added SSL certificate let's encrypt

_docker/nginx/prod/conf.d/nginx.conf

@@ -1,36 +1,70 @@
 server {
+    listen 80;
+    server_name ntspi.ru www.ntspi.ru;
+    return 301 https://www.ntspi.ru$request_uri;
+}
 
+server {
+    listen 443 ssl http2;
+    server_name ntspi.ru;
+
+    ssl_certificate /etc/letsencrypt/live/www.ntspi.ru/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/www.ntspi.ru/privkey.pem;
+
+    return 301 https://www.ntspi.ru$request_uri;
+}
+
+
+server {
+    listen 443 ssl http2;
+    server_name www.ntspi.ru;
+
+    # SSL-конфигурация
+    ssl_certificate /etc/letsencrypt/live/www.ntspi.ru/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/www.ntspi.ru/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/www.ntspi.ru/chain.pem;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:SSL:50m;
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    resolver 8.8.8.8 8.8.4.4 valid=300s;
+    resolver_timeout 5s;
+
+    # Ваши текущие настройки
     gzip on;
-    gzip_disable "msie6";  # Отключение для IE6 (устаревший браузер)
-
+    gzip_disable "msie6";
     gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml;
-
     gzip_min_length 1024;
-
     gzip_comp_level 6;
-
     gzip_buffers 16 8k;
-
     gzip_proxied any;
-
     gzip_vary on;
 
-    client_max_body_size 200M;  # Максимальный размер тела запроса
-    large_client_header_buffers 4 128k;  # Размеры буферов для заголовков
+    client_max_body_size 200M;
+    large_client_header_buffers 4 128k;
 
     root /var/www/public;
 
+    # Security headers
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options "nosniff";
+    add_header X-XSS-Protection "1; mode=block";
+    add_header Referrer-Policy "strict-origin-when-cross-origin";
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
+
     location / {
-        add_header Access-Control-Allow-Origin *;  # Заголовок для CORS
-        try_files $uri /index.php?$args;  # Обработка запросов
+        add_header Access-Control-Allow-Origin *;
+        try_files $uri /index.php?$args;
     }
 
-
-
     location /sveden/ {
         alias /var/www/public/sveden/;
         index index.html;
-        try_files $uri $uri/ /sveden/index.html;  # Обработка статических файлов
+        try_files $uri $uri/ /sveden/index.html;
     }
 
     location = /sveden {
@@ -38,29 +72,32 @@ server {
     }
 
     location ~ \.php$ {
-        try_files $uri =404;  # Если файл не найден, возвращаем 404
-        fastcgi_split_path_info ^(.+\.php)(/.+)$;  # Разделение пути
-        fastcgi_pass app:9000;  # Указываем сервер PHP-FPM
-        fastcgi_index index.php;  # Индексный файл
-        include fastcgi_params;  # Включаем параметры FastCGI
-        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;  # Путь к скрипту
-        fastcgi_param PATH_INFO $fastcgi_path_info;  # Информация о пути
-        fastcgi_buffers 16 16k;  # Увеличение буферов FastCGI
-        fastcgi_buffer_size 32k;  # Размер буфера FastCGI
+        try_files $uri =404;
+        fastcgi_split_path_info ^(.+\.php)(/.+)$;
+        fastcgi_pass app:9000;
+        fastcgi_index index.php;
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        fastcgi_param PATH_INFO $fastcgi_path_info;
+        fastcgi_buffers 16 16k;
+        fastcgi_buffer_size 32k;
         fastcgi_param REQUEST_SCHEME https;
         fastcgi_param HTTPS On;
     }
 
-    # Защита от доступа к конфиденциальным файлам
     location ~ /\.ht {
-        deny all;  # Запрет доступа к файлам .htaccess
+        deny all;
     }
 
-    # Настройки кэширования для статических файлов
     location ~* \.(css|js|jpg|jpeg|png|gif|ico|svg|woff|woff2|ttf|otf)$ {
-        expires 30d;  # Кэширование на 30 дней
-        add_header Cache-Control "public, no-transform";  # Заголовок кэширования
+        expires 30d;
+        add_header Cache-Control "public, no-transform";
     }
 
-
+    # Блок для обновления Let's Encrypt (оставить!)
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+        allow all;
+        default_type "text/plain";
+    }
 }

docker-compose.yml

@@ -1,18 +1,36 @@
 version: '3'
+
 services:
   webserver:
     image: nginx:1.27.2
     volumes:
       - ./:/var/www
       - ./_docker/nginx/${NGINX_ENV}/conf.d/:/etc/nginx/conf.d/
+      - /etc/letsencrypt:/etc/letsencrypt
+      - /var/www/certbot:/var/www/certbot
     ports:
       - "80:80"
+      - "443:443"
     container_name: ntspi-nginx
     restart: always
     depends_on:
       - app
     env_file:
       - .env
+    networks:
+      - app-network
+
+  certbot:
+    image: certbot/certbot
+    container_name: ntspi-certbot
+    volumes:
+      - /etc/letsencrypt:/etc/letsencrypt
+      - /var/www/certbot:/var/www/certbot
+    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
+    depends_on:
+      - webserver
+    networks:
+      - app-network
 
   app:
     build:
@@ -27,6 +45,8 @@ services:
     depends_on:
       db:
         condition: service_healthy
+    networks:
+      - app-network
 
   php-queue-worker:
     restart: always
@@ -40,6 +60,8 @@ services:
     depends_on:
       db:
         condition: service_healthy
+    networks:
+      - app-network
 
   db:
     image: mysql:8.0
@@ -59,6 +81,8 @@ services:
       interval: 5s
       timeout: 10s
       retries: 10
+    networks:
+      - app-network
 
   redis-cache:
     image: redis:7.4.2
@@ -69,7 +93,13 @@ services:
     command: redis-server --save 20 1 --loglevel warning
     volumes:
       - cache:/data
+    networks:
+      - app-network
 
 volumes:
   cache:
     driver: local
+
+networks:
+  app-network:
+    driver: bridge