Reverse Proxy — nginx (10.100.1.24 / proxy.lan)

Dokumentasi infrastruktur reverse-proxy untuk AI Agent. Bukan sumber kebenaran config live — selalu verifikasi di server.

Peran server

Item	Nilai
Host	`proxy.lan` / `10.100.1.24`
SSH	`ssh reverse-proxy` atau `ssh -m hmac-sha1 root@10.100.1.24 -p 22`
Stack	nginx 1.27, Docker (Dockge `/opt/stacks/`)
Sertifikat wildcard	`/home/ssl-gisportal/gisportal.id-fullchain.pem`
Sertifikat geonet	`/etc/nginx/sslgeonet.co.id/`

DNS (MikroTik split-DNS — 10.100.1.1)

Pattern / name	Target	Keterangan
`^dev\.gisportal\.id`	`10.100.1.51`	Dev IIS — tidak lewat reverse-proxy
`\.gisportal\.id` (catch-all)	`10.100.1.24`	Semua subdomain lain
`iguf.geonet.co.id`	`10.100.1.24`	vhost terpisah (`geonet.iguf.conf`)

DNS publik:

Domain	IP publik	NAT →
`dev.gisportal.id`	`117.102.73.100`	`10.100.1.51:443`
`*.gisportal.id` (umum)	`117.102.73.102`	`10.100.1.24:443`
`iguf.geonet.co.id`	`117.102.73.99`	`10.100.1.24:443`

Struktur nginx

/etc/nginx/nginx.conf
  include conf.d/*.conf
  include conf.d/production/*.conf
  include conf.d/development/*.conf

Path	Fungsi
`conf.d/ssl.conf`	Template SSL global (di-include vhost HTTPS)
`conf.d/default-wildcard.conf`	`server_name _` → redirect `app.gisportal.id/support-portal/`
`conf.d/production/`	vhost produksi
`conf.d/development/`	vhost development
`conf.d/nonaktif/`	Tidak diload — config lama

Domain kunci (verified 2026-06-17)

Domain	Config	Backend
`iguf.geonet.co.id`	`conf.d/geonet.iguf.conf`	`https://10.100.1.41:1443/iguf/`
`file.gisportal.id`	`conf.d/nas.conf`	`https://10.100.1.10` (QNAP)
`git.gisportal.id`	`conf.d/production/git.conf`	`http://10.100.1.41:3000` (Gitea)
`dev.gisportal.id`	(nonaktif di nginx)	Langsung `10.100.1.51` via DNS

SSL / HTTP2 (penting)

Browser modern (Edge/Chrome) memakai HTTP/2. Cipher berikut dilarang untuk HTTP/2:

RC4, SSLv3, cipher lemah lainnya

Setting saat ini (ssl.conf, sejak 2026-06-17):

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:...;
ssl_prefer_server_ciphers off;

Backup sebelum perubahan: ssl.conf.bak.20260617

Gejala jika SSL salah: ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY di browser; curl HTTP/1.1 masih 200.

Reload nginx

nginx -t && nginx -s reload

Subdomain tanpa vhost

Jika subdomain resolve ke 10.100.1.24 tetapi tidak ada server_name di nginx → kena default-wildcard.conf (redirect support-portal). Contoh yang pernah bermasalah: iguf.gisportal.id (domain aktif: iguf.geonet.co.id).

2.9 KiB Raw Blame History