zizi-al/sub2api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
sub2api/ops/remote/jppro-sub2api/current/proxy-ng-hardening-notes.md
zizi 6814fa2a62 docs(ops): record proxy-ng deployment hardening 
Add deployment traces for the JPpro proxy node, RackNerd origin hosts, catproxy boundary changes, local speed checks, and Sub2API rate-limit behavior.

Keep remote secrets excluded while tracking sanitized nginx, compose, plan, and operational memory documents.
2026-05-26 23:27:41 +08:00

840 B
Raw Blame History

JPpro proxy-ng hardening notes

日期：2026-05-26

  • Public host served: proxy.api.lilifamily.com, jp.proxy.api.lilifamily.com
  • Origin: https://origin.proxy.api.lilifamily.com
  • Token: stored on remote only at /etc/nginx/proxy-ng/token.conf, redacted from Git
  • Certificate: /etc/letsencrypt/live/proxy.api.lilifamily.com/fullchain.pem, SAN includes both public and node hostnames
  • Scan-path blocking: enabled for dotfiles, wp-login, phpmyadmin, cgi-bin, vendor, boaform
  • Rate limit: general 10r/s, auth 10r/m, connection limit 50 per IP on public server
  • fail2ban: nginx-proxy-ng-scan and sshd active
  • logrotate: /etc/logrotate.d/nginx-proxy-ng
  • Validation: public /health returned 200, unauthenticated /v1/responses returned 401 API_KEY_REQUIRED, scan paths returned closed connection/444 behavior