gustavosantos/GTI_GERENCIADOR_FISCAL
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: publish the Hub through a reverse proxy on another host

Browse Source 
GTI terminates TLS in its Nginx Proxy Manager (10.0.10.100), not on the
Hub host, so the Hub must be reachable on the LAN — by the proxy only.

- docker-compose.prod.yml passes FORWARDED_ALLOW_IPS (uvicorn then trusts
  X-Forwarded-For/-Proto from the proxy only: real client IPs in audit and
  session records, https scheme) and WEB_COOKIE_SECURE. Defaults keep the
  previous behaviour.
- restrict_hub_port.sh + gti-fiscal-hub-port.service: Docker-published
  ports bypass UFW, so the source restriction lives in DOCKER-USER,
  matched on the conntrack original destination with --ctdir ORIGINAL,
  and is re-applied whenever docker.service starts (the chain is not
  persisted across reboots).
- *.service forced to LF like *.sh; tests cover both.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
gti
2026-09-23 07:46:11 -03:00
co-authored by Claude Opus 5.5
parent d33149f5ee
commit 91a2dda969
7 changed files with 78 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/hub/.env.example
+6
View File
@@ -8,9 +8,15 @@ POSTGRES_PASSWORD=
BASE_URL=https://fiscal.example.gti
# Interface the Hub listens on. Keep 127.0.0.1 when a reverse proxy runs on the same host; use the LAN IP only behind a firewall.
# Docker-published ports bypass UFW: restrict the source in the DOCKER-USER chain (see docs/PILOT_DEPLOYMENT.md).
HUB_BIND=127.0.0.1
HUB_PORT=8000
# IP(s) of the reverse proxy allowed to set X-Forwarded-For/-Proto (comma-separated). 127.0.0.1 = same host.
FORWARDED_ALLOW_IPS=127.0.0.1
# 1 once HTTPS terminates in front of the Hub (session/CSRF cookies become Secure).
WEB_COOKIE_SECURE=0
LOG_LEVEL=INFO
AGENT_ONLINE_THRESHOLD_SECONDS=120