From 22d049aa9f6349275a36b89c6f98da8ad17f8025 Mon Sep 17 00:00:00 2001 From: "Andrey K. Choi" Date: Sun, 2 Nov 2025 11:29:05 +0900 Subject: [PATCH] makefile script edit --- Makefile | 89 +------------------------------------ scripts/setup-nginx.sh | 99 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 101 insertions(+), 87 deletions(-) create mode 100755 scripts/setup-nginx.sh diff --git a/Makefile b/Makefile index 4aa41b6..54f0ef2 100644 --- a/Makefile +++ b/Makefile @@ -75,95 +75,10 @@ build-prod: ## Сборка для продакшена с настройкой else \ echo "✅ certbot уже установлен"; \ fi' - @echo "⚙️ Настройка nginx конфигурации..." - @sudo bash -c 'cat > /etc/nginx/sites-available/links << EOF\n\ -server {\n\ - listen 80;\n\ - server_name links.shareon.kr sharon.kr;\n\ -\n\ - # Redirect all HTTP requests to HTTPS\n\ - return 301 https://\$$server_name\$$request_uri;\n\ -}\n\ -\n\ -server {\n\ - listen 443 ssl http2;\n\ - server_name links.shareon.kr sharon.kr;\n\ -\n\ - # SSL certificates (will be configured by certbot)\n\ - # ssl_certificate /etc/letsencrypt/live/links.shareon.kr/fullchain.pem;\n\ - # ssl_certificate_key /etc/letsencrypt/live/links.shareon.kr/privkey.pem;\n\ -\n\ - # Modern SSL configuration\n\ - ssl_protocols TLSv1.2 TLSv1.3;\n\ - ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384;\n\ - ssl_prefer_server_ciphers off;\n\ - ssl_session_cache shared:SSL:10m;\n\ -\n\ - # Security headers\n\ - add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;\n\ - add_header X-Frame-Options DENY;\n\ - add_header X-Content-Type-Options nosniff;\n\ - add_header X-XSS-Protection "1; mode=block";\n\ -\n\ - # Proxy to frontend (Next.js)\n\ - location / {\n\ - proxy_pass http://localhost:3000;\n\ - proxy_http_version 1.1;\n\ - proxy_set_header Upgrade \$$http_upgrade;\n\ - proxy_set_header Connection "upgrade";\n\ - proxy_set_header Host \$$host;\n\ - proxy_set_header X-Real-IP \$$remote_addr;\n\ - proxy_set_header X-Forwarded-For \$$proxy_add_x_forwarded_for;\n\ - proxy_set_header X-Forwarded-Proto \$$scheme;\n\ - proxy_cache_bypass \$$http_upgrade;\n\ - proxy_read_timeout 86400;\n\ - }\n\ -\n\ - # Proxy API requests to backend (Django)\n\ - location /api/ {\n\ - proxy_pass http://localhost:8000;\n\ - proxy_set_header Host \$$host;\n\ - proxy_set_header X-Real-IP \$$remote_addr;\n\ - proxy_set_header X-Forwarded-For \$$proxy_add_x_forwarded_for;\n\ - proxy_set_header X-Forwarded-Proto \$$scheme;\n\ - }\n\ -\n\ - # Proxy admin requests to backend (Django)\n\ - location /admin/ {\n\ - proxy_pass http://localhost:8000;\n\ - proxy_set_header Host \$$host;\n\ - proxy_set_header X-Real-IP \$$remote_addr;\n\ - proxy_set_header X-Forwarded-For \$$proxy_add_x_forwarded_for;\n\ - proxy_set_header X-Forwarded-Proto \$$scheme;\n\ - }\n\ -\n\ - # Serve static files from Django\n\ - location /static/ {\n\ - proxy_pass http://localhost:8000;\n\ - proxy_set_header Host \$$host;\n\ - expires 1y;\n\ - add_header Cache-Control "public, immutable";\n\ - }\n\ -\n\ - # Serve media files from Django\n\ - location /media/ {\n\ - proxy_pass http://localhost:8000;\n\ - proxy_set_header Host \$$host;\n\ - expires 1y;\n\ - add_header Cache-Control "public";\n\ - }\n\ -}\n\ -EOF' - @sudo ln -sf /etc/nginx/sites-available/links /etc/nginx/sites-enabled/ - @sudo rm -f /etc/nginx/sites-enabled/default - @echo "🧪 Проверка конфигурации nginx..." - @sudo nginx -t - @echo "🔄 Перезапуск nginx..." - @sudo systemctl restart nginx - @sudo systemctl enable nginx + @./scripts/setup-nginx.sh @echo "✅ Продакшен сборка и nginx настройка завершены" @echo "📝 Для получения SSL сертификата выполните:" - @echo " sudo certbot --nginx -d links.shareon.kr -d sharon.kr" + @echo " make ssl-cert" ssl-cert: ## Получить SSL сертификат от Let's Encrypt @echo "🔒 Получение SSL сертификата..." diff --git a/scripts/setup-nginx.sh b/scripts/setup-nginx.sh new file mode 100755 index 0000000..4d994c1 --- /dev/null +++ b/scripts/setup-nginx.sh @@ -0,0 +1,99 @@ +#!/bin/bash +# scripts/setup-nginx.sh - Настройка nginx для CatLink + +set -e + +echo "⚙️ Настройка nginx конфигурации..." + +# Создание конфигурации nginx +sudo tee /etc/nginx/sites-available/links > /dev/null << 'EOF' +server { + listen 80; + server_name links.shareon.kr sharon.kr; + + # Redirect all HTTP requests to HTTPS + return 301 https://$server_name$request_uri; +} + +server { + listen 443 ssl http2; + server_name links.shareon.kr sharon.kr; + + # SSL certificates (will be configured by certbot) + # ssl_certificate /etc/letsencrypt/live/links.shareon.kr/fullchain.pem; + # ssl_certificate_key /etc/letsencrypt/live/links.shareon.kr/privkey.pem; + + # Modern SSL configuration + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384; + ssl_prefer_server_ciphers off; + ssl_session_cache shared:SSL:10m; + + # Security headers + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + add_header X-Frame-Options DENY; + add_header X-Content-Type-Options nosniff; + add_header X-XSS-Protection "1; mode=block"; + + # Proxy to frontend (Next.js) + location / { + proxy_pass http://localhost:3000; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_cache_bypass $http_upgrade; + proxy_read_timeout 86400; + } + + # Proxy API requests to backend (Django) + location /api/ { + proxy_pass http://localhost:8000; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + + # Proxy admin requests to backend (Django) + location /admin/ { + proxy_pass http://localhost:8000; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + + # Serve static files from Django + location /static/ { + proxy_pass http://localhost:8000; + proxy_set_header Host $host; + expires 1y; + add_header Cache-Control "public, immutable"; + } + + # Serve media files from Django + location /media/ { + proxy_pass http://localhost:8000; + proxy_set_header Host $host; + expires 1y; + add_header Cache-Control "public"; + } +} +EOF + +echo "🔗 Активация конфигурации nginx..." +sudo ln -sf /etc/nginx/sites-available/links /etc/nginx/sites-enabled/ +sudo rm -f /etc/nginx/sites-enabled/default + +echo "🧪 Проверка конфигурации nginx..." +sudo nginx -t + +echo "🔄 Перезапуск nginx..." +sudo systemctl restart nginx +sudo systemctl enable nginx + +echo "✅ nginx настройка завершена" \ No newline at end of file