up

docker/nginx/nginx.conf

@@ -1,4 +1,4 @@
-user www;
+user nginx;
 worker_processes auto;
 error_log /var/log/nginx/error.log warn;
 pid /var/run/nginx.pid;

docker/nginx/ssl-prod.conf

@@ -0,0 +1,97 @@
+# Configuración HTTPS para producción con Let's Encrypt
+# Este archivo se monta en: /etc/nginx/http.d/ssl.conf
+
+# Redirigir HTTP a HTTPS
+server {
+    listen 80;
+    listen [::]:80;
+    server_name bot.u-s.app;
+    
+    # Permitir verificación de Let's Encrypt
+    location /.well-known/acme-challenge/ {
+        root /var/www/html;
+    }
+    
+    # Redirigir todo lo demás a HTTPS
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+# HTTPS Server
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name bot.u-s.app;
+
+    # Certificados SSL de Let's Encrypt
+    ssl_certificate /etc/letsencrypt/live/bot.u-s.app/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/bot.u-s.app/privkey.pem;
+    
+    # Configuración SSL moderna
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+    
+    # HSTS (descomentar en producción después de verificar que SSL funciona)
+    # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    
+    # Headers de seguridad
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    
+    # Root y configuración PHP
+    root /var/www/html;
+    index index.php index.html;
+    
+    # Tamaño máximo de upload
+    client_max_body_size 50M;
+    
+    # Logs
+    access_log /var/log/nginx/ssl_access.log;
+    error_log /var/log/nginx/ssl_error.log;
+    
+    # PHP-FPM
+    location ~ \.php$ {
+        try_files $uri =404;
+        fastcgi_split_path_info ^(.+\.php)(/.+)$;
+        fastcgi_pass unix:/run/php/php-fpm.sock;
+        fastcgi_index index.php;
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        fastcgi_param PATH_INFO $fastcgi_path_info;
+        fastcgi_param HTTPS on;
+        fastcgi_read_timeout 300;
+    }
+    
+    # API endpoints
+    location /api/ {
+        try_files $uri $uri/ /api/index.php?$query_string;
+    }
+    
+    # Webhook
+    location /webhook {
+        try_files $uri $uri/ /webhook.php?$query_string;
+    }
+    
+    # Archivos estáticos - cache agresivo
+    location ~* \.(css|js|jpg|jpeg|png|gif|ico|svg|woff|woff2|ttf|eot)$ {
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+    }
+    
+    # Denegar acceso a archivos sensibles
+    location ~ /\. {
+        deny all;
+    }
+    
+    location ~ /(config|logs|backups|database)/ {
+        deny all;
+    }
+    
+    # Fallback
+    location / {
+        try_files $uri $uri/ /index.php?$query_string;
+    }
+}

docker/nginx/ssl.conf

@@ -0,0 +1,185 @@
+# Configuración SSL para bot.u-s.app
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name bot.u-s.app localhost;
+    root /var/www/html;
+    index index.php index.html;
+
+    # SSL Certificates
+    ssl_certificate /etc/nginx/ssl/server.crt;
+    ssl_certificate_key /etc/nginx/ssl/server.key;
+
+    # SSL Configuration
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:SSL:50m;
+    ssl_session_tickets off;
+
+    # Modern TLS configuration
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers off;
+
+    # Security headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "no-referrer-when-downgrade" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+    # Logs
+    access_log /var/log/nginx/whatsapp-ssl-access.log;
+    error_log /var/log/nginx/whatsapp-ssl-error.log warn;
+
+    # Aumentar timeouts para webhook
+    fastcgi_read_timeout 300;
+    fastcgi_send_timeout 300;
+    proxy_read_timeout 300;
+    proxy_send_timeout 300;
+
+    # Root location
+    location / {
+        try_files $uri $uri/ /index.php?$query_string;
+    }
+
+    # PHP files
+    location ~ \.php$ {
+        try_files $uri =404;
+        fastcgi_split_path_info ^(.+\.php)(/.+)$;
+        fastcgi_pass 127.0.0.1:9000;
+        fastcgi_index index.php;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        include fastcgi_params;
+
+        # FastCGI buffers
+        fastcgi_buffers 16 16k;
+        fastcgi_buffer_size 32k;
+        
+        # Importante para que webhook responda rápido
+        fastcgi_buffering off;
+    }
+
+    # Webhook endpoint
+    location ~ ^/api/webhook(_optimized)?\.php$ {
+        fastcgi_pass 127.0.0.1:9000;
+        fastcgi_index webhook_optimized.php;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        include fastcgi_params;
+        
+        fastcgi_buffering off;
+        fastcgi_request_buffering off;
+        fastcgi_read_timeout 60;
+        fastcgi_send_timeout 60;
+        
+        add_header Cache-Control "no-store, no-cache, must-revalidate";
+        expires off;
+    }
+
+    # Health check endpoint
+    location /health.php {
+        fastcgi_pass 127.0.0.1:9000;
+        fastcgi_param SCRIPT_FILENAME $document_root/health.php;
+        include fastcgi_params;
+        access_log off;
+    }
+
+    # Static assets caching
+    location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|eot)$ {
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+        access_log off;
+    }
+
+    # Deny access to hidden files
+    location ~ /\. {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+
+    # Deny access to sensitive files
+    location ~ /(?:composer\.json|composer\.lock|package\.json|\.env|\.git) {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+
+    # Uploads directory
+    location ^~ /uploads/ {
+        alias /var/www/html/uploads/;
+        autoindex off;
+        
+        # Security: solo permitir ciertos tipos de archivo
+        location ~* \.(php|phtml|php3|php4|php5|pl|py|cgi|sh)$ {
+            deny all;
+        }
+    }
+
+    # SSE endpoint
+    location ~ ^/api/sse.*\.php$ {
+        fastcgi_pass 127.0.0.1:9000;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        include fastcgi_params;
+        
+        fastcgi_buffering off;
+        fastcgi_cache off;
+        proxy_buffering off;
+        chunked_transfer_encoding off;
+        
+        fastcgi_read_timeout 3600;
+        fastcgi_send_timeout 3600;
+        keepalive_timeout 3600;
+        
+        add_header Content-Type text/event-stream;
+        add_header Cache-Control no-cache;
+        add_header X-Accel-Buffering no;
+    }
+}
+
+# Redirección HTTP a HTTPS
+server {
+    listen 80;
+    listen [::]:80;
+    server_name _;
+
+    # Para desarrollo, mantener HTTP disponible
+    # Descomentar las siguientes líneas para forzar HTTPS:
+    # return 301 https://$host$request_uri;
+
+    # Por ahora, servir también en HTTP
+    root /var/www/html;
+    index index.php index.html;
+
+    location / {
+        try_files $uri $uri/ /index.php?$query_string;
+    }
+
+    location ~ \.php$ {
+        try_files $uri =404;
+        fastcgi_split_path_info ^(.+\.php)(/.+)$;
+        fastcgi_pass 127.0.0.1:9000;
+        fastcgi_index index.php;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        include fastcgi_params;
+        fastcgi_buffers 16 16k;
+        fastcgi_buffer_size 32k;
+        fastcgi_buffering off;
+    }
+
+    location /health.php {
+        fastcgi_pass 127.0.0.1:9000;
+        fastcgi_param SCRIPT_FILENAME $document_root/health.php;
+        include fastcgi_params;
+        access_log off;
+    }
+
+    location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|eot)$ {
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+        access_log off;
+    }
+
+    location ~ /\. {
+        deny all;
+    }
+}