Bernt
bae705aa97
- Add NFC ePassport roadmap (ICAO 9303, eIDAS) - Add TensorFlow.js edge face detection (BlazeFace) - Add structured audit logger (GDPR-compliant) - Risk scoring support Part of KYC Apple Native UX v1.1.0
100 lines
3.5 KiB
Bash
100 lines
3.5 KiB
Bash
#!/bin/bash
|
|
# Deployment-skript: Nginx-config för LandveX Finance
|
|
# Kör med: sudo bash /home/bernt/.openclaw/workspace/aamos-ledger/deploy-nginx-fixes.sh
|
|
|
|
set -euo pipefail
|
|
|
|
echo "=== Nginx Config Deployment ==="
|
|
|
|
# ── Backup ───────────────────────────────────────────────────────────────────
|
|
BACKUP_DIR="/etc/nginx/.backup-$(date +%s)"
|
|
mkdir -p "$BACKUP_DIR"
|
|
cp /etc/nginx/conf.d/*.conf "$BACKUP_DIR/" 2>/dev/null || true
|
|
echo "✅ Backup skapad: $BACKUP_DIR"
|
|
|
|
# ── Skapa ny nginx-config ────────────────────────────────────────────────────
|
|
cat > /etc/nginx/conf.d/landvex-finance.conf << 'EOF'
|
|
# LandveX Finance — aamos-ledger proxy
|
|
# Ingen Basic Auth — JWT hanteras av aamos-ledger
|
|
|
|
server {
|
|
listen 443 ssl http2;
|
|
server_name landvex.com;
|
|
|
|
# SSL
|
|
ssl_certificate /etc/letsencrypt/live/landvex.com/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/landvex.com/privkey.pem;
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers HIGH:!aNULL:!MD5;
|
|
|
|
# Security headers
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
|
|
# Rate limiting
|
|
limit_req_zone $binary_remote_addr zone=finance:10m rate=10r/s;
|
|
limit_req zone=finance burst=20 nodelay;
|
|
|
|
# Proxy till aamos-ledger
|
|
location /api/ledger/ {
|
|
proxy_pass http://127.0.0.1:3250;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
# Propagera tenant/user headers från JWT (sätts av auth.mjs)
|
|
proxy_set_header X-Tenant-ID $http_x_tenant_id;
|
|
proxy_set_header X-User-ID $http_x_user_id;
|
|
proxy_set_header X-Trace-ID $http_x_trace_id;
|
|
|
|
proxy_connect_timeout 5s;
|
|
proxy_send_timeout 10s;
|
|
proxy_read_timeout 10s;
|
|
}
|
|
|
|
# Health check (unauthed)
|
|
location /health {
|
|
proxy_pass http://127.0.0.1:3250/health;
|
|
access_log off;
|
|
}
|
|
|
|
# Static files (UI)
|
|
location /ouroboros/finance/ {
|
|
alias /opt/amos/public/ouroboros/finance/;
|
|
try_files $uri $uri/ /ouroboros/finance/index.html;
|
|
expires 1h;
|
|
add_header Cache-Control "public, immutable";
|
|
}
|
|
}
|
|
|
|
# Redirect HTTP to HTTPS
|
|
server {
|
|
listen 80;
|
|
server_name landvex.com;
|
|
return 301 https://$server_name$request_uri;
|
|
}
|
|
EOF
|
|
|
|
echo "✅ Nginx-config skapad"
|
|
|
|
# ── Testa config ─────────────────────────────────────────────────────────────
|
|
nginx -t && echo "✅ Nginx config OK" || {
|
|
echo "❌ Nginx config fel — återställer backup"
|
|
cp "$BACKUP_DIR"/*.conf /etc/nginx/conf.d/ 2>/dev/null || true
|
|
exit 1
|
|
}
|
|
|
|
# ── Starta om nginx ──────────────────────────────────────────────────────────
|
|
systemctl reload nginx && echo "✅ Nginx reloadad" || {
|
|
echo "❌ Nginx reload misslyckades"
|
|
exit 1
|
|
}
|
|
|
|
echo ""
|
|
echo "=== Deployment klar ==="
|
|
echo "Backup: $BACKUP_DIR"
|