feat: Produktions-Deployment mit Nginx und SSL
- docker-compose-prod.yml: Produktionsumgebung mit Nginx Reverse Proxy - nginx/nginx.conf: Optimierte Nginx-Konfiguration mit SSL und Sicherheits-Headers - Rate Limiting für API-Endpunkte (10/s) und Login (5/min) - Automatische SSL-Zertifikate via Let's Encrypt/Certbot - Gzip-Kompression und Performance-Optimierungen Setup-Scripts: - scripts/setup-ssl.sh: Bash-Script für Linux/macOS - scripts/setup-ssl.ps1: PowerShell-Script für Windows - Automatische Domain-Konfiguration aus .env (DOMAIN, ADMIN_EMAIL) - Ein-Klick-Setup für SSL-Zertifikate Dokumentation: - docs/production-deployment.md: Vollständige Deployment-Anleitung - Troubleshooting, Monitoring, Backup-Strategien - Sicherheitsempfehlungen und Best Practices Features: - Automatische SSL-Zertifikat-Erneuerung (alle 12h) - HSTS, CSP, XSS-Schutz - Health Checks und Monitoring - Persistente Daten über Docker Volumes
This commit is contained in:
259
docs/production-deployment.md
Normal file
259
docs/production-deployment.md
Normal file
@@ -0,0 +1,259 @@
|
||||
# Produktions-Deployment für Stargirlnails Kiel
|
||||
|
||||
Diese Anleitung beschreibt das Deployment der Stargirlnails Kiel Buchungsanwendung in einer produktiven Umgebung mit SSL-Zertifikaten.
|
||||
|
||||
## 🏗️ Architektur
|
||||
|
||||
```
|
||||
Internet → Nginx (Port 80/443) → Stargirlnails App (Port 3000)
|
||||
↓
|
||||
Certbot (SSL-Zertifikate)
|
||||
```
|
||||
|
||||
### Services:
|
||||
- **stargirlnails**: Hauptanwendung
|
||||
- **nginx**: Reverse Proxy mit SSL-Terminierung
|
||||
- **certbot**: Automatische SSL-Zertifikat-Verwaltung
|
||||
|
||||
## 📋 Voraussetzungen
|
||||
|
||||
### Server-Anforderungen:
|
||||
- **OS**: Linux (Ubuntu 20.04+ empfohlen)
|
||||
- **RAM**: Mindestens 2GB
|
||||
- **CPU**: Mindestens 1 Core
|
||||
- **Speicher**: Mindestens 10GB freier Speicher
|
||||
- **Ports**: 80, 443 müssen erreichbar sein
|
||||
|
||||
### Software:
|
||||
- Docker & Docker Compose installiert
|
||||
- Git installiert
|
||||
|
||||
### Domain-Konfiguration:
|
||||
- Domain muss auf Server-IP zeigen
|
||||
- DNS-A-Eintrag korrekt konfiguriert
|
||||
|
||||
## 🚀 Deployment
|
||||
|
||||
### 1. Repository klonen
|
||||
```bash
|
||||
git clone <repository-url>
|
||||
cd mybeautybooking
|
||||
```
|
||||
|
||||
### 2. Umgebungsvariablen konfigurieren
|
||||
```bash
|
||||
cp .env.example .env
|
||||
nano .env
|
||||
```
|
||||
|
||||
**Wichtige Variablen für Produktion:**
|
||||
```env
|
||||
# Domain-Konfiguration (ERFORDERLICH für SSL)
|
||||
DOMAIN=stargirlnails.de
|
||||
|
||||
# Admin-Konfiguration (ERFORDERLICH für SSL)
|
||||
ADMIN_EMAIL=admin@stargirlnails.de
|
||||
|
||||
# E-Mail-Konfiguration
|
||||
RESEND_API_KEY=your_resend_api_key_here
|
||||
EMAIL_FROM=noreply@stargirlnails.de
|
||||
|
||||
# Produktionsmodus
|
||||
NODE_ENV=production
|
||||
```
|
||||
|
||||
### 3. SSL-Setup und Deployment
|
||||
```bash
|
||||
# Linux/macOS
|
||||
chmod +x scripts/setup-ssl.sh
|
||||
./scripts/setup-ssl.sh
|
||||
|
||||
# Windows (PowerShell)
|
||||
.\scripts\setup-ssl.ps1
|
||||
```
|
||||
|
||||
Das Script:
|
||||
- ✅ Erstellt Docker Volumes
|
||||
- ✅ Konfiguriert Nginx mit der Domain
|
||||
- ✅ Erstellt SSL-Zertifikat via Let's Encrypt
|
||||
- ✅ Startet alle Services
|
||||
|
||||
### 4. Verifikation
|
||||
```bash
|
||||
# Service-Status prüfen
|
||||
docker-compose -f docker-compose-prod.yml ps
|
||||
|
||||
# Logs anzeigen
|
||||
docker-compose -f docker-compose-prod.yml logs -f
|
||||
|
||||
# SSL-Zertifikat prüfen
|
||||
curl -I https://your-domain.com
|
||||
```
|
||||
|
||||
## 🔧 Verwaltung
|
||||
|
||||
### Service-Befehle
|
||||
```bash
|
||||
# Services starten
|
||||
docker-compose -f docker-compose-prod.yml up -d
|
||||
|
||||
# Services stoppen
|
||||
docker-compose -f docker-compose-prod.yml down
|
||||
|
||||
# Logs anzeigen
|
||||
docker-compose -f docker-compose-prod.yml logs -f
|
||||
|
||||
# Einzelnen Service neu starten
|
||||
docker-compose -f docker-compose-prod.yml restart stargirlnails
|
||||
```
|
||||
|
||||
### SSL-Zertifikat-Verwaltung
|
||||
```bash
|
||||
# Zertifikat manuell erneuern
|
||||
docker-compose -f docker-compose-prod.yml run --rm certbot certbot renew
|
||||
|
||||
# Zertifikat-Status prüfen
|
||||
docker-compose -f docker-compose-prod.yml run --rm certbot certbot certificates
|
||||
```
|
||||
|
||||
**Automatische Erneuerung**: Certbot erneuert Zertifikate automatisch alle 12 Stunden.
|
||||
|
||||
### Updates
|
||||
```bash
|
||||
# Code aktualisieren
|
||||
git pull origin main
|
||||
|
||||
# Neues Image bauen und starten
|
||||
docker-compose -f docker-compose-prod.yml up -d --build
|
||||
|
||||
# Alte Images aufräumen
|
||||
docker image prune -f
|
||||
```
|
||||
|
||||
## 🔒 Sicherheit
|
||||
|
||||
### Nginx-Sicherheitsfeatures:
|
||||
- ✅ **SSL/TLS**: TLS 1.2+ mit modernen Ciphern
|
||||
- ✅ **HSTS**: Strict Transport Security Header
|
||||
- ✅ **Rate Limiting**: API-Endpunkte geschützt
|
||||
- ✅ **Security Headers**: XSS, CSRF, Clickjacking-Schutz
|
||||
- ✅ **Gzip-Kompression**: Optimierte Performance
|
||||
|
||||
### Rate Limits:
|
||||
- **API-Endpunkte**: 10 Anfragen/Sekunde
|
||||
- **Login-Endpunkte**: 5 Anfragen/Minute
|
||||
|
||||
### Firewall-Empfehlung:
|
||||
```bash
|
||||
# UFW (Ubuntu)
|
||||
sudo ufw allow 22/tcp # SSH
|
||||
sudo ufw allow 80/tcp # HTTP
|
||||
sudo ufw allow 443/tcp # HTTPS
|
||||
sudo ufw enable
|
||||
```
|
||||
|
||||
## 📊 Monitoring
|
||||
|
||||
### Health Checks:
|
||||
```bash
|
||||
# Anwendungs-Health-Check
|
||||
curl https://your-domain.com/health
|
||||
|
||||
# SSL-Zertifikat-Status
|
||||
openssl s_client -connect your-domain.com:443 -servername your-domain.com
|
||||
```
|
||||
|
||||
### Logs überwachen:
|
||||
```bash
|
||||
# Alle Logs
|
||||
docker-compose -f docker-compose-prod.yml logs -f
|
||||
|
||||
# Nur Anwendungs-Logs
|
||||
docker-compose -f docker-compose-prod.yml logs -f stargirlnails
|
||||
|
||||
# Nur Nginx-Logs
|
||||
docker-compose -f docker-compose-prod.yml logs -f nginx
|
||||
```
|
||||
|
||||
### Ressourcen-Monitoring:
|
||||
```bash
|
||||
# Container-Ressourcen
|
||||
docker stats
|
||||
|
||||
# Disk-Usage
|
||||
docker system df
|
||||
```
|
||||
|
||||
## 🚨 Troubleshooting
|
||||
|
||||
### Häufige Probleme:
|
||||
|
||||
#### SSL-Zertifikat kann nicht erstellt werden
|
||||
```bash
|
||||
# Prüfe Domain-Erreichbarkeit
|
||||
curl -I http://your-domain.com
|
||||
|
||||
# Prüfe DNS-Einträge
|
||||
nslookup your-domain.com
|
||||
|
||||
# Prüfe Port 80
|
||||
telnet your-domain.com 80
|
||||
```
|
||||
|
||||
#### Services starten nicht
|
||||
```bash
|
||||
# Detaillierte Logs
|
||||
docker-compose -f docker-compose-prod.yml logs
|
||||
|
||||
# Container-Status
|
||||
docker-compose -f docker-compose-prod.yml ps
|
||||
|
||||
# Volumes prüfen
|
||||
docker volume ls
|
||||
```
|
||||
|
||||
#### Performance-Probleme
|
||||
```bash
|
||||
# Ressourcen-Check
|
||||
docker stats
|
||||
|
||||
# Nginx-Logs prüfen
|
||||
docker-compose -f docker-compose-prod.yml logs nginx | grep -i error
|
||||
```
|
||||
|
||||
### Log-Dateien:
|
||||
- **Anwendung**: `docker-compose logs stargirlnails`
|
||||
- **Nginx**: `docker-compose logs nginx`
|
||||
- **Certbot**: `docker-compose logs certbot`
|
||||
|
||||
## 🔄 Backup & Wiederherstellung
|
||||
|
||||
### Daten-Backup:
|
||||
```bash
|
||||
# Storage-Daten sichern
|
||||
tar -czf backup-$(date +%Y%m%d).tar.gz .storage/
|
||||
|
||||
# SSL-Zertifikate sichern
|
||||
docker run --rm -v certbot-certs:/data -v $(pwd):/backup alpine tar czf /backup/ssl-backup-$(date +%Y%m%d).tar.gz -C /data .
|
||||
```
|
||||
|
||||
### Wiederherstellung:
|
||||
```bash
|
||||
# Storage-Daten wiederherstellen
|
||||
tar -xzf backup-YYYYMMDD.tar.gz
|
||||
|
||||
# SSL-Zertifikate wiederherstellen
|
||||
docker run --rm -v certbot-certs:/data -v $(pwd):/backup alpine tar xzf /backup/ssl-backup-YYYYMMDD.tar.gz -C /data
|
||||
```
|
||||
|
||||
## 📞 Support
|
||||
|
||||
Bei Problemen:
|
||||
1. Prüfe die Logs: `docker-compose -f docker-compose-prod.yml logs`
|
||||
2. Prüfe den Service-Status: `docker-compose -f docker-compose-prod.yml ps`
|
||||
3. Prüfe die Dokumentation in `docs/`
|
||||
4. Erstelle ein Issue im Repository
|
||||
|
||||
---
|
||||
|
||||
**Wichtiger Hinweis**: Diese Konfiguration ist für Produktionsumgebungen optimiert. Für Entwicklung verwende `docker-compose.yml`.
|
||||
Reference in New Issue
Block a user