up

docker/nginx/default.conf

@@ -0,0 +1,120 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name _;
+    root /var/www/html;
+    index index.php index.html;
+
+    # Security headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "no-referrer-when-downgrade" always;
+
+    # Logs
+    access_log /var/log/nginx/whatsapp-access.log;
+    error_log /var/log/nginx/whatsapp-error.log warn;
+
+    # Aumentar timeouts para webhook (procesamiento puede tardar)
+    fastcgi_read_timeout 300;
+    fastcgi_send_timeout 300;
+    proxy_read_timeout 300;
+    proxy_send_timeout 300;
+
+    # Root location
+    location / {
+        try_files $uri $uri/ /index.php?$query_string;
+    }
+
+    # PHP files
+    location ~ \.php$ {
+        try_files $uri =404;
+        fastcgi_split_path_info ^(.+\.php)(/.+)$;
+        fastcgi_pass 127.0.0.1:9000;
+        fastcgi_index index.php;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        include fastcgi_params;
+
+        # FastCGI buffers
+        fastcgi_buffers 16 16k;
+        fastcgi_buffer_size 32k;
+        
+        # Importante para que webhook responda rápido
+        fastcgi_buffering off;
+    }
+
+    # Webhook endpoint (configuración especial para respuesta rápida)
+    location ~ ^/api/webhook(_optimized)?\.php$ {
+        fastcgi_pass 127.0.0.1:9000;
+        fastcgi_index webhook_optimized.php;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        include fastcgi_params;
+        
+        # Sin buffering para respuesta inmediata
+        fastcgi_buffering off;
+        fastcgi_request_buffering off;
+        
+        # Timeouts ajustados
+        fastcgi_read_timeout 60;
+        fastcgi_send_timeout 60;
+        
+        # No cache
+        add_header Cache-Control "no-store, no-cache, must-revalidate";
+        expires off;
+    }
+
+    # Health check endpoint
+    location /health.php {
+        fastcgi_pass 127.0.0.1:9000;
+        fastcgi_param SCRIPT_FILENAME $document_root/health.php;
+        include fastcgi_params;
+        access_log off;
+    }
+
+    # Static assets caching
+    location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|eot)$ {
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+        access_log off;
+    }
+
+    # Deny access to hidden files
+    location ~ /\. {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+
+    # Deny access to sensitive files
+    location ~ /(?:composer\.json|composer\.lock|package\.json|\.env|\.git) {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+
+    # Uploads directory
+    location ^~ /uploads/ {
+        alias /var/www/html/uploads/;
+        autoindex off;
+        
+        # Security: solo permitir ciertos tipos de archivo
+        location ~* \.(jpg|jpeg|png|gif|pdf|doc|docx|xls|xlsx|mp4|mp3|webp)$ {
+            expires 7d;
+            add_header Cache-Control "public";
+        }
+        
+        # Denegar ejecución de PHP en uploads
+        location ~ \.php$ {
+            deny all;
+        }
+    }
+
+    # API directory (sin directorio listing)
+    location ^~ /api/ {
+        location ~ \.php$ {
+            fastcgi_pass 127.0.0.1:9000;
+            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+            include fastcgi_params;
+        }
+    }
+}

docker/nginx/nginx.conf

@@ -0,0 +1,60 @@
+user www;
+worker_processes auto;
+error_log /var/log/nginx/error.log warn;
+pid /var/run/nginx.pid;
+
+events {
+    worker_connections 2048;
+    use epoll;
+    multi_accept on;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    # Logging
+    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                    '$status $body_bytes_sent "$http_referer" '
+                    '"$http_user_agent" "$http_x_forwarded_for" '
+                    'rt=$request_time uct="$upstream_connect_time" '
+                    'uht="$upstream_header_time" urt="$upstream_response_time"';
+
+    access_log /var/log/nginx/access.log main;
+
+    # Performance
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout 65;
+    types_hash_max_size 2048;
+    client_max_body_size 100M;
+
+    # Gzip
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 1000;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_types text/plain text/css text/xml text/javascript
+               application/json application/javascript application/xml+rss
+               application/rss+xml font/truetype font/opentype
+               application/vnd.ms-fontobject image/svg+xml;
+
+    # Buffer sizes
+    client_body_buffer_size 128k;
+    client_header_buffer_size 1k;
+    large_client_header_buffers 4 16k;
+
+    # Timeouts
+    client_body_timeout 12;
+    client_header_timeout 12;
+    send_timeout 10;
+
+    # FastCGI cache (opcional)
+    fastcgi_cache_path /var/cache/nginx levels=1:2 keys_zone=whatsapp_cache:10m 
+                       max_size=100m inactive=60m use_temp_path=off;
+
+    # Include virtual hosts
+    include /etc/nginx/http.d/*.conf;
+}