to start both backend and frontend services
# Frontend - Public facing (Next.js Production Server)
# Frontend - Public facing (Next.js Production Server on port 1087)
upstream frontend {
server 127.0.0.1:3000;
server 127.0.0.1:1087;
keepalive 64;
}
# Backend - Internal only (Django)
# Backend - Internal only (Django on port 1086)
upstream backend_internal {
server 127.0.0.1:8000;
server 127.0.0.1:1086;
keepalive 64;
}
@@ -96,20 +99,27 @@ server {
}
# API Proxy - Frontend talks to backend ONLY through this internal proxy
# Backend port 8000 is BLOCKED from internet by firewall
# Backend port 1086 is BLOCKED from internet by firewall
location /api/ {
limit_req zone=api_limit burst=20 nodelay;
# Internal proxy to backend (127.0.0.1:8000)
# Internal proxy to backend (127.0.0.1:1086)
# Backend is NOT accessible from public internet
proxy_pass http://backend_internal/api/;
proxy_http_version 1.1;
# Add internal API key (must match INTERNAL_API_KEY in Django .env)
# Update this value with your actual API key from .env file
set $api_key "PLACEHOLDER_INTERNAL_API_KEY";
proxy_set_header X-Internal-API-Key $api_key;
# Backend sees request as coming from localhost
proxy_set_header Host $host;
proxy_set_header X-Real-IP 127.0.0.1;
proxy_set_header X-Forwarded-For 127.0.0.1;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
# Hide backend server info
proxy_hide_header X-Powered-By;
@@ -123,7 +133,7 @@ server {
# CORS headers (if needed)
add_header Access-Control-Allow-Origin "https://gnxsoft.com" always;
add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
add_header Access-Control-Allow-Headers "Authorization, Content-Type" always;
add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Internal-API-Key" always;
add_header Access-Control-Allow-Credentials "true" always;
# Handle preflight requests
@@ -133,8 +143,9 @@ server {
}
# Media files (served by nginx directly for better performance)
# Update path to match your actual deployment location
location /media/ {
alias /var/www/gnxsoft/media/;
alias /home/gnx/Desktop/GNX-WEB/backEnd/media/;
expires 30d;
add_header Cache-Control "public, immutable";
access_log off;
@@ -146,8 +157,9 @@ server {
}
# Static files (served by nginx directly)
# Update path to match your actual deployment location
location /static/ {
alias /var/www/gnxsoft/static/;
alias /home/gnx/Desktop/GNX-WEB/backEnd/staticfiles/;
expires 1y;
add_header Cache-Control "public, immutable";
access_log off;
@@ -168,10 +180,26 @@ server {
log_not_found off;
}
# Deny access to backend admin (extra security)
location /admin {
deny all;
return 404;
# Admin panel - Proxy to backend (with IP restriction)
location /admin/ {
# IP restriction is handled by Django middleware
# Add internal API key (must match INTERNAL_API_KEY in Django .env)
set $api_key "PLACEHOLDER_INTERNAL_API_KEY";
proxy_set_header X-Internal-API-Key $api_key;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://backend_internal;
proxy_redirect off;
proxy_http_version 1.1;
proxy_set_header Connection "";
# Timeouts
proxy_connect_timeout 30s;
proxy_send_timeout 30s;
proxy_read_timeout 30s;
}
# Health check endpoint
@@ -185,11 +213,14 @@ server {
# ==============================================================================
# IMPORTANT SECURITY NOTES:
# ==============================================================================
# 1. Backend runs on 127.0.0.1:8000 (internal only)
# 2. Firewall BLOCKS external access to port 8000
# 3. Only nginx can reach backend (internal network)
# 4. Public internet can ONLY access nginx (ports 80, 443)
# 5. All API calls go through nginx proxy (/api/* → 127.0.0.1:8000/api/*)
# 6. Backend IP whitelist middleware ensures only localhost requests
# 1. Backend runs on 127.0.0.1:1086 (internal only)
# 2. Frontend runs on 127.0.0.1:1087 (internal only)
# 3. Firewall BLOCKS external access to ports 1086 and 1087
# 4. Only nginx can reach backend/frontend (internal network)
# 5. Public internet can ONLY access nginx (ports 80, 443)
# 6. All API calls go through nginx proxy (/api/* → 127.0.0.1:1086/api/*)
# 7. Backend IP whitelist middleware ensures only localhost requests
# 8. Update PLACEHOLDER_INTERNAL_API_KEY with actual key from Django .env
# 9. PostgreSQL runs on port 5433 (to avoid conflict with Docker on 5432)
# ==============================================================================