AUDIT APLIKASI — REVERSE PROXY
==============================
Tanggal audit : 2026-06-10
Sumber        : server/host.txt
Metode        : SSH langsung

IP/SSH   : 10.100.1.24  |  ssh -m hmac-sha1 root@10.100.1.24 -p 22
Hostname : proxy.lan
OS       : CentOS Linux 8
Uptime   : ~78 hari
Resource : RAM 15 GiB (avail ~8.6 GiB) | Disk / 50G (32% terpakai)

Peran host: gateway HTTPS, manajemen Docker (Dockge), monitoring, automation,
dan reverse proxy ke infrastruktur lain (Proxmox, VMware, Zabbix, IIS, Tomcat, dll).


A. LAYANAN NATIVE (systemd, bukan Docker)
-----------------------------------------
| Layanan            | Fungsi                                      |
|--------------------|---------------------------------------------|
| nginx              | Reverse proxy HTTPS → backend internal      |
| php-fpm (7.2.24)   | PHP FastCGI untuk situs native di host      |
| mosquitto          | MQTT broker                                 |
| zabbix-agent       | Monitoring agent (Zabbix 4.4 release)     |
| vncserver@:1       | Remote desktop VNC                          |
| docker             | Container runtime (Docker CE 26.1.3)        |

Versi penting:
  - nginx/1.27.0
  - PHP 7.2.24 (cli)
  - Docker 26.1.3 + docker compose plugin 2.27.0


B. DOCKER CONTAINER (semua di /opt/stacks/)
-------------------------------------------
| Container          | Image                         | Status   | Port host              | Domain (Nginx)                    |
|--------------------|-------------------------------|----------|------------------------|-----------------------------------|
| geonet-console     | geonet-console:latest         | healthy  | 127.0.0.1:8091→80      | console.gisportal.id              |
| sqlservercheck     | sqlservercheck:latest         | healthy  | 127.0.0.1:8090→80      | sqlservercheck.gisportal.id       |
| dockge-dockge-1    | louislam/dockge:1             | healthy  | 0.0.0.0:5001→5001      | dockge.gisportal.id               |
| grafana-web        | grafana/grafana:10.4.2        | healthy  | 0.0.0.0:3000→3000      | grafana.gisportal.id              |
| grafana-loki       | grafana/loki:2.9.4            | healthy  | 0.0.0.0:3100→3100      | (internal logging)                |
| grafana-promtail   | grafana/promtail:2.9.4        | running  | —                      | (log shipper)                     |
| uptime-kuma        | louislam/uptime-kuma:1        | healthy  | 0.0.0.0:3001→3001      | uptime.gisportal.id               |
| n8n                | docker.n8n.io/n8nio/n8n       | healthy  | 0.0.0.0:5678→5678      | n8n.gisportal.id                  |
| node-red           | nodered/node-red:latest       | healthy  | 0.0.0.0:1880→1880      | node-red.gisportal.id             |
| simple-web         | ghcr.io/rianjawa93/simple-web | healthy  | 0.0.0.0:8088→80        | simple-web.gisportal.id           |
| nginx-config-check | nginx:1.27-alpine             | healthy  | —                      | (validasi config nginx)           |

Folder stack: /opt/stacks/
  geonet-console, sqlservercheck, grafana, n8n, node-red,
  simple-web, uptime-kuma, nginx-config-check


C. NGINX REVERSE PROXY (39+ virtual host)
-----------------------------------------
Nginx mem-proxy domain *.gisportal.id ke berbagai backend (Docker, VM, IIS, dll).
Contoh domain terdaftar:

  acunetix, adfs, apache, apimobile, app, arc, asset, asset.opr,
  databaselist, dockge, explore, git, grafana, help, hse, iis,
  laragon, maps, martin, monitor, n8n, node-red, proxmox, pve00/01/02,
  rpm, rwa, sfile, simp, simple-web, speed, sqlservercheck, stream,
  todo, tomcat, uptime, vmware, wsp, zabbix

Config lokasi: /etc/nginx/conf.d/production/*.conf


D. STACK DARI PROJECT server-connection (repo lokal)
----------------------------------------------------
| Stack          | Path di server              | URL publik                              | Koneksi DB        |
|----------------|-----------------------------|-----------------------------------------|-------------------|
| geonet-console | /opt/stacks/geonet-console/ | https://console.gisportal.id            | MSSQL 10.100.1.25 |
| (legacy 301)   | databaselist.gisportal.id   | redirect → console.gisportal.id         | —                 |
| sqlservercheck | /opt/stacks/sqlservercheck/ | https://sqlservercheck.gisportal.id     | MSSQL 10.100.1.25 |

  - geonet-console  : Geonet Console — database, LDAP, API, audit
  - sqlservercheck: PHP test koneksi TS (/ts) & NTS (/nts), dipantau Uptime Kuma
  - Keduanya bind ke 127.0.0.1 saja; akses publik hanya via Nginx + HTTPS


E. ANALISA & CATATAN
--------------------
Catatan:
  - PHP 7.2 sudah EOL; pertimbangkan upgrade jika masih dipakai produksi.
  - Beberapa container expose port ke 0.0.0.0 (3000, 3001, 5678, 1880, 8088, 5001).
    Pastikan firewall Mikrotik membatasi akses langsung ke port tersebut.
  - geonet-console & sqlservercheck aman: hanya 127.0.0.1, wajib lewat Nginx.


PERINTAH VERIFIKASI ULANG
-------------------------
# Semua container Docker
ssh -m hmac-sha1 root@10.100.1.24 -p 22 "docker ps -a"

# Stack server-connection
ssh -m hmac-sha1 root@10.100.1.24 -p 22 "ls /opt/stacks/geonet-console /opt/stacks/sqlservercheck"

# Status stack geonet-console
ssh -m hmac-sha1 root@10.100.1.24 -p 22 "cd /opt/stacks/geonet-console && docker compose ps"

# Status stack sqlservercheck
ssh -m hmac-sha1 root@10.100.1.24 -p 22 "cd /opt/stacks/sqlservercheck && docker compose ps"

# Daftar domain nginx
ssh -m hmac-sha1 root@10.100.1.24 -p 22 "grep -rh server_name /etc/nginx/conf.d/production/*.conf | grep -v '#' | sort -u"