Проект разделен на два репозитория

2026-08-14 15:42:45 +03:00
parent e06a77ee1d
commit bbef7a30c9
521 changed files with 2597 additions and 2302 deletions
@@ -0,0 +1,131 @@
+upstream message_safety_api {
+    server ${MESSAGE_SAFETY_UPSTREAM_HOST}:8080;
+    keepalive 16;
+}
+
+upstream bitrix_sync {
+    server ${BITRIX_SYNC_UPSTREAM_HOST}:8080;
+    keepalive 16;
+}
+
+server {
+    listen 8081;
+    location = /nginx-health/live {
+        access_log off;
+        return 200 "ok\n";
+    }
+    location / {
+        return 404;
+    }
+}
+
+server {
+    listen 8080;
+    server_name ${PROCESSING_PUBLIC_HOST};
+
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+        try_files $uri =404;
+    }
+
+    location = /bitrix/sync/webhook/contact {
+        return 426;
+    }
+    location = /bitrix/sync/webhook/alert {
+        return 426;
+    }
+    location / {
+        return 308 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 8444 ssl;
+    http2 on;
+    server_name ${PROCESSING_PUBLIC_HOST};
+
+    ssl_certificate /run/public-tls/fullchain.pem;
+    ssl_certificate_key /run/public-tls/privkey.pem;
+    include /etc/nginx/allowlists/tls.conf;
+
+    add_header Strict-Transport-Security "max-age=31536000" always;
+    add_header X-Content-Type-Options nosniff always;
+    add_header Referrer-Policy no-referrer always;
+    add_header Cache-Control no-store always;
+
+    location = /bitrix/sync/webhook/contact {
+        # Core error logs include the raw request line and cannot redact query.
+        error_log /dev/null crit;
+        if ($request_method != POST) { return 405; }
+        include /etc/nginx/allowlists/bitrix-webhook-allowlist.conf;
+        limit_req zone=bitrix_webhooks burst=20 nodelay;
+        limit_conn per_ip 10;
+        client_max_body_size 128k;
+        proxy_pass http://bitrix_sync;
+        include /etc/nginx/allowlists/proxy-common.conf;
+        proxy_read_timeout 60s;
+    }
+
+    location = /bitrix/sync/webhook/alert {
+        # Rejections remain visible in query-free access logs and metrics.
+        error_log /dev/null crit;
+        if ($request_method != POST) { return 405; }
+        include /etc/nginx/allowlists/bitrix-webhook-allowlist.conf;
+        limit_req zone=bitrix_webhooks burst=20 nodelay;
+        limit_conn per_ip 10;
+        client_max_body_size 128k;
+        proxy_pass http://bitrix_sync;
+        include /etc/nginx/allowlists/proxy-common.conf;
+        proxy_read_timeout 60s;
+    }
+
+    location / {
+        return 404;
+    }
+}
+
+server {
+    listen 8443 ssl;
+    server_name _;
+
+    ssl_certificate /run/secrets/internal_tls_certificate;
+    ssl_certificate_key /run/secrets/internal_tls_private_key;
+    include /etc/nginx/allowlists/tls.conf;
+
+    include /etc/nginx/allowlists/private-caller-allowlist.conf;
+    client_max_body_size 256k;
+    add_header Cache-Control no-store always;
+    add_header X-Content-Type-Options nosniff always;
+
+    location = /internal/safety/v2/messages/check {
+        if ($request_method != POST) { return 405; }
+        proxy_pass http://message_safety_api;
+        include /etc/nginx/allowlists/proxy-common.conf;
+        proxy_read_timeout 10s;
+    }
+
+    location ~ "^/internal/safety/v2/messages/tasks/[0-9a-fA-F-]{36}$" {
+        if ($request_method != GET) { return 405; }
+        proxy_pass http://message_safety_api;
+        include /etc/nginx/allowlists/proxy-common.conf;
+        proxy_read_timeout 5s;
+    }
+
+    location = /internal/safety/status {
+        if ($request_method != GET) { return 405; }
+        proxy_pass http://message_safety_api/health/ready;
+        include /etc/nginx/allowlists/proxy-common.conf;
+        proxy_read_timeout 60s;
+    }
+
+    location = /internal/sync/v1/status {
+        if ($request_method != GET) { return 405; }
+        proxy_pass http://bitrix_sync;
+        include /etc/nginx/allowlists/proxy-common.conf;
+        proxy_read_timeout 60s;
+    }
+
+    location / {
+        return 404;
+    }
+}