LDAPWeb/GeoNetAgent/infra/nginx

GeoNetAgent Collector — Reverse Proxy

Host: proxy.lan (10.100.1.24) — nginx + Docker collector.

Arsitektur

Internet / LAN                         HTTP internal (LAN)
       |                                        |
       v                                        v
:443 agent.gisportal.id              :8000 10.100.1.24
POST /api/v1/agent/report            UI, read API (allowlist IP)
       |                                        |
:443 collector.gisportal.id                    |
UI, read API, health, docs (HTTPS)             |
       |                                        |
       +--------------> 127.0.0.1:18000 <-------+
                    (Docker collector)

Akses	URL	Siapa
Agent (publik)	https://agent.gisportal.id/api/v1/agent/report	Laptop user di internet
Install / update agent	https://agent.gisportal.id/install/	Bootstrap PowerShell (GET)
UI + API (HTTPS)	https://collector.gisportal.id/ui/	IT / browser (publik + LAN)
UI + API (HTTP LAN)	http://10.100.1.24:8000/ui/	IT di kantor (tanpa TLS)

Collector Docker bind 127.0.0.1:18000 — tidak expose langsung.

Firewalld: port 8000/tcp untuk 10.x, 192.168.x, 100.100.x (HTTP internal).

Prasyarat DNS

Host	LAN (MikroTik split-DNS)	Publik (registrar)
agent.gisportal.id	opsional → .24	IP publik kantor
collector.gisportal.id	10.100.1.24	IP publik kantor

Port forward 443 → 10.100.1.24:443.

Deploy

scp infra/nginx/geonetagent-collector-*.conf root@10.100.1.24:/etc/nginx/conf.d/
ssh root@10.100.1.24 "nginx -t && systemctl reload nginx"

Verifikasi

# HTTPS UI (publik / LAN)
curl -s -o /dev/null -w "%{http_code}" https://collector.gisportal.id/ui/
# harapan: 200

curl -s https://collector.gisportal.id/api/v1/health

# Agent ingress terpisah — POST saja
curl -s -o /dev/null -w "%{http_code}" https://agent.gisportal.id/api/v1/health
# harapan: 404

Agent config

{
  "collector_url": "https://agent.gisportal.id/api/v1/agent/report",
  "agent_token": "<site-token>"
}

UI config (browser)

• API Base URL: https://collector.gisportal.id
• Bearer Token: sama dengan agent_token / API_BEARER_TOKEN

File

File	Fungsi
geonetagent-collector-public.conf	agent.gisportal.id — POST agent saja
geonetagent-collector-https.conf	collector.gisportal.id — UI + API HTTPS
geonetagent-collector-internal.conf	Port 8000 HTTP, IP allowlist LAN