You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
106 lines
5.5 KiB
106 lines
5.5 KiB
AUDIT APLIKASI — REVERSE PROXY |
|
============================== |
|
Tanggal audit : 2026-06-10 |
|
Sumber : server/host.txt |
|
Metode : SSH langsung |
|
|
|
IP/SSH : 10.100.1.24 | ssh -m hmac-sha1 root@10.100.1.24 -p 22 |
|
Hostname : proxy.lan |
|
OS : CentOS Linux 8 |
|
Uptime : ~78 hari |
|
Resource : RAM 15 GiB (avail ~8.6 GiB) | Disk / 50G (32% terpakai) |
|
|
|
Peran host: gateway HTTPS, manajemen Docker (Dockge), monitoring, automation, |
|
dan reverse proxy ke infrastruktur lain (Proxmox, VMware, Zabbix, IIS, Tomcat, dll). |
|
|
|
|
|
A. LAYANAN NATIVE (systemd, bukan Docker) |
|
----------------------------------------- |
|
| Layanan | Fungsi | |
|
|--------------------|---------------------------------------------| |
|
| nginx | Reverse proxy HTTPS → backend internal | |
|
| php-fpm (7.2.24) | PHP FastCGI untuk situs native di host | |
|
| mosquitto | MQTT broker | |
|
| zabbix-agent | Monitoring agent (Zabbix 4.4 release) | |
|
| vncserver@:1 | Remote desktop VNC | |
|
| docker | Container runtime (Docker CE 26.1.3) | |
|
|
|
Versi penting: |
|
- nginx/1.27.0 |
|
- PHP 7.2.24 (cli) |
|
- Docker 26.1.3 + docker compose plugin 2.27.0 |
|
|
|
|
|
B. DOCKER CONTAINER (semua di /opt/stacks/) |
|
------------------------------------------- |
|
| Container | Image | Status | Port host | Domain (Nginx) | |
|
|--------------------|-------------------------------|----------|------------------------|-----------------------------------| |
|
| geonet-console | geonet-console:latest | healthy | 127.0.0.1:8091→80 | console.gisportal.id | |
|
| sqlservercheck | sqlservercheck:latest | healthy | 127.0.0.1:8090→80 | sqlservercheck.gisportal.id | |
|
| dockge-dockge-1 | louislam/dockge:1 | healthy | 0.0.0.0:5001→5001 | dockge.gisportal.id | |
|
| grafana-web | grafana/grafana:10.4.2 | healthy | 0.0.0.0:3000→3000 | grafana.gisportal.id | |
|
| grafana-loki | grafana/loki:2.9.4 | healthy | 0.0.0.0:3100→3100 | (internal logging) | |
|
| grafana-promtail | grafana/promtail:2.9.4 | running | — | (log shipper) | |
|
| uptime-kuma | louislam/uptime-kuma:1 | healthy | 0.0.0.0:3001→3001 | uptime.gisportal.id | |
|
| n8n | docker.n8n.io/n8nio/n8n | healthy | 0.0.0.0:5678→5678 | n8n.gisportal.id | |
|
| node-red | nodered/node-red:latest | healthy | 0.0.0.0:1880→1880 | node-red.gisportal.id | |
|
| simple-web | ghcr.io/rianjawa93/simple-web | healthy | 0.0.0.0:8088→80 | simple-web.gisportal.id | |
|
| nginx-config-check | nginx:1.27-alpine | healthy | — | (validasi config nginx) | |
|
|
|
Folder stack: /opt/stacks/ |
|
geonet-console, sqlservercheck, grafana, n8n, node-red, |
|
simple-web, uptime-kuma, nginx-config-check |
|
|
|
|
|
C. NGINX REVERSE PROXY (39+ virtual host) |
|
----------------------------------------- |
|
Nginx mem-proxy domain *.gisportal.id ke berbagai backend (Docker, VM, IIS, dll). |
|
Contoh domain terdaftar: |
|
|
|
acunetix, adfs, apache, apimobile, app, arc, asset, asset.opr, |
|
databaselist, dockge, explore, git, grafana, help, hse, iis, |
|
laragon, maps, martin, monitor, n8n, node-red, proxmox, pve00/01/02, |
|
rpm, rwa, sfile, simp, simple-web, speed, sqlservercheck, stream, |
|
todo, tomcat, uptime, vmware, wsp, zabbix |
|
|
|
Config lokasi: /etc/nginx/conf.d/production/*.conf |
|
|
|
|
|
D. STACK DARI PROJECT server-connection (repo lokal) |
|
---------------------------------------------------- |
|
| Stack | Path di server | URL publik | Koneksi DB | |
|
|----------------|-----------------------------|-----------------------------------------|-------------------| |
|
| geonet-console | /opt/stacks/geonet-console/ | https://console.gisportal.id | MSSQL 10.100.1.25 | |
|
| (legacy 301) | databaselist.gisportal.id | redirect → console.gisportal.id | — | |
|
| sqlservercheck | /opt/stacks/sqlservercheck/ | https://sqlservercheck.gisportal.id | MSSQL 10.100.1.25 | |
|
|
|
- geonet-console : Geonet Console — database, LDAP, API, audit |
|
- sqlservercheck: PHP test koneksi TS (/ts) & NTS (/nts), dipantau Uptime Kuma |
|
- Keduanya bind ke 127.0.0.1 saja; akses publik hanya via Nginx + HTTPS |
|
|
|
|
|
E. ANALISA & CATATAN |
|
-------------------- |
|
Catatan: |
|
- PHP 7.2 sudah EOL; pertimbangkan upgrade jika masih dipakai produksi. |
|
- Beberapa container expose port ke 0.0.0.0 (3000, 3001, 5678, 1880, 8088, 5001). |
|
Pastikan firewall Mikrotik membatasi akses langsung ke port tersebut. |
|
- geonet-console & sqlservercheck aman: hanya 127.0.0.1, wajib lewat Nginx. |
|
|
|
|
|
PERINTAH VERIFIKASI ULANG |
|
------------------------- |
|
# Semua container Docker |
|
ssh -m hmac-sha1 root@10.100.1.24 -p 22 "docker ps -a" |
|
|
|
# Stack server-connection |
|
ssh -m hmac-sha1 root@10.100.1.24 -p 22 "ls /opt/stacks/geonet-console /opt/stacks/sqlservercheck" |
|
|
|
# Status stack geonet-console |
|
ssh -m hmac-sha1 root@10.100.1.24 -p 22 "cd /opt/stacks/geonet-console && docker compose ps" |
|
|
|
# Status stack sqlservercheck |
|
ssh -m hmac-sha1 root@10.100.1.24 -p 22 "cd /opt/stacks/sqlservercheck && docker compose ps" |
|
|
|
# Daftar domain nginx |
|
ssh -m hmac-sha1 root@10.100.1.24 -p 22 "grep -rh server_name /etc/nginx/conf.d/production/*.conf | grep -v '#' | sort -u"
|
|
|