hello-dd-code
45 lines
1.3 KiB
Markdown
45 lines
1.3 KiB
Markdown
# 生产 HTTPS 配置与证书续期策略
|
||
|
||
对应 issue：`#10 [P1][T7] 生产 HTTPS 配置与证书续期策略`
|
||
|
||
## 1. Nginx HTTPS 强制
|
||
|
||
- 参考配置：`deploy/nginx/wx_service_https.conf`
|
||
- 核心策略：
|
||
- `80 -> 443` 永久重定向
|
||
- 仅暴露 `443 ssl http2`
|
||
- 添加 HSTS 与基础安全响应头
|
||
- 反代到后端 `127.0.0.1:8080`
|
||
|
||
部署步骤：
|
||
|
||
```bash
|
||
sudo cp deploy/nginx/wx_service_https.conf /etc/nginx/conf.d/wx_service.conf
|
||
sudo nginx -t
|
||
sudo systemctl reload nginx
|
||
```
|
||
|
||
## 2. 证书自动续期
|
||
|
||
脚本：`scripts/ops/renew_cert.sh`
|
||
|
||
推荐 cron（每天 03:30）：
|
||
|
||
```bash
|
||
30 3 * * * CERTBOT_CMD=/usr/bin/certbot NGINX_RELOAD_CMD="systemctl reload nginx" OPS_ALERT_WEBHOOK="https://example.com/webhook" /path/to/wx_service/scripts/ops/renew_cert.sh >> /var/log/wx_service-cert-renew.log 2>&1
|
||
```
|
||
|
||
## 3. 续期失败与过期告警
|
||
|
||
脚本：`scripts/ops/check_cert_expiry.sh`
|
||
|
||
推荐 cron（每天 04:00）：
|
||
|
||
```bash
|
||
0 4 * * * TLS_DOMAIN=api.example.com TLS_CERT_PORT=443 TLS_MIN_DAYS=15 OPS_ALERT_WEBHOOK="https://example.com/webhook" /path/to/wx_service/scripts/ops/check_cert_expiry.sh >> /var/log/wx_service-cert-check.log 2>&1
|
||
```
|
||
|
||
说明：
|
||
- 当剩余天数 `<= TLS_MIN_DAYS` 时返回非 0 并推送告警。
|
||
- 当无法获取证书信息时也会告警并返回非 0。
|