← back to Kamatera Nginx

sites-available/dw-admin-auth

196 lines

# DW-Agents Protected Admin Services
# Simple basic_auth protection for internal admin tools
# Credentials: admin / DW2025Secure!

# Define trusted IPs that bypass auth
geo $auth_bypass {
    default         0;
    127.0.0.1       1;
    ::1             1;
    45.61.58.125    1;
}

server {
    listen 9001;
    listen [::]:9001;
    server_name 45.61.58.125;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;

    # Proxy settings
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_connect_timeout 60s;
    proxy_send_timeout 60s;
    proxy_read_timeout 60s;

    # ============================================
    # ADMIN TOOLS (Protected with basic_auth)
    # ============================================

    # Product Importer (3002)
    location /import/ {
        satisfy any;
        allow 127.0.0.1;
        allow 45.61.58.125;
        deny all;
        auth_basic "DW Admin";
        auth_basic_user_file /etc/nginx/.htpasswd;

        proxy_pass http://127.0.0.1:3002/;
    }

    # Dashboard Monitor (9990)
    location /dashboard/ {
        satisfy any;
        allow 127.0.0.1;
        allow 45.61.58.125;
        deny all;
        auth_basic "DW Admin";
        auth_basic_user_file /etc/nginx/.htpasswd;

        proxy_pass http://127.0.0.1:9990/;
    }

    # Master Hub (9893)
    location /hub/ {
        satisfy any;
        allow 127.0.0.1;
        allow 45.61.58.125;
        deny all;
        auth_basic "DW Admin";
        auth_basic_user_file /etc/nginx/.htpasswd;

        proxy_pass http://127.0.0.1:9893/;
    }

    # Screenshot Upload (7577)
    location /screenshot/ {
        satisfy any;
        allow 127.0.0.1;
        allow 45.61.58.125;
        deny all;
        auth_basic "DW Admin";
        auth_basic_user_file /etc/nginx/.htpasswd;

        proxy_pass http://127.0.0.1:7577/;
        client_max_body_size 50M;
    }

    # Vendor Dashboard (9832)
    location /vendor/ {
        satisfy any;
        allow 127.0.0.1;
        allow 45.61.58.125;
        deny all;
        auth_basic "DW Admin";
        auth_basic_user_file /etc/nginx/.htpasswd;

        proxy_pass http://127.0.0.1:9832/;
    }

    # ============================================
    # EXECUTIVE DASHBOARDS (Protected)
    # ============================================

    location /exec/purchasing/ {
        satisfy any;
        allow 127.0.0.1;
        allow 45.61.58.125;
        deny all;
        auth_basic "DW Admin";
        auth_basic_user_file /etc/nginx/.htpasswd;
        proxy_pass http://127.0.0.1:7120/;
    }

    location /exec/marketing/ {
        satisfy any;
        allow 127.0.0.1;
        allow 45.61.58.125;
        deny all;
        auth_basic "DW Admin";
        auth_basic_user_file /etc/nginx/.htpasswd;
        proxy_pass http://127.0.0.1:7121/;
    }

    # ============================================
    # DW-AGENTS (Protected)
    # ============================================

    location /agent/legal/ {
        satisfy any;
        allow 127.0.0.1;
        allow 45.61.58.125;
        deny all;
        auth_basic "DW Admin";
        auth_basic_user_file /etc/nginx/.htpasswd;
        proxy_pass http://127.0.0.1:9879/;
    }

    location /agent/accounting/ {
        satisfy any;
        allow 127.0.0.1;
        allow 45.61.58.125;
        deny all;
        auth_basic "DW Admin";
        auth_basic_user_file /etc/nginx/.htpasswd;
        proxy_pass http://127.0.0.1:9886/;
    }

    # ============================================
    # HEALTH CHECK (No Auth)
    # ============================================
    location /health {
        access_log off;
        return 200 'DW Admin Portal OK';
        add_header Content-Type text/plain;
    }

    # ============================================
    # ROOT - Simple landing page
    # ============================================
    location / {
        satisfy any;
        allow 127.0.0.1;
        allow 45.61.58.125;
        deny all;
        auth_basic "DW Admin";
        auth_basic_user_file /etc/nginx/.htpasswd;

        return 200 '<!DOCTYPE html>
<html>
<head><title>DW Admin Portal</title>
<style>
body { font-family: Arial; background: #1a1a2e; color: white; display: flex; justify-content: center; align-items: center; min-height: 100vh; margin: 0; }
.container { text-align: center; padding: 40px; }
h1 { color: #667eea; }
.links { margin-top: 30px; }
.links a { display: inline-block; margin: 10px; padding: 15px 30px; background: #667eea; color: white; text-decoration: none; border-radius: 8px; }
.links a:hover { background: #764ba2; }
</style>
</head>
<body>
<div class="container">
<h1>DW Admin Portal</h1>
<p>Protected admin services</p>
<div class="links">
<a href="/dashboard/">Dashboard</a>
<a href="/hub/">Master Hub</a>
<a href="/import/">Product Import</a>
<a href="/vendor/">Vendor Dashboard</a>
</div>
</div>
</body>
</html>';
        add_header Content-Type text/html;
    }
}