LDAPWeb/nginx/docs/server.md

Server — nginx

Last updated: 2026-07-06
Config live di server — verifikasi via SSH sebelum mengandalkan docs.

Item	Nilai
Host	proxy.lan / 10.100.1.24
SSH	ssh reverse-proxy
nginx	1.27
SSL wildcard	/home/ssl-gisportal/gisportal.id-fullchain.pem
SSL geonet	/etc/nginx/sslgeonet.co.id/
Docker stacks	/opt/stacks/ (Dockge)

---

Struktur config

/etc/nginx/nginx.conf
  include conf.d/*.conf
  include conf.d/production/*.conf
  include conf.d/development/*.conf

Path	Fungsi
conf.d/ssl.conf	SSL global
conf.d/default-wildcard.conf	catch-all → redirect support-portal
conf.d/production/	vhost produksi
conf.d/development/	vhost dev
conf.d/nonaktif/	tidak diload

Reload: nginx -t && nginx -s reload

---

DNS (split-DNS MikroTik 10.100.1.1)

Pattern	Target	Catatan
^dev\.gisportal\.id	10.100.1.51	bypass reverse-proxy
\.gisportal\.id	10.100.1.24	catch-all
iguf.geonet.co.id	10.100.1.24	geonet.iguf.conf

DNS publik:

Domain	IP publik	NAT →
dev.gisportal.id	117.102.73.100	10.100.1.51:443
*.gisportal.id	117.102.73.102	10.100.1.24:443
iguf.geonet.co.id	117.102.73.99	10.100.1.24:443
sync.geonet.co.id	117.102.73.102	10.100.1.24:443 → 10.100.1.28

---

Domain kunci

Domain	Backend
console.gisportal.id	geonet-console Docker
my.gisportal.id	mysupperapps FE
zammad.gisportal.id	127.0.0.1:8093
sync.geonet.co.id	https://10.100.1.28:443
agent.gisportal.id	GeoNetAgent collector
file.gisportal.id	QNAP 10.100.1.10
git.gisportal.id	Gitea 10.100.1.41:3000
dockge.gisportal.id	Dockge UI

Template vhost di repo app: Mailcow/infra/nginx/, Zammad/infra/nginx/, GeoNetAgent/infra/nginx/.

---

SSL / HTTP2

Cipher lemah (RC4, SSLv3) → ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY.

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;

---

Mapping ke monorepo

Repo	Config template
Mailcow	Mailcow/infra/nginx/sync.geonet.co.id.conf
Zammad	Zammad/infra/nginx/zammad.gisportal.id.conf
GeoNetAgent	GeoNetAgent/infra/nginx/

Deprecated: server-audit/.cursor/infra-reverse-proxy.md → gunakan file ini.