a27b74cf22
- Frontend v4 accessible sur réseau local (192.168.1.40) - Ports ouverts: 3002 (frontend), 5001 (backend), 5004 (dashboard) - Ollama GPU fonctionnel - Self-healing interactif - Dashboard confiance Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
428 lines
9.0 KiB
Markdown
428 lines
9.0 KiB
Markdown
# Configuration HTTPS Production - RPA Vision V3
|
|
|
|
**Guide complet pour sécuriser l'API et le Dashboard avec HTTPS**
|
|
|
|
## 📋 Prérequis
|
|
|
|
- Serveur Linux (Ubuntu/Debian recommandé)
|
|
- Nom de domaine pointant vers votre serveur
|
|
- Ports 80 et 443 ouverts dans le firewall
|
|
- Accès root/sudo
|
|
|
|
## 🔧 Installation
|
|
|
|
### 1. Installer Nginx
|
|
|
|
```bash
|
|
sudo apt update
|
|
sudo apt install nginx -y
|
|
```
|
|
|
|
### 2. Installer Certbot (Let's Encrypt)
|
|
|
|
```bash
|
|
sudo apt install certbot python3-certbot-nginx -y
|
|
```
|
|
|
|
## 🌐 Configuration Nginx
|
|
|
|
### 1. Créer la configuration pour l'API
|
|
|
|
**Fichier:** `/etc/nginx/sites-available/rpa-api`
|
|
|
|
```nginx
|
|
# Configuration API Upload
|
|
server {
|
|
listen 80;
|
|
server_name api.votre-domaine.com;
|
|
|
|
# Redirection HTTP → HTTPS (sera ajoutée par certbot)
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:8000;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
# Augmenter la taille max pour les uploads
|
|
client_max_body_size 100M;
|
|
client_body_timeout 300s;
|
|
|
|
# Timeouts
|
|
proxy_connect_timeout 300s;
|
|
proxy_send_timeout 300s;
|
|
proxy_read_timeout 300s;
|
|
}
|
|
}
|
|
```
|
|
|
|
### 2. Créer la configuration pour le Dashboard
|
|
|
|
**Fichier:** `/etc/nginx/sites-available/rpa-dashboard`
|
|
|
|
```nginx
|
|
# Configuration Dashboard Web
|
|
server {
|
|
listen 80;
|
|
server_name dashboard.votre-domaine.com;
|
|
|
|
# Redirection HTTP → HTTPS (sera ajoutée par certbot)
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:5001;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
# WebSocket support (si nécessaire)
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
}
|
|
}
|
|
```
|
|
|
|
### 3. Activer les configurations
|
|
|
|
```bash
|
|
# Créer les liens symboliques
|
|
sudo ln -s /etc/nginx/sites-available/rpa-api /etc/nginx/sites-enabled/
|
|
sudo ln -s /etc/nginx/sites-available/rpa-dashboard /etc/nginx/sites-enabled/
|
|
|
|
# Tester la configuration
|
|
sudo nginx -t
|
|
|
|
# Recharger Nginx
|
|
sudo systemctl reload nginx
|
|
```
|
|
|
|
## 🔒 Obtenir les Certificats SSL
|
|
|
|
### 1. Certificat pour l'API
|
|
|
|
```bash
|
|
sudo certbot --nginx -d api.votre-domaine.com
|
|
```
|
|
|
|
**Questions interactives:**
|
|
- Email: votre@email.com
|
|
- Accepter les termes: Yes
|
|
- Partager email: No (optionnel)
|
|
- Redirection HTTPS: Yes (recommandé)
|
|
|
|
### 2. Certificat pour le Dashboard
|
|
|
|
```bash
|
|
sudo certbot --nginx -d dashboard.votre-domaine.com
|
|
```
|
|
|
|
### 3. Vérifier les certificats
|
|
|
|
```bash
|
|
sudo certbot certificates
|
|
```
|
|
|
|
**Sortie attendue:**
|
|
```
|
|
Found the following certs:
|
|
Certificate Name: api.votre-domaine.com
|
|
Domains: api.votre-domaine.com
|
|
Expiry Date: 2026-02-23 (VALID: 89 days)
|
|
|
|
Certificate Name: dashboard.votre-domaine.com
|
|
Domains: dashboard.votre-domaine.com
|
|
Expiry Date: 2026-02-23 (VALID: 89 days)
|
|
```
|
|
|
|
## 🚀 Démarrer les Services
|
|
|
|
### 1. Créer le service systemd pour l'API
|
|
|
|
**Fichier:** `/etc/systemd/system/rpa-api.service`
|
|
|
|
```ini
|
|
[Unit]
|
|
Description=RPA Vision V3 - API Upload
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=rpa
|
|
WorkingDirectory=/home/rpa/rpa_vision_v3/server
|
|
Environment="ENCRYPTION_PASSWORD=VotreCléSecrète2025"
|
|
Environment="PATH=/home/rpa/rpa_vision_v3/venv_v3/bin:/usr/local/bin:/usr/bin:/bin"
|
|
ExecStart=/home/rpa/rpa_vision_v3/venv_v3/bin/uvicorn api_upload:app --host 127.0.0.1 --port 8000
|
|
Restart=always
|
|
RestartSec=10
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
```
|
|
|
|
### 2. Créer le service systemd pour le Dashboard
|
|
|
|
**Fichier:** `/etc/systemd/system/rpa-dashboard.service`
|
|
|
|
```ini
|
|
[Unit]
|
|
Description=RPA Vision V3 - Dashboard Web
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=rpa
|
|
WorkingDirectory=/home/rpa/rpa_vision_v3/web_dashboard
|
|
Environment="PATH=/home/rpa/rpa_vision_v3/venv_v3/bin:/usr/local/bin:/usr/bin:/bin"
|
|
ExecStart=/home/rpa/rpa_vision_v3/venv_v3/bin/python app.py
|
|
Restart=always
|
|
RestartSec=10
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
```
|
|
|
|
### 3. Activer et démarrer les services
|
|
|
|
```bash
|
|
# Recharger systemd
|
|
sudo systemctl daemon-reload
|
|
|
|
# Activer au démarrage
|
|
sudo systemctl enable rpa-api
|
|
sudo systemctl enable rpa-dashboard
|
|
|
|
# Démarrer les services
|
|
sudo systemctl start rpa-api
|
|
sudo systemctl start rpa-dashboard
|
|
|
|
# Vérifier le statut
|
|
sudo systemctl status rpa-api
|
|
sudo systemctl status rpa-dashboard
|
|
```
|
|
|
|
## 🔥 Configuration Firewall
|
|
|
|
```bash
|
|
# Autoriser HTTP et HTTPS
|
|
sudo ufw allow 80/tcp
|
|
sudo ufw allow 443/tcp
|
|
|
|
# Bloquer l'accès direct aux ports internes
|
|
sudo ufw deny 8000/tcp
|
|
sudo ufw deny 5001/tcp
|
|
|
|
# Activer le firewall
|
|
sudo ufw enable
|
|
|
|
# Vérifier
|
|
sudo ufw status
|
|
```
|
|
|
|
## ✅ Vérification
|
|
|
|
### 1. Tester l'API
|
|
|
|
```bash
|
|
# HTTP (devrait rediriger vers HTTPS)
|
|
curl -I http://api.votre-domaine.com/api/traces/status
|
|
|
|
# HTTPS
|
|
curl https://api.votre-domaine.com/api/traces/status
|
|
```
|
|
|
|
**Réponse attendue:**
|
|
```json
|
|
{
|
|
"status": "online",
|
|
"version": "1.0.0",
|
|
"encryption_enabled": true
|
|
}
|
|
```
|
|
|
|
### 2. Tester le Dashboard
|
|
|
|
Ouvrir dans un navigateur:
|
|
```
|
|
https://dashboard.votre-domaine.com
|
|
```
|
|
|
|
### 3. Tester l'upload depuis l'agent
|
|
|
|
**Configurer l'agent:**
|
|
|
|
```json
|
|
{
|
|
"server_url": "https://api.votre-domaine.com/api/traces/upload",
|
|
"encryption_password": "VotreCléSecrète2025"
|
|
}
|
|
```
|
|
|
|
## 🔄 Renouvellement Automatique
|
|
|
|
Certbot configure automatiquement le renouvellement. Vérifier:
|
|
|
|
```bash
|
|
# Tester le renouvellement (dry-run)
|
|
sudo certbot renew --dry-run
|
|
|
|
# Voir le timer systemd
|
|
sudo systemctl list-timers | grep certbot
|
|
```
|
|
|
|
**Le renouvellement se fait automatiquement tous les 60 jours.**
|
|
|
|
## 📊 Monitoring
|
|
|
|
### 1. Logs Nginx
|
|
|
|
```bash
|
|
# Logs d'accès
|
|
sudo tail -f /var/log/nginx/access.log
|
|
|
|
# Logs d'erreur
|
|
sudo tail -f /var/log/nginx/error.log
|
|
```
|
|
|
|
### 2. Logs Services
|
|
|
|
```bash
|
|
# API
|
|
sudo journalctl -u rpa-api -f
|
|
|
|
# Dashboard
|
|
sudo journalctl -u rpa-dashboard -f
|
|
```
|
|
|
|
### 3. Vérifier les certificats
|
|
|
|
```bash
|
|
# Expiration
|
|
sudo certbot certificates
|
|
|
|
# Tester SSL
|
|
curl -vI https://api.votre-domaine.com 2>&1 | grep -i ssl
|
|
```
|
|
|
|
## 🔒 Sécurité Avancée
|
|
|
|
### 1. Améliorer la configuration SSL
|
|
|
|
**Ajouter dans les blocs `server` Nginx:**
|
|
|
|
```nginx
|
|
# SSL Configuration
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_prefer_server_ciphers on;
|
|
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
|
|
ssl_session_cache shared:SSL:10m;
|
|
ssl_session_timeout 10m;
|
|
|
|
# Security Headers
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
```
|
|
|
|
### 2. Limiter les tentatives de connexion
|
|
|
|
```nginx
|
|
# Dans le bloc http de /etc/nginx/nginx.conf
|
|
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
|
|
|
|
# Dans le bloc location de l'API
|
|
location /api/traces/upload {
|
|
limit_req zone=api_limit burst=20 nodelay;
|
|
# ... reste de la config
|
|
}
|
|
```
|
|
|
|
### 3. Authentification basique (optionnel)
|
|
|
|
```bash
|
|
# Créer un fichier de mots de passe
|
|
sudo apt install apache2-utils
|
|
sudo htpasswd -c /etc/nginx/.htpasswd admin
|
|
|
|
# Ajouter dans la config Nginx
|
|
auth_basic "RPA Vision V3";
|
|
auth_basic_user_file /etc/nginx/.htpasswd;
|
|
```
|
|
|
|
## 🚨 Troubleshooting
|
|
|
|
### Problème: Certificat non obtenu
|
|
|
|
```bash
|
|
# Vérifier DNS
|
|
nslookup api.votre-domaine.com
|
|
|
|
# Vérifier port 80 accessible
|
|
sudo netstat -tlnp | grep :80
|
|
|
|
# Logs certbot
|
|
sudo tail -f /var/log/letsencrypt/letsencrypt.log
|
|
```
|
|
|
|
### Problème: 502 Bad Gateway
|
|
|
|
```bash
|
|
# Vérifier que les services tournent
|
|
sudo systemctl status rpa-api
|
|
sudo systemctl status rpa-dashboard
|
|
|
|
# Vérifier les ports
|
|
sudo netstat -tlnp | grep -E '8000|5001'
|
|
|
|
# Logs Nginx
|
|
sudo tail -f /var/log/nginx/error.log
|
|
```
|
|
|
|
### Problème: Upload échoue
|
|
|
|
```bash
|
|
# Vérifier taille max
|
|
grep client_max_body_size /etc/nginx/sites-available/rpa-api
|
|
|
|
# Augmenter si nécessaire
|
|
client_max_body_size 200M;
|
|
|
|
# Recharger Nginx
|
|
sudo systemctl reload nginx
|
|
```
|
|
|
|
## 📝 Checklist Déploiement
|
|
|
|
- [ ] Nom de domaine configuré (DNS A record)
|
|
- [ ] Nginx installé et configuré
|
|
- [ ] Certificats SSL obtenus (Let's Encrypt)
|
|
- [ ] Services systemd créés et démarrés
|
|
- [ ] Firewall configuré (80, 443 ouverts)
|
|
- [ ] Test API: `curl https://api.votre-domaine.com/api/traces/status`
|
|
- [ ] Test Dashboard: Ouvrir dans navigateur
|
|
- [ ] Test upload depuis agent
|
|
- [ ] Renouvellement auto vérifié: `sudo certbot renew --dry-run`
|
|
- [ ] Monitoring configuré (logs)
|
|
|
|
## 🎯 Résultat Final
|
|
|
|
**Après configuration:**
|
|
|
|
- ✅ API accessible via: `https://api.votre-domaine.com`
|
|
- ✅ Dashboard accessible via: `https://dashboard.votre-domaine.com`
|
|
- ✅ Certificats SSL valides (Let's Encrypt)
|
|
- ✅ Renouvellement automatique
|
|
- ✅ Firewall configuré
|
|
- ✅ Services auto-start au boot
|
|
|
|
**Les agents peuvent maintenant uploader en HTTPS sécurisé!** 🔒
|
|
|
|
---
|
|
|
|
**Besoin d'aide?**
|
|
- Logs Nginx: `/var/log/nginx/`
|
|
- Logs Certbot: `/var/log/letsencrypt/`
|
|
- Logs Services: `sudo journalctl -u rpa-api`
|