Add reverse proxy SSL guides for Caddy, Nginx, and Traefik.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/nginx/docker-compose.nginx.yml

@@ -0,0 +1,51 @@
+# Пример: Nginx + Certbot (Let's Encrypt)
+#
+# Запуск:
+#   docker compose -f docker-compose.yml -f deploy/nginx/docker-compose.nginx.yml up -d --build
+#
+# Первый выпуск сертификата (после того как DNS уже указывает на сервер):
+#   docker compose -f deploy/nginx/docker-compose.nginx.yml run --rm certbot certonly \
+#     --webroot -w /var/www/certbot \
+#     -d panel.example.com \
+#     --email admin@example.com --agree-tos --no-eff-email
+#
+# Затем раскомментируйте HTTPS-server в nginx.conf и:
+#   docker compose -f docker-compose.yml -f deploy/nginx/docker-compose.nginx.yml up -d
+#
+# Обновление сертификатов (cron / systemd timer на хосте):
+#   docker compose -f deploy/nginx/docker-compose.nginx.yml run --rm certbot renew
+#   docker compose -f deploy/nginx/docker-compose.nginx.yml exec nginx nginx -s reload
+
+services:
+  nginx:
+    image: nginx:1.27-alpine
+    container_name: vpn-panel-nginx
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./snippets:/etc/nginx/snippets:ro
+      - certbot_www:/var/www/certbot:ro
+      - certbot_certs:/etc/letsencrypt:ro
+    networks:
+      - vpn-net
+    depends_on:
+      - app
+
+  certbot:
+    image: certbot/certbot:latest
+    container_name: vpn-panel-certbot
+    volumes:
+      - certbot_www:/var/www/certbot
+      - certbot_certs:/etc/letsencrypt
+    entrypoint: /bin/sh -c "trap exit TERM; while :; do certbot renew --webroot -w /var/www/certbot --quiet; sleep 12h & wait $${!}; done"
+
+volumes:
+  certbot_www:
+  certbot_certs:
+
+networks:
+  vpn-net:
+    name: vpn-panel-net

deploy/nginx/nginx.conf

@@ -0,0 +1,42 @@
+# Замените panel.example.com на свой DOMAIN.
+# После выпуска сертификата Certbot раскомментируйте блок HTTPS ниже.
+
+upstream vpn_panel {
+    server app:8080;
+    keepalive 32;
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name panel.example.com;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    # Пока сертификата нет — проксируем HTTP.
+    # После выпуска SSL лучше редиректить на HTTPS (раскомментируйте return и закомментируйте location /).
+    # return 301 https://$host$request_uri;
+
+    location / {
+        proxy_pass http://vpn_panel;
+        include /etc/nginx/snippets/proxy_params.conf;
+    }
+}
+
+# --- HTTPS (раскомментировать после certbot certonly) ---
+# server {
+#     listen 443 ssl http2;
+#     listen [::]:443 ssl http2;
+#     server_name panel.example.com;
+#
+#     ssl_certificate     /etc/letsencrypt/live/panel.example.com/fullchain.pem;
+#     ssl_certificate_key /etc/letsencrypt/live/panel.example.com/privkey.pem;
+#     include /etc/nginx/snippets/ssl_params.conf;
+#
+#     location / {
+#         proxy_pass http://vpn_panel;
+#         include /etc/nginx/snippets/proxy_params.conf;
+#     }
+# }

deploy/nginx/snippets/proxy_params.conf

@@ -0,0 +1,10 @@
+proxy_http_version 1.1;
+proxy_set_header Host              $host;
+proxy_set_header X-Real-IP         $remote_addr;
+proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_set_header X-Forwarded-Host  $host;
+proxy_set_header Connection        "";
+proxy_read_timeout  60s;
+proxy_send_timeout  60s;
+proxy_buffering on;

deploy/nginx/snippets/ssl_params.conf

@@ -0,0 +1,14 @@
+ssl_session_cache shared:SSL:10m;
+ssl_session_timeout 1d;
+ssl_session_tickets off;
+
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_prefer_server_ciphers off;
+
+# Modern Mozilla intermediate
+ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
+
+add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+add_header X-Content-Type-Options nosniff always;
+add_header X-Frame-Options DENY always;
+add_header Referrer-Policy strict-origin-when-cross-origin always;