Инициализация NGINX

install.sh

@@ -0,0 +1,80 @@
+#!/bin/bash
+set -e
+
+# Переменные (передаются через окружение или аргументы)
+# client_f7cloud    - домен для клиента
+# ip_client_f7cloud  - IP адрес клиента
+# hpb_f7cloud       - домен для HPB
+# ip_hpb_f7cloud    - IP адрес HPB
+# certbot_email     - почта для получения сертификатов через certbot
+
+usage() {
+    echo "Использование: $0"
+    echo "Переменные (обязательно задать через экспорт или перед вызовом):"
+    echo "  client_f7cloud    - домен для клиента"
+    echo "  ip_client_f7cloud - IP адрес клиента"
+    echo "  hpb_f7cloud       - домен для HPB"
+    echo "  ip_hpb_f7cloud    - IP адрес HPB"
+    echo "  certbot_email     - почта для сертификатов certbot"
+    echo ""
+    echo "Пример:"
+    echo "  client_f7cloud=client.example.com ip_client_f7cloud=10.0.0.1 \\"
+    echo "  hpb_f7cloud=hpb.example.com ip_hpb_f7cloud=10.0.0.2 \\"
+    echo "  certbot_email=admin@example.com $0"
+    exit 1
+}
+
+for var in client_f7cloud ip_client_f7cloud hpb_f7cloud ip_hpb_f7cloud certbot_email; do
+    if [ -z "${!var}" ]; then
+        echo "Ошибка: не задана переменная $var"
+        usage
+    fi
+done
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+NGINX_SITES="/etc/nginx/sites-enabled"
+NGINX_SNIPPETS="/etc/nginx/snippets"
+
+echo "Установка nginx..."
+apt-get update
+apt-get install -y nginx
+
+echo "Установка certbot..."
+apt-get install -y certbot python3-certbot-nginx
+
+echo "Копирование конфигов с подстановкой переменных..."
+
+# Копируем sites-enabled (с заменой плейсхолдеров)
+mkdir -p "$NGINX_SITES"
+rsync -a --delete "$SCRIPT_DIR/sites-enabled/" "$NGINX_SITES/"
+for f in "$NGINX_SITES"/*.conf; do
+    [ -f "$f" ] || continue
+    sed -i \
+        -e "s|__CLIENT_F7CLOUD__|$client_f7cloud|g" \
+        -e "s|__IP_CLIENT_F7CLOUD__|$ip_client_f7cloud|g" \
+        -e "s|__HPB_F7CLOUD__|$hpb_f7cloud|g" \
+        -e "s|__IP_HPB_F7CLOUD__|$ip_hpb_f7cloud|g" \
+        "$f"
+done
+
+# Копируем snippets (с заменой плейсхолдеров)
+mkdir -p "$NGINX_SNIPPETS"
+rsync -a --delete "$SCRIPT_DIR/snippets/" "$NGINX_SNIPPETS/"
+for f in "$NGINX_SNIPPETS"/*.conf; do
+    [ -f "$f" ] || continue
+    sed -i \
+        -e "s|__CLIENT_F7CLOUD__|$client_f7cloud|g" \
+        -e "s|__IP_CLIENT_F7CLOUD__|$ip_client_f7cloud|g" \
+        -e "s|__HPB_F7CLOUD__|$hpb_f7cloud|g" \
+        -e "s|__IP_HPB_F7CLOUD__|$ip_hpb_f7cloud|g" \
+        "$f"
+done
+
+echo "Проверка конфигурации nginx..."
+nginx -t
+
+echo "Перезагрузка nginx..."
+systemctl reload nginx
+
+echo "Готово. Certbot установлен. Для получения сертификатов используйте:"
+echo "  certbot --nginx -d $client_f7cloud -d $hpb_f7cloud --email $certbot_email --agree-tos"

sites-enabled/default

@@ -0,0 +1 @@
+/etc/nginx/sites-available/default

sites-enabled/f7cloud.ru.conf

@@ -0,0 +1,40 @@
+server {
+    server_name __CLIENT_F7CLOUD__;
+
+
+
+    server_tokens off;
+
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/www/html;
+        try_files $uri =404;
+    }
+    location / {
+    proxy_pass http://__IP_CLIENT_F7CLOUD__:80;
+    proxy_http_version 1.1;
+
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto https;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Forwarded-Port 443;
+
+    proxy_read_timeout 3600;
+    proxy_send_timeout 3600;
+    proxy_connect_timeout 60;
+
+    proxy_buffering off;
+    proxy_request_buffering off;
+}
+
+    access_log /var/log/nginx/__CLIENT_F7CLOUD___access.log;
+    error_log  /var/log/nginx/__CLIENT_F7CLOUD___error.log;
+
+    listen [::]:80;
+    listen 80; 
+
+}
+
+
+

sites-enabled/hpb.f7cloud.ru.conf

@@ -0,0 +1,35 @@
+include /etc/nginx/snippets/signaling-upstream-servers.conf;
+
+server {
+  listen 0.0.0.0:80;
+  listen [::]:80 ipv6only=on;
+
+  server_name __HPB_F7CLOUD__;
+  server_tokens off;
+
+  location ^~ /.well-known/acme-challenge/ {
+      root /var/www/html;
+      try_files $uri =404;
+  }
+
+  location / {
+    rewrite ^ https://$host$request_uri? permanent;
+  }
+  include /etc/nginx/snippets/signaling-forwarding.conf;
+  access_log /var/log/nginx/__HPB_F7CLOUD___access.log;
+  error_log  /var/log/nginx/__HPB_F7CLOUD___error.log;
+}
+
+stream {
+    upstream coturn_backend {
+        server __IP_HPB_F7CLOUD__:5349;
+    }
+
+    server {
+        listen 5349;       # TCP для TURN
+        listen 5349 udp;   # UDP для звонков (ВАЖНО!)
+        proxy_pass coturn_backend;
+        proxy_timeout 1h;
+        proxy_connect_timeout 5s;
+    }
+}

snippets/fastcgi-php.conf

@@ -0,0 +1,13 @@
+# regex to split $uri to $fastcgi_script_name and $fastcgi_path
+fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+
+# Check that the PHP script exists before passing it
+try_files $fastcgi_script_name =404;
+
+# Bypass the fact that try_files resets $fastcgi_path_info
+# see: http://trac.nginx.org/nginx/ticket/321
+set $path_info $fastcgi_path_info;
+fastcgi_param PATH_INFO $path_info;
+
+fastcgi_index index.php;
+include fastcgi.conf;

snippets/headers.conf

@@ -0,0 +1,8 @@
+add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload;" always;
+add_header X-Content-Type-Options "nosniff" always;
+add_header X-XSS-Protection "1; mode=block" always;
+add_header X-Robots-Tag none always;
+add_header X-Download-Options noopen always;
+add_header X-Permitted-Cross-Domain-Policies none always;
+add_header Referrer-Policy no-referrer always;
+add_header X-Frame-Options "SAMEORIGIN" always;

snippets/signaling-forwarding.conf

@@ -0,0 +1,56 @@
+location /standalone-signaling/ {
+    proxy_pass http://signaling/;
+    proxy_http_version 1.1;
+
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Host $host;
+
+    proxy_buffering off;
+    proxy_request_buffering off;
+
+    proxy_read_timeout 3600;
+    proxy_send_timeout 3600;
+    proxy_connect_timeout 60;
+}
+
+location /standalone-signaling/spreed {
+    proxy_pass http://signaling/spreed;
+    proxy_http_version 1.1;
+
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Host $host;
+
+    proxy_buffering off;
+    proxy_request_buffering off;
+
+    proxy_read_timeout 3600;
+    proxy_send_timeout 3600;
+    proxy_connect_timeout 60;
+}
+
+location = /standalone-signaling {
+    proxy_pass http://signaling/;
+    proxy_http_version 1.1;
+
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Host $host;
+
+    proxy_buffering off;
+    proxy_request_buffering off;
+
+    proxy_read_timeout 3600;
+    proxy_send_timeout 3600;
+    proxy_connect_timeout 60;
+}

snippets/signaling-upstream-servers.conf

@@ -0,0 +1,4 @@
+upstream signaling {
+    server __IP_HPB_F7CLOUD__:8080;
+    keepalive 32;
+}

snippets/snakeoil.conf

@@ -0,0 +1,5 @@
+# Self signed certificates generated by the ssl-cert package
+# Don't use them in a production server!
+
+ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
+ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;