up

docker/entrypoint-dev.sh

@@ -17,6 +17,11 @@ echo "📁 Creando directorios..."
 mkdir -p /var/www/html/logs
 mkdir -p /var/www/html/uploads
 mkdir -p /run/php
+mkdir -p /var/lib/nginx/tmp/client_body
+mkdir -p /var/lib/nginx/tmp/proxy
+mkdir -p /var/lib/nginx/tmp/fastcgi
+mkdir -p /var/lib/nginx/tmp/uwsgi
+mkdir -p /var/lib/nginx/tmp/scgi
 
 # Establecer permisos
 echo "🔐 Configurando permisos..."
@@ -24,6 +29,8 @@ chown -R www-data:www-data /var/www/html/logs
 chown -R www-data:www-data /var/www/html/uploads
 chmod -R 755 /var/www/html/logs
 chmod -R 755 /var/www/html/uploads
+chown -R nginx:nginx /var/lib/nginx/tmp
+chmod -R 755 /var/lib/nginx/tmp
 
 # Información de desarrollo
 echo ""

docker/entrypoint.sh

@@ -13,16 +13,25 @@ until redis-cli -h ${REDIS_HOST:-redis} ping 2>/dev/null; do
 done
 echo "✅ Redis conectado"
 
-# Esperar a que MySQL esté disponible (solo si no es localhost ni IP interna)
-if [ "${DB_HOST}" != "localhost" ] && [ "${DB_HOST}" != "127.0.0.1" ] && [ "${DB_HOST}" != "db" ]; then
-    echo "ℹ️  Usando base de datos externa (${DB_HOST}), omitiendo verificación de conectividad..."
-else
-    echo "⏳ Esperando MySQL..."
-    until mysql -h ${DB_HOST:-db} -u ${DB_USER:-whatsapp_user} -p${DB_PASS} -e "SELECT 1" >/dev/null 2>&1; do
-        echo "   MySQL no disponible, esperando..."
+# Esperar a que MySQL esté disponible
+if [ "${DB_HOST}" = "mysql" ] || [ "${DB_HOST}" = "db" ]; then
+    echo "⏳ Esperando MySQL local..."
+    MAX_RETRIES=30
+    RETRY=0
+    until mariadb -h "${DB_HOST:-mysql}" -u "${DB_USER:-whatsapp_user}" -p"${DB_PASS}" --skip-ssl -e "SELECT 1" >/dev/null 2>&1; do
+        RETRY=$((RETRY + 1))
+        if [ $RETRY -ge $MAX_RETRIES ]; then
+            echo "⚠️  MySQL no disponible después de $MAX_RETRIES intentos, continuando..."
+            break
+        fi
+        echo "   MySQL no disponible, intento $RETRY/$MAX_RETRIES..."
         sleep 2
     done
-    echo "✅ MySQL conectado"
+    if [ $RETRY -lt $MAX_RETRIES ]; then
+        echo "✅ MySQL conectado"
+    fi
+elif [ "${DB_HOST}" != "localhost" ] && [ "${DB_HOST}" != "127.0.0.1" ]; then
+    echo "ℹ️  Usando base de datos externa (${DB_HOST}), omitiendo verificación de conectividad..."
 fi
 
 # Crear directorios si no existen
@@ -30,12 +39,43 @@ mkdir -p /var/www/html/logs
 mkdir -p /var/www/html/uploads
 mkdir -p /var/cache/nginx
 mkdir -p /run/php
+mkdir -p /var/lib/nginx/tmp/client_body
+mkdir -p /var/lib/nginx/tmp/proxy
+mkdir -p /var/lib/nginx/tmp/fastcgi
+mkdir -p /var/lib/nginx/tmp/uwsgi
+mkdir -p /var/lib/nginx/tmp/scgi
 
-# Establecer permisos
+# Establecer permisos ANTES de iniciar servicios
 chown -R www:www /var/www/html/logs
 chown -R www:www /var/www/html/uploads
-chmod -R 755 /var/www/html/logs
-chmod -R 755 /var/www/html/uploads
+chmod -R 775 /var/www/html/logs
+chmod -R 775 /var/www/html/uploads
+
+# IMPORTANTE: nginx necesita acceso a sus directorios temporales
+# Usar grupo nginx para compartir acceso entre nginx y www
+chown -R nginx:nginx /var/lib/nginx
+chmod -R 775 /var/lib/nginx/tmp
+
+# Generar certificados SSL si no existen
+SSL_DIR="/etc/nginx/ssl"
+if [ ! -f "$SSL_DIR/server.crt" ] || [ ! -f "$SSL_DIR/server.key" ]; then
+    echo "🔐 Generando certificados SSL autofirmados..."
+    mkdir -p "$SSL_DIR"
+    openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
+        -keyout "$SSL_DIR/server.key" \
+        -out "$SSL_DIR/server.crt" \
+        -subj "/C=CO/ST=Cundinamarca/L=Bogota/O=U-Site/OU=WhatsApp Bot/CN=bot.u-s.app" \
+        -addext "subjectAltName=DNS:bot.u-s.app,DNS:localhost,DNS:*.u-s.app,IP:127.0.0.1" 2>/dev/null || \
+    openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
+        -keyout "$SSL_DIR/server.key" \
+        -out "$SSL_DIR/server.crt" \
+        -subj "/C=CO/ST=Cundinamarca/L=Bogota/O=U-Site/OU=WhatsApp Bot/CN=bot.u-s.app"
+    chmod 600 "$SSL_DIR/server.key"
+    chmod 644 "$SSL_DIR/server.crt"
+    echo "✅ Certificados SSL generados para bot.u-s.app"
+else
+    echo "✅ Certificados SSL existentes encontrados"
+fi
 
 # Ejecutar migraciones de BD (si existen)
 if [ -f /var/www/html/database/migrate.php ]; then

docker/fix-permissions.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+# Script para corregir permisos después de que nginx inicie
+
+sleep 2
+
+# Corregir permisos de directorios nginx
+chown -R nginx:nginx /var/lib/nginx
+chmod -R 755 /var/lib/nginx/tmp
+
+echo "✅ Permisos de nginx corregidos"

docker/nginx/nginx.conf

@@ -1,4 +1,4 @@
-user www;
+user nginx;
 worker_processes auto;
 error_log /var/log/nginx/error.log warn;
 pid /var/run/nginx.pid;

docker/nginx/ssl-prod.conf

@@ -0,0 +1,97 @@
+# Configuración HTTPS para producción con Let's Encrypt
+# Este archivo se monta en: /etc/nginx/http.d/ssl.conf
+
+# Redirigir HTTP a HTTPS
+server {
+    listen 80;
+    listen [::]:80;
+    server_name bot.u-s.app;
+    
+    # Permitir verificación de Let's Encrypt
+    location /.well-known/acme-challenge/ {
+        root /var/www/html;
+    }
+    
+    # Redirigir todo lo demás a HTTPS
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+# HTTPS Server
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name bot.u-s.app;
+
+    # Certificados SSL de Let's Encrypt
+    ssl_certificate /etc/letsencrypt/live/bot.u-s.app/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/bot.u-s.app/privkey.pem;
+    
+    # Configuración SSL moderna
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+    
+    # HSTS (descomentar en producción después de verificar que SSL funciona)
+    # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    
+    # Headers de seguridad
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    
+    # Root y configuración PHP
+    root /var/www/html;
+    index index.php index.html;
+    
+    # Tamaño máximo de upload
+    client_max_body_size 50M;
+    
+    # Logs
+    access_log /var/log/nginx/ssl_access.log;
+    error_log /var/log/nginx/ssl_error.log;
+    
+    # PHP-FPM
+    location ~ \.php$ {
+        try_files $uri =404;
+        fastcgi_split_path_info ^(.+\.php)(/.+)$;
+        fastcgi_pass unix:/run/php/php-fpm.sock;
+        fastcgi_index index.php;
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        fastcgi_param PATH_INFO $fastcgi_path_info;
+        fastcgi_param HTTPS on;
+        fastcgi_read_timeout 300;
+    }
+    
+    # API endpoints
+    location /api/ {
+        try_files $uri $uri/ /api/index.php?$query_string;
+    }
+    
+    # Webhook
+    location /webhook {
+        try_files $uri $uri/ /webhook.php?$query_string;
+    }
+    
+    # Archivos estáticos - cache agresivo
+    location ~* \.(css|js|jpg|jpeg|png|gif|ico|svg|woff|woff2|ttf|eot)$ {
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+    }
+    
+    # Denegar acceso a archivos sensibles
+    location ~ /\. {
+        deny all;
+    }
+    
+    location ~ /(config|logs|backups|database)/ {
+        deny all;
+    }
+    
+    # Fallback
+    location / {
+        try_files $uri $uri/ /index.php?$query_string;
+    }
+}

docker/nginx/ssl.conf

@@ -0,0 +1,185 @@
+# Configuración SSL para bot.u-s.app
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name bot.u-s.app localhost;
+    root /var/www/html;
+    index index.php index.html;
+
+    # SSL Certificates
+    ssl_certificate /etc/nginx/ssl/server.crt;
+    ssl_certificate_key /etc/nginx/ssl/server.key;
+
+    # SSL Configuration
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:SSL:50m;
+    ssl_session_tickets off;
+
+    # Modern TLS configuration
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers off;
+
+    # Security headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "no-referrer-when-downgrade" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+    # Logs
+    access_log /var/log/nginx/whatsapp-ssl-access.log;
+    error_log /var/log/nginx/whatsapp-ssl-error.log warn;
+
+    # Aumentar timeouts para webhook
+    fastcgi_read_timeout 300;
+    fastcgi_send_timeout 300;
+    proxy_read_timeout 300;
+    proxy_send_timeout 300;
+
+    # Root location
+    location / {
+        try_files $uri $uri/ /index.php?$query_string;
+    }
+
+    # PHP files
+    location ~ \.php$ {
+        try_files $uri =404;
+        fastcgi_split_path_info ^(.+\.php)(/.+)$;
+        fastcgi_pass 127.0.0.1:9000;
+        fastcgi_index index.php;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        include fastcgi_params;
+
+        # FastCGI buffers
+        fastcgi_buffers 16 16k;
+        fastcgi_buffer_size 32k;
+        
+        # Importante para que webhook responda rápido
+        fastcgi_buffering off;
+    }
+
+    # Webhook endpoint
+    location ~ ^/api/webhook(_optimized)?\.php$ {
+        fastcgi_pass 127.0.0.1:9000;
+        fastcgi_index webhook_optimized.php;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        include fastcgi_params;
+        
+        fastcgi_buffering off;
+        fastcgi_request_buffering off;
+        fastcgi_read_timeout 60;
+        fastcgi_send_timeout 60;
+        
+        add_header Cache-Control "no-store, no-cache, must-revalidate";
+        expires off;
+    }
+
+    # Health check endpoint
+    location /health.php {
+        fastcgi_pass 127.0.0.1:9000;
+        fastcgi_param SCRIPT_FILENAME $document_root/health.php;
+        include fastcgi_params;
+        access_log off;
+    }
+
+    # Static assets caching
+    location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|eot)$ {
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+        access_log off;
+    }
+
+    # Deny access to hidden files
+    location ~ /\. {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+
+    # Deny access to sensitive files
+    location ~ /(?:composer\.json|composer\.lock|package\.json|\.env|\.git) {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+
+    # Uploads directory
+    location ^~ /uploads/ {
+        alias /var/www/html/uploads/;
+        autoindex off;
+        
+        # Security: solo permitir ciertos tipos de archivo
+        location ~* \.(php|phtml|php3|php4|php5|pl|py|cgi|sh)$ {
+            deny all;
+        }
+    }
+
+    # SSE endpoint
+    location ~ ^/api/sse.*\.php$ {
+        fastcgi_pass 127.0.0.1:9000;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        include fastcgi_params;
+        
+        fastcgi_buffering off;
+        fastcgi_cache off;
+        proxy_buffering off;
+        chunked_transfer_encoding off;
+        
+        fastcgi_read_timeout 3600;
+        fastcgi_send_timeout 3600;
+        keepalive_timeout 3600;
+        
+        add_header Content-Type text/event-stream;
+        add_header Cache-Control no-cache;
+        add_header X-Accel-Buffering no;
+    }
+}
+
+# Redirección HTTP a HTTPS
+server {
+    listen 80;
+    listen [::]:80;
+    server_name _;
+
+    # Para desarrollo, mantener HTTP disponible
+    # Descomentar las siguientes líneas para forzar HTTPS:
+    # return 301 https://$host$request_uri;
+
+    # Por ahora, servir también en HTTP
+    root /var/www/html;
+    index index.php index.html;
+
+    location / {
+        try_files $uri $uri/ /index.php?$query_string;
+    }
+
+    location ~ \.php$ {
+        try_files $uri =404;
+        fastcgi_split_path_info ^(.+\.php)(/.+)$;
+        fastcgi_pass 127.0.0.1:9000;
+        fastcgi_index index.php;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        include fastcgi_params;
+        fastcgi_buffers 16 16k;
+        fastcgi_buffer_size 32k;
+        fastcgi_buffering off;
+    }
+
+    location /health.php {
+        fastcgi_pass 127.0.0.1:9000;
+        fastcgi_param SCRIPT_FILENAME $document_root/health.php;
+        include fastcgi_params;
+        access_log off;
+    }
+
+    location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|eot)$ {
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+        access_log off;
+    }
+
+    location ~ /\. {
+        deny all;
+    }
+}

docker/php/php-fpm.conf

@@ -21,7 +21,8 @@ php_admin_value[error_log] = /var/log/php-fpm-error.log
 
 ; Security
 ; Nota: curl_exec y curl_multi_exec son necesarios para WhatsApp API
-php_admin_value[disable_functions] = exec,passthru,shell_exec,system,proc_open,popen,parse_ini_file,show_source
+; shell_exec habilitado para conversión de medios con ffmpeg
+php_admin_value[disable_functions] = exec,passthru,system,proc_open,popen,parse_ini_file,show_source
 
 ; Performance
 request_terminate_timeout = 300s

docker/php/php.ini

@@ -20,6 +20,7 @@ date.timezone = America/Bogota
 expose_php = Off
 allow_url_fopen = On
 allow_url_include = Off
+disable_functions = 
 
 ; Session
 session.save_handler = redis

docker/scripts/generate-ssl.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+# Script para generar certificados SSL autofirmados para desarrollo
+
+SSL_DIR="/etc/nginx/ssl"
+
+# Crear directorio si no existe
+mkdir -p "$SSL_DIR"
+
+# Verificar si ya existen los certificados
+if [ -f "$SSL_DIR/server.crt" ] && [ -f "$SSL_DIR/server.key" ]; then
+    echo "✅ Certificados SSL ya existen en $SSL_DIR"
+    exit 0
+fi
+
+echo "🔐 Generando certificados SSL autofirmados para desarrollo..."
+
+# Generar clave privada y certificado autofirmado
+openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
+    -keyout "$SSL_DIR/server.key" \
+    -out "$SSL_DIR/server.crt" \
+    -subj "/C=CO/ST=Cundinamarca/L=Bogota/O=WhatsApp Bot Dev/OU=Development/CN=localhost" \
+    -addext "subjectAltName=DNS:localhost,DNS:*.localhost,IP:127.0.0.1"
+
+# Establecer permisos correctos
+chmod 600 "$SSL_DIR/server.key"
+chmod 644 "$SSL_DIR/server.crt"
+
+echo "✅ Certificados SSL generados exitosamente:"
+echo "   - Certificado: $SSL_DIR/server.crt"
+echo "   - Clave: $SSL_DIR/server.key"
+echo ""
+echo "⚠️  NOTA: Estos son certificados autofirmados para DESARROLLO."
+echo "    Los navegadores mostrarán advertencias de seguridad."
+echo "    Para producción, usa certificados de Let's Encrypt u otra CA."