Проект разделен на два репозитория

2026-08-14 15:42:45 +03:00
parent e06a77ee1d
commit bbef7a30c9
521 changed files with 2597 additions and 2302 deletions
@@ -0,0 +1,2 @@
+# Fail-closed active file. Replace atomically from the reviewed .template file.
+deny all;
@@ -0,0 +1,5 @@
+# Copy to bitrix-webhook-allowlist.conf only after ownership verification.
+# One reviewed directive per confirmed Bitrix24 source CIDR:
+# allow 192.0.2.10/32;
+# allow 2001:db8::10/128;
+deny all;
@@ -0,0 +1,3 @@
+# Fail-closed active file. Replace atomically from the reviewed .template file.
+allow 192.168.0.1;
+deny all;
@@ -0,0 +1,4 @@
+# VM1 and approved ops private source CIDRs only:
+# allow 10.20.0.10/32;
+# allow 10.20.1.0/28;
+deny all;
@@ -0,0 +1,14 @@
+proxy_http_version 1.1;
+proxy_set_header Connection "";
+proxy_set_header Host $host;
+proxy_set_header X-Real-IP $remote_addr;
+proxy_set_header X-Forwarded-For $remote_addr;
+proxy_set_header X-Forwarded-Proto https;
+proxy_set_header X-Forwarded-Host $host;
+proxy_set_header X-Forwarded-Port $server_port;
+proxy_set_header X-Request-ID $request_id;
+proxy_connect_timeout 3s;
+proxy_send_timeout 15s;
+proxy_request_buffering on;
+proxy_buffering off;
+proxy_intercept_errors off;
@@ -0,0 +1,5 @@
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_session_cache shared:TLS:10m;
+ssl_session_timeout 10m;
+ssl_session_tickets off;
+ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
@@ -0,0 +1,33 @@
+worker_processes auto;
+pid /tmp/nginx.pid;
+error_log /dev/stderr warn;
+
+events {
+    worker_connections 2048;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+    server_tokens off;
+
+    log_format safe_json escape=json
+      '{"time":"$time_iso8601","request_id":"$request_id","remote_addr":"$remote_addr",'
+      '"host":"$host","method":"$request_method","uri":"$uri","status":$status,'
+      '"bytes":$body_bytes_sent,"duration":$request_time,'
+      '"upstream_status":"$upstream_status","upstream_time":"$upstream_response_time"}';
+    access_log /dev/stdout safe_json;
+
+    limit_req_status 429;
+    limit_req_zone $binary_remote_addr zone=bitrix_webhooks:10m rate=30r/m;
+    limit_conn_zone $binary_remote_addr zone=per_ip:10m;
+
+    client_body_temp_path /tmp/client_body;
+    proxy_temp_path /tmp/proxy;
+    client_header_timeout 10s;
+    client_body_timeout 15s;
+    keepalive_timeout 30s;
+    send_timeout 30s;
+
+    include /etc/nginx/conf.d/10-vm2.conf;
+}
@@ -0,0 +1,131 @@
+upstream message_safety_api {
+    server ${MESSAGE_SAFETY_UPSTREAM_HOST}:8080;
+    keepalive 16;
+}
+
+upstream bitrix_sync {
+    server ${BITRIX_SYNC_UPSTREAM_HOST}:8080;
+    keepalive 16;
+}
+
+server {
+    listen 8081;
+    location = /nginx-health/live {
+        access_log off;
+        return 200 "ok\n";
+    }
+    location / {
+        return 404;
+    }
+}
+
+server {
+    listen 8080;
+    server_name ${PROCESSING_PUBLIC_HOST};
+
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+        try_files $uri =404;
+    }
+
+    location = /bitrix/sync/webhook/contact {
+        return 426;
+    }
+    location = /bitrix/sync/webhook/alert {
+        return 426;
+    }
+    location / {
+        return 308 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 8444 ssl;
+    http2 on;
+    server_name ${PROCESSING_PUBLIC_HOST};
+
+    ssl_certificate /run/public-tls/fullchain.pem;
+    ssl_certificate_key /run/public-tls/privkey.pem;
+    include /etc/nginx/allowlists/tls.conf;
+
+    add_header Strict-Transport-Security "max-age=31536000" always;
+    add_header X-Content-Type-Options nosniff always;
+    add_header Referrer-Policy no-referrer always;
+    add_header Cache-Control no-store always;
+
+    location = /bitrix/sync/webhook/contact {
+        # Core error logs include the raw request line and cannot redact query.
+        error_log /dev/null crit;
+        if ($request_method != POST) { return 405; }
+        include /etc/nginx/allowlists/bitrix-webhook-allowlist.conf;
+        limit_req zone=bitrix_webhooks burst=20 nodelay;
+        limit_conn per_ip 10;
+        client_max_body_size 128k;
+        proxy_pass http://bitrix_sync;
+        include /etc/nginx/allowlists/proxy-common.conf;
+        proxy_read_timeout 60s;
+    }
+
+    location = /bitrix/sync/webhook/alert {
+        # Rejections remain visible in query-free access logs and metrics.
+        error_log /dev/null crit;
+        if ($request_method != POST) { return 405; }
+        include /etc/nginx/allowlists/bitrix-webhook-allowlist.conf;
+        limit_req zone=bitrix_webhooks burst=20 nodelay;
+        limit_conn per_ip 10;
+        client_max_body_size 128k;
+        proxy_pass http://bitrix_sync;
+        include /etc/nginx/allowlists/proxy-common.conf;
+        proxy_read_timeout 60s;
+    }
+
+    location / {
+        return 404;
+    }
+}
+
+server {
+    listen 8443 ssl;
+    server_name _;
+
+    ssl_certificate /run/secrets/internal_tls_certificate;
+    ssl_certificate_key /run/secrets/internal_tls_private_key;
+    include /etc/nginx/allowlists/tls.conf;
+
+    include /etc/nginx/allowlists/private-caller-allowlist.conf;
+    client_max_body_size 256k;
+    add_header Cache-Control no-store always;
+    add_header X-Content-Type-Options nosniff always;
+
+    location = /internal/safety/v2/messages/check {
+        if ($request_method != POST) { return 405; }
+        proxy_pass http://message_safety_api;
+        include /etc/nginx/allowlists/proxy-common.conf;
+        proxy_read_timeout 10s;
+    }
+
+    location ~ "^/internal/safety/v2/messages/tasks/[0-9a-fA-F-]{36}$" {
+        if ($request_method != GET) { return 405; }
+        proxy_pass http://message_safety_api;
+        include /etc/nginx/allowlists/proxy-common.conf;
+        proxy_read_timeout 5s;
+    }
+
+    location = /internal/safety/status {
+        if ($request_method != GET) { return 405; }
+        proxy_pass http://message_safety_api/health/ready;
+        include /etc/nginx/allowlists/proxy-common.conf;
+        proxy_read_timeout 60s;
+    }
+
+    location = /internal/sync/v1/status {
+        if ($request_method != GET) { return 405; }
+        proxy_pass http://bitrix_sync;
+        include /etc/nginx/allowlists/proxy-common.conf;
+        proxy_read_timeout 60s;
+    }
+
+    location / {
+        return 404;
+    }
+}