# Progress — server-audit

**Fase aktif:** Fase 0 — Blueprint (POC collect-only)  
**Terakhir diupdate:** 2026-06-17

## Milestone selesai

### [2026-06-17] Perbaikan akses domain reverse-proxy (MikroTik + nginx)

**Status:** ✅ Diverifikasi user — akses lokal & publik normal kembali.

| Domain / scope | Status | Catatan |
|----------------|--------|---------|
| `iguf.geonet.co.id` | ✅ | vhost `geonet.iguf.conf` → `10.100.1.41:1443/iguf/` |
| `*.gisportal.id` (subdomain dengan vhost nginx aktif) | ✅ | Termasuk `git.gisportal.id`, `file.gisportal.id`, dll. |
| `dev.gisportal.id` | ✅ | Bypass reverse-proxy — DNS langsung ke `10.100.1.51` (IIS) |

**Akar masalah utama:** `ssl.conf` nginx memakai `SSLv3` + cipher `RC4` → browser (HTTP/2) error `ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY`. `curl` HTTP/1.1 tidak terpengaruh.

**Perubahan di `10.100.1.24` (reverse-proxy):**

1. `/etc/nginx/conf.d/ssl.conf` — TLSv1.2/1.3, cipher GCM (backup: `ssl.conf.bak.20260617`)
2. `/etc/nginx/conf.d/nas.conf` — `file.gisportal.id`: proxy HTTPS ke QNAP, redirect `/` → `/cgi-bin/login.html`
3. `/etc/nginx/conf.d/production/git.conf` — proxy headers + redirect HTTP→HTTPS

**Detail teknis:** lihat `.cursor/infra-reverse-proxy.md` dan ADR `001-ssl-http2-reverse-proxy.md`.

**Outstanding (opsional):**

- [ ] `ROOT_URL` Gitea di `10.100.1.41` masih `http://git.gisportal.id/` — ubah ke `https://` di `app.ini`
- [ ] Subdomain tanpa vhost nginx tetap kena `default-wildcard.conf` → redirect `app.gisportal.id/support-portal/`
- [ ] `iguf.gisportal.id` belum punya vhost (gunakan `iguf.geonet.co.id`)

## Checklist fase 0 (berkelanjutan)

- [x] Audit konektivitas MikroTik + reverse-proxy
- [x] Dokumentasi perbaikan nginx/SSL di `.cursor/`
- [ ] Blueprint lengkap (`.cursor/blueprint.md`)
- [ ] Profil infrastruktur (`.cursor/me.md`)