v1.0 - Version stable: multi-PC, détection UI-DETR-1, 3 modes exécution
- Frontend v4 accessible sur réseau local (192.168.1.40) - Ports ouverts: 3002 (frontend), 5001 (backend), 5004 (dashboard) - Ollama GPU fonctionnel - Self-healing interactif - Dashboard confiance Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Dom
427
server/nginx_https_setup.md
Normal file
427
server/nginx_https_setup.md
Normal file
@@ -0,0 +1,427 @@
|
||||
# Configuration HTTPS Production - RPA Vision V3
|
||||
|
||||
**Guide complet pour sécuriser l'API et le Dashboard avec HTTPS**
|
||||
|
||||
## 📋 Prérequis
|
||||
|
||||
- Serveur Linux (Ubuntu/Debian recommandé)
|
||||
- Nom de domaine pointant vers votre serveur
|
||||
- Ports 80 et 443 ouverts dans le firewall
|
||||
- Accès root/sudo
|
||||
|
||||
## 🔧 Installation
|
||||
|
||||
### 1. Installer Nginx
|
||||
|
||||
```bash
|
||||
sudo apt update
|
||||
sudo apt install nginx -y
|
||||
```
|
||||
|
||||
### 2. Installer Certbot (Let's Encrypt)
|
||||
|
||||
```bash
|
||||
sudo apt install certbot python3-certbot-nginx -y
|
||||
```
|
||||
|
||||
## 🌐 Configuration Nginx
|
||||
|
||||
### 1. Créer la configuration pour l'API
|
||||
|
||||
**Fichier:** `/etc/nginx/sites-available/rpa-api`
|
||||
|
||||
```nginx
|
||||
# Configuration API Upload
|
||||
server {
|
||||
listen 80;
|
||||
server_name api.votre-domaine.com;
|
||||
|
||||
# Redirection HTTP → HTTPS (sera ajoutée par certbot)
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8000;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
# Augmenter la taille max pour les uploads
|
||||
client_max_body_size 100M;
|
||||
client_body_timeout 300s;
|
||||
|
||||
# Timeouts
|
||||
proxy_connect_timeout 300s;
|
||||
proxy_send_timeout 300s;
|
||||
proxy_read_timeout 300s;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### 2. Créer la configuration pour le Dashboard
|
||||
|
||||
**Fichier:** `/etc/nginx/sites-available/rpa-dashboard`
|
||||
|
||||
```nginx
|
||||
# Configuration Dashboard Web
|
||||
server {
|
||||
listen 80;
|
||||
server_name dashboard.votre-domaine.com;
|
||||
|
||||
# Redirection HTTP → HTTPS (sera ajoutée par certbot)
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:5001;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
# WebSocket support (si nécessaire)
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### 3. Activer les configurations
|
||||
|
||||
```bash
|
||||
# Créer les liens symboliques
|
||||
sudo ln -s /etc/nginx/sites-available/rpa-api /etc/nginx/sites-enabled/
|
||||
sudo ln -s /etc/nginx/sites-available/rpa-dashboard /etc/nginx/sites-enabled/
|
||||
|
||||
# Tester la configuration
|
||||
sudo nginx -t
|
||||
|
||||
# Recharger Nginx
|
||||
sudo systemctl reload nginx
|
||||
```
|
||||
|
||||
## 🔒 Obtenir les Certificats SSL
|
||||
|
||||
### 1. Certificat pour l'API
|
||||
|
||||
```bash
|
||||
sudo certbot --nginx -d api.votre-domaine.com
|
||||
```
|
||||
|
||||
**Questions interactives:**
|
||||
- Email: votre@email.com
|
||||
- Accepter les termes: Yes
|
||||
- Partager email: No (optionnel)
|
||||
- Redirection HTTPS: Yes (recommandé)
|
||||
|
||||
### 2. Certificat pour le Dashboard
|
||||
|
||||
```bash
|
||||
sudo certbot --nginx -d dashboard.votre-domaine.com
|
||||
```
|
||||
|
||||
### 3. Vérifier les certificats
|
||||
|
||||
```bash
|
||||
sudo certbot certificates
|
||||
```
|
||||
|
||||
**Sortie attendue:**
|
||||
```
|
||||
Found the following certs:
|
||||
Certificate Name: api.votre-domaine.com
|
||||
Domains: api.votre-domaine.com
|
||||
Expiry Date: 2026-02-23 (VALID: 89 days)
|
||||
|
||||
Certificate Name: dashboard.votre-domaine.com
|
||||
Domains: dashboard.votre-domaine.com
|
||||
Expiry Date: 2026-02-23 (VALID: 89 days)
|
||||
```
|
||||
|
||||
## 🚀 Démarrer les Services
|
||||
|
||||
### 1. Créer le service systemd pour l'API
|
||||
|
||||
**Fichier:** `/etc/systemd/system/rpa-api.service`
|
||||
|
||||
```ini
|
||||
[Unit]
|
||||
Description=RPA Vision V3 - API Upload
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=rpa
|
||||
WorkingDirectory=/home/rpa/rpa_vision_v3/server
|
||||
Environment="ENCRYPTION_PASSWORD=VotreCléSecrète2025"
|
||||
Environment="PATH=/home/rpa/rpa_vision_v3/venv_v3/bin:/usr/local/bin:/usr/bin:/bin"
|
||||
ExecStart=/home/rpa/rpa_vision_v3/venv_v3/bin/uvicorn api_upload:app --host 127.0.0.1 --port 8000
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
```
|
||||
|
||||
### 2. Créer le service systemd pour le Dashboard
|
||||
|
||||
**Fichier:** `/etc/systemd/system/rpa-dashboard.service`
|
||||
|
||||
```ini
|
||||
[Unit]
|
||||
Description=RPA Vision V3 - Dashboard Web
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=rpa
|
||||
WorkingDirectory=/home/rpa/rpa_vision_v3/web_dashboard
|
||||
Environment="PATH=/home/rpa/rpa_vision_v3/venv_v3/bin:/usr/local/bin:/usr/bin:/bin"
|
||||
ExecStart=/home/rpa/rpa_vision_v3/venv_v3/bin/python app.py
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
```
|
||||
|
||||
### 3. Activer et démarrer les services
|
||||
|
||||
```bash
|
||||
# Recharger systemd
|
||||
sudo systemctl daemon-reload
|
||||
|
||||
# Activer au démarrage
|
||||
sudo systemctl enable rpa-api
|
||||
sudo systemctl enable rpa-dashboard
|
||||
|
||||
# Démarrer les services
|
||||
sudo systemctl start rpa-api
|
||||
sudo systemctl start rpa-dashboard
|
||||
|
||||
# Vérifier le statut
|
||||
sudo systemctl status rpa-api
|
||||
sudo systemctl status rpa-dashboard
|
||||
```
|
||||
|
||||
## 🔥 Configuration Firewall
|
||||
|
||||
```bash
|
||||
# Autoriser HTTP et HTTPS
|
||||
sudo ufw allow 80/tcp
|
||||
sudo ufw allow 443/tcp
|
||||
|
||||
# Bloquer l'accès direct aux ports internes
|
||||
sudo ufw deny 8000/tcp
|
||||
sudo ufw deny 5001/tcp
|
||||
|
||||
# Activer le firewall
|
||||
sudo ufw enable
|
||||
|
||||
# Vérifier
|
||||
sudo ufw status
|
||||
```
|
||||
|
||||
## ✅ Vérification
|
||||
|
||||
### 1. Tester l'API
|
||||
|
||||
```bash
|
||||
# HTTP (devrait rediriger vers HTTPS)
|
||||
curl -I http://api.votre-domaine.com/api/traces/status
|
||||
|
||||
# HTTPS
|
||||
curl https://api.votre-domaine.com/api/traces/status
|
||||
```
|
||||
|
||||
**Réponse attendue:**
|
||||
```json
|
||||
{
|
||||
"status": "online",
|
||||
"version": "1.0.0",
|
||||
"encryption_enabled": true
|
||||
}
|
||||
```
|
||||
|
||||
### 2. Tester le Dashboard
|
||||
|
||||
Ouvrir dans un navigateur:
|
||||
```
|
||||
https://dashboard.votre-domaine.com
|
||||
```
|
||||
|
||||
### 3. Tester l'upload depuis l'agent
|
||||
|
||||
**Configurer l'agent:**
|
||||
|
||||
```json
|
||||
{
|
||||
"server_url": "https://api.votre-domaine.com/api/traces/upload",
|
||||
"encryption_password": "VotreCléSecrète2025"
|
||||
}
|
||||
```
|
||||
|
||||
## 🔄 Renouvellement Automatique
|
||||
|
||||
Certbot configure automatiquement le renouvellement. Vérifier:
|
||||
|
||||
```bash
|
||||
# Tester le renouvellement (dry-run)
|
||||
sudo certbot renew --dry-run
|
||||
|
||||
# Voir le timer systemd
|
||||
sudo systemctl list-timers | grep certbot
|
||||
```
|
||||
|
||||
**Le renouvellement se fait automatiquement tous les 60 jours.**
|
||||
|
||||
## 📊 Monitoring
|
||||
|
||||
### 1. Logs Nginx
|
||||
|
||||
```bash
|
||||
# Logs d'accès
|
||||
sudo tail -f /var/log/nginx/access.log
|
||||
|
||||
# Logs d'erreur
|
||||
sudo tail -f /var/log/nginx/error.log
|
||||
```
|
||||
|
||||
### 2. Logs Services
|
||||
|
||||
```bash
|
||||
# API
|
||||
sudo journalctl -u rpa-api -f
|
||||
|
||||
# Dashboard
|
||||
sudo journalctl -u rpa-dashboard -f
|
||||
```
|
||||
|
||||
### 3. Vérifier les certificats
|
||||
|
||||
```bash
|
||||
# Expiration
|
||||
sudo certbot certificates
|
||||
|
||||
# Tester SSL
|
||||
curl -vI https://api.votre-domaine.com 2>&1 | grep -i ssl
|
||||
```
|
||||
|
||||
## 🔒 Sécurité Avancée
|
||||
|
||||
### 1. Améliorer la configuration SSL
|
||||
|
||||
**Ajouter dans les blocs `server` Nginx:**
|
||||
|
||||
```nginx
|
||||
# SSL Configuration
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
ssl_session_timeout 10m;
|
||||
|
||||
# Security Headers
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
```
|
||||
|
||||
### 2. Limiter les tentatives de connexion
|
||||
|
||||
```nginx
|
||||
# Dans le bloc http de /etc/nginx/nginx.conf
|
||||
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
|
||||
|
||||
# Dans le bloc location de l'API
|
||||
location /api/traces/upload {
|
||||
limit_req zone=api_limit burst=20 nodelay;
|
||||
# ... reste de la config
|
||||
}
|
||||
```
|
||||
|
||||
### 3. Authentification basique (optionnel)
|
||||
|
||||
```bash
|
||||
# Créer un fichier de mots de passe
|
||||
sudo apt install apache2-utils
|
||||
sudo htpasswd -c /etc/nginx/.htpasswd admin
|
||||
|
||||
# Ajouter dans la config Nginx
|
||||
auth_basic "RPA Vision V3";
|
||||
auth_basic_user_file /etc/nginx/.htpasswd;
|
||||
```
|
||||
|
||||
## 🚨 Troubleshooting
|
||||
|
||||
### Problème: Certificat non obtenu
|
||||
|
||||
```bash
|
||||
# Vérifier DNS
|
||||
nslookup api.votre-domaine.com
|
||||
|
||||
# Vérifier port 80 accessible
|
||||
sudo netstat -tlnp | grep :80
|
||||
|
||||
# Logs certbot
|
||||
sudo tail -f /var/log/letsencrypt/letsencrypt.log
|
||||
```
|
||||
|
||||
### Problème: 502 Bad Gateway
|
||||
|
||||
```bash
|
||||
# Vérifier que les services tournent
|
||||
sudo systemctl status rpa-api
|
||||
sudo systemctl status rpa-dashboard
|
||||
|
||||
# Vérifier les ports
|
||||
sudo netstat -tlnp | grep -E '8000|5001'
|
||||
|
||||
# Logs Nginx
|
||||
sudo tail -f /var/log/nginx/error.log
|
||||
```
|
||||
|
||||
### Problème: Upload échoue
|
||||
|
||||
```bash
|
||||
# Vérifier taille max
|
||||
grep client_max_body_size /etc/nginx/sites-available/rpa-api
|
||||
|
||||
# Augmenter si nécessaire
|
||||
client_max_body_size 200M;
|
||||
|
||||
# Recharger Nginx
|
||||
sudo systemctl reload nginx
|
||||
```
|
||||
|
||||
## 📝 Checklist Déploiement
|
||||
|
||||
- [ ] Nom de domaine configuré (DNS A record)
|
||||
- [ ] Nginx installé et configuré
|
||||
- [ ] Certificats SSL obtenus (Let's Encrypt)
|
||||
- [ ] Services systemd créés et démarrés
|
||||
- [ ] Firewall configuré (80, 443 ouverts)
|
||||
- [ ] Test API: `curl https://api.votre-domaine.com/api/traces/status`
|
||||
- [ ] Test Dashboard: Ouvrir dans navigateur
|
||||
- [ ] Test upload depuis agent
|
||||
- [ ] Renouvellement auto vérifié: `sudo certbot renew --dry-run`
|
||||
- [ ] Monitoring configuré (logs)
|
||||
|
||||
## 🎯 Résultat Final
|
||||
|
||||
**Après configuration:**
|
||||
|
||||
- ✅ API accessible via: `https://api.votre-domaine.com`
|
||||
- ✅ Dashboard accessible via: `https://dashboard.votre-domaine.com`
|
||||
- ✅ Certificats SSL valides (Let's Encrypt)
|
||||
- ✅ Renouvellement automatique
|
||||
- ✅ Firewall configuré
|
||||
- ✅ Services auto-start au boot
|
||||
|
||||
**Les agents peuvent maintenant uploader en HTTPS sécurisé!** 🔒
|
||||
|
||||
---
|
||||
|
||||
**Besoin d'aide?**
|
||||
- Logs Nginx: `/var/log/nginx/`
|
||||
- Logs Certbot: `/var/log/letsencrypt/`
|
||||
- Logs Services: `sudo journalctl -u rpa-api`
|
||||
Reference in New Issue
Block a user