user
3 weeks ago
6 changed files with 234 additions and 10 deletions
@ -0,0 +1,218 @@ |
|||||
|
# Infrastruktura produkcyjna |
||||
|
|
||||
|
## Architektura |
||||
|
|
||||
|
``` |
||||
|
Internet → VPS (publiczne IP, nginx + SSL) |
||||
|
↕ WireGuard tunnel (szyfrowany, domowe IP ukryte) |
||||
|
192.168.2.66 (nginx, port 80) |
||||
|
↓ LAN |
||||
|
192.168.2.33 (docker-compose, port 80) |
||||
|
``` |
||||
|
|
||||
|
- Domowe IP nigdy nie jest widoczne publicznie |
||||
|
- SSL terminuje na VPS |
||||
|
- `.66` inicjuje połączenie WireGuard do VPS — zero port-forwardingu na domowym routerze |
||||
|
|
||||
|
--- |
||||
|
|
||||
|
## 1. WireGuard |
||||
|
|
||||
|
### Instalacja (VPS i .66) |
||||
|
|
||||
|
```bash |
||||
|
apt install wireguard |
||||
|
``` |
||||
|
|
||||
|
### VPS — generowanie kluczy |
||||
|
|
||||
|
```bash |
||||
|
wg genkey | tee /etc/wireguard/vps_private.key | wg pubkey > /etc/wireguard/vps_public.key |
||||
|
``` |
||||
|
|
||||
|
### .66 — generowanie kluczy |
||||
|
|
||||
|
```bash |
||||
|
wg genkey | tee /etc/wireguard/home_private.key | wg pubkey > /etc/wireguard/home_public.key |
||||
|
``` |
||||
|
|
||||
|
### `/etc/wireguard/wg0.conf` na VPS |
||||
|
|
||||
|
```ini |
||||
|
[Interface] |
||||
|
Address = 10.10.0.1/24 |
||||
|
ListenPort = 51820 |
||||
|
PrivateKey = <vps_private.key> |
||||
|
|
||||
|
[Peer] |
||||
|
# .66 home server |
||||
|
PublicKey = <home_public.key> |
||||
|
AllowedIPs = 10.10.0.2/32 |
||||
|
``` |
||||
|
|
||||
|
### `/etc/wireguard/wg0.conf` na .66 |
||||
|
|
||||
|
```ini |
||||
|
[Interface] |
||||
|
Address = 10.10.0.2/24 |
||||
|
PrivateKey = <home_private.key> |
||||
|
|
||||
|
[Peer] |
||||
|
# VPS |
||||
|
PublicKey = <vps_public.key> |
||||
|
Endpoint = <VPS_PUBLIC_IP>:51820 |
||||
|
AllowedIPs = 10.10.0.1/32 |
||||
|
PersistentKeepalive = 25 |
||||
|
``` |
||||
|
|
||||
|
> `PersistentKeepalive = 25` — utrzymuje tunel przez NAT domowego routera |
||||
|
|
||||
|
### Uruchomienie (obie maszyny) |
||||
|
|
||||
|
```bash |
||||
|
systemctl enable --now wg-quick@wg0 |
||||
|
``` |
||||
|
|
||||
|
### Weryfikacja |
||||
|
|
||||
|
```bash |
||||
|
wg show # status tunelu |
||||
|
ping 10.10.0.1 # z .66 do VPS |
||||
|
ping 10.10.0.2 # z VPS do .66 |
||||
|
``` |
||||
|
|
||||
|
--- |
||||
|
|
||||
|
## 2. Nginx na VPS |
||||
|
|
||||
|
### Certyfikat SSL |
||||
|
|
||||
|
```bash |
||||
|
apt install certbot python3-certbot-nginx |
||||
|
certbot certonly --nginx -d q2dropzone.xyz |
||||
|
``` |
||||
|
|
||||
|
### `/etc/nginx/sites-available/q2dropzone.xyz` |
||||
|
|
||||
|
```nginx |
||||
|
server { |
||||
|
listen 80; |
||||
|
server_name q2dropzone.xyz; |
||||
|
return 301 https://$host$request_uri; |
||||
|
} |
||||
|
|
||||
|
server { |
||||
|
listen 443 ssl; |
||||
|
server_name q2dropzone.xyz; |
||||
|
|
||||
|
ssl_certificate /etc/letsencrypt/live/q2dropzone.xyz/fullchain.pem; |
||||
|
ssl_certificate_key /etc/letsencrypt/live/q2dropzone.xyz/privkey.pem; |
||||
|
|
||||
|
client_max_body_size 6g; |
||||
|
proxy_read_timeout 3600s; |
||||
|
proxy_send_timeout 3600s; |
||||
|
proxy_connect_timeout 60s; |
||||
|
|
||||
|
location / { |
||||
|
proxy_pass http://10.10.0.2:80; |
||||
|
proxy_http_version 1.1; |
||||
|
proxy_set_header Host $host; |
||||
|
proxy_set_header X-Real-IP $remote_addr; |
||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; |
||||
|
proxy_set_header X-Forwarded-Proto https; |
||||
|
proxy_buffering off; |
||||
|
proxy_request_buffering off; |
||||
|
} |
||||
|
} |
||||
|
``` |
||||
|
|
||||
|
```bash |
||||
|
ln -s /etc/nginx/sites-available/q2dropzone.xyz /etc/nginx/sites-enabled/ |
||||
|
nginx -t && systemctl reload nginx |
||||
|
``` |
||||
|
|
||||
|
--- |
||||
|
|
||||
|
## 3. Nginx na .66 |
||||
|
|
||||
|
### `/etc/nginx/sites-available/q2dropzone.xyz` |
||||
|
|
||||
|
```nginx |
||||
|
server { |
||||
|
listen 80; |
||||
|
server_name q2dropzone.xyz; |
||||
|
|
||||
|
client_max_body_size 6g; |
||||
|
proxy_read_timeout 3600s; |
||||
|
proxy_send_timeout 3600s; |
||||
|
proxy_connect_timeout 60s; |
||||
|
|
||||
|
location / { |
||||
|
proxy_pass http://192.168.2.33:80; |
||||
|
proxy_http_version 1.1; |
||||
|
proxy_set_header Host $host; |
||||
|
proxy_set_header X-Real-IP $remote_addr; |
||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; |
||||
|
proxy_set_header X-Forwarded-Proto https; |
||||
|
proxy_buffering off; |
||||
|
proxy_request_buffering off; |
||||
|
} |
||||
|
} |
||||
|
``` |
||||
|
|
||||
|
```bash |
||||
|
ln -s /etc/nginx/sites-available/q2dropzone.xyz /etc/nginx/sites-enabled/ |
||||
|
nginx -t && systemctl reload nginx |
||||
|
``` |
||||
|
|
||||
|
--- |
||||
|
|
||||
|
## 4. Firewall |
||||
|
|
||||
|
### VPS |
||||
|
|
||||
|
```bash |
||||
|
ufw allow 51820/udp # WireGuard |
||||
|
ufw allow 80/tcp # HTTP (redirect do HTTPS) |
||||
|
ufw allow 443/tcp # HTTPS |
||||
|
ufw enable |
||||
|
``` |
||||
|
|
||||
|
### .66 |
||||
|
|
||||
|
```bash |
||||
|
# port 80 tylko z WireGuard IP VPS-a |
||||
|
ufw allow in on wg0 from 10.10.0.1 to any port 80 |
||||
|
ufw deny 80 |
||||
|
ufw enable |
||||
|
``` |
||||
|
|
||||
|
--- |
||||
|
|
||||
|
## 5. .33 — uruchomienie aplikacji |
||||
|
|
||||
|
```bash |
||||
|
git clone <repo> q2dropzone && cd q2dropzone |
||||
|
cp .env.example .env |
||||
|
nano .env # uzupełnij DB_PASSWORD, JWT_SECRET, DISK_ROOT |
||||
|
docker-compose up -d --build |
||||
|
``` |
||||
|
|
||||
|
--- |
||||
|
|
||||
|
## DNS |
||||
|
|
||||
|
Rekord A dla `q2dropzone.xyz` → publiczne IP VPS (nie domowe). |
||||
|
|
||||
|
--- |
||||
|
|
||||
|
## Przepływ requestu |
||||
|
|
||||
|
``` |
||||
|
klient |
||||
|
→ VPS:443 (SSL terminate, proxy_pass przez WireGuard) |
||||
|
→ .66:80 (proxy_pass przez LAN) |
||||
|
→ .33:80 (nginx w docker → backend Go) |
||||
|
``` |
||||
|
|
||||
|
Każdy nginx ma `proxy_buffering off` i `proxy_request_buffering off` — duże pliki streamowane bez buforowania na dysk. |
||||
|
After Width: | Height: | Size: 1.2 MiB |
Loading…
Reference in new issue