Files
awoooi/docs/security/nginx-config-drift-repo.snapshot.json

1107 lines
33 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"configs": [
{
"comparison": {
"drift_detected": null,
"note": "尚未提供 live conf 匯出檔;本階段不 SSH、不讀 live、不 reload。",
"status": "repo_only_no_live_evidence"
},
"config_id": "host188_all_sites",
"control_tier": "C0",
"host": "192.168.0.188",
"live_input": {
"path": null,
"provided": false,
"summary": null
},
"live_path": "/etc/nginx/sites-enabled/all-sites.conf",
"owner_gate": "public_gateway_owner_response_required",
"repo_source": {
"line_count": 268,
"normalized_sha256": "175e13f1a66b349d188f054a5232b9dc3ebf801e25f4a2d3879e34248a787e2a",
"parsed": {
"acme_routes": [
{
"auth_basic": [],
"path": "/.well-known/acme-challenge/",
"proxy_passes": [],
"roots": [
"/var/www/html"
],
"server_names": [
"stock.wooo.work"
]
},
{
"auth_basic": [],
"path": "/.well-known/acme-challenge/",
"proxy_passes": [],
"roots": [
"/var/www/html"
],
"server_names": [
"vtuber.wooo.work"
]
}
],
"admin_routes": [
{
"auth_basic": [],
"path": "= /admin",
"proxy_passes": [],
"roots": [],
"server_names": [
"stock.wooo.work"
]
},
{
"auth_basic": [
"off"
],
"path": "/admin/",
"proxy_passes": [
"http://192.168.0.110:31235"
],
"roots": [],
"server_names": [
"stock.wooo.work"
]
}
],
"listens": [
"443 ssl",
"443 ssl http2",
"80"
],
"proxy_passes": [
"http://127.0.0.1:3000",
"http://127.0.0.1:3301",
"http://127.0.0.1:5003",
"http://192.168.0.110:3003",
"http://192.168.0.110:31235",
"http://192.168.0.110:8929",
"http://192.168.0.125:32334/api/",
"http://192.168.0.125:32334/api/v1/ws",
"http://192.168.0.125:32335",
"https://192.168.0.110"
],
"server_block_count": 15,
"server_names": [
"aiops.wooo.work",
"bitan.wooo.work",
"gitlab.wooo.work",
"mo.wooo.work",
"signoz.wooo.work",
"stock.wooo.work",
"tsenyang.com",
"vtuber.wooo.work",
"www.tsenyang.com"
],
"servers": [
{
"has_tls": false,
"index": 1,
"listens": [
"80"
],
"locations": [],
"proxy_passes": [],
"server_names": [
"aiops.wooo.work"
],
"ssl_certificate_keys": [],
"ssl_certificates": []
},
{
"has_tls": true,
"index": 2,
"listens": [
"443 ssl http2"
],
"locations": [
{
"auth_basic": [],
"path": "/api/",
"proxy_passes": [
"http://192.168.0.125:32334/api/"
],
"roots": [],
"websocket_upgrade": false
},
{
"auth_basic": [],
"path": "/api/v1/ws",
"proxy_passes": [
"http://192.168.0.125:32334/api/v1/ws"
],
"roots": [],
"websocket_upgrade": true
},
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"http://192.168.0.125:32335"
],
"roots": [],
"websocket_upgrade": false
}
],
"proxy_passes": [
"http://192.168.0.125:32334/api/",
"http://192.168.0.125:32334/api/v1/ws",
"http://192.168.0.125:32335"
],
"server_names": [
"aiops.wooo.work"
],
"ssl_certificate_keys": [
"/etc/letsencrypt/live/aiops.wooo.work/privkey.pem"
],
"ssl_certificates": [
"/etc/letsencrypt/live/aiops.wooo.work/fullchain.pem"
]
},
{
"has_tls": false,
"index": 3,
"listens": [
"80"
],
"locations": [],
"proxy_passes": [],
"server_names": [
"gitlab.wooo.work"
],
"ssl_certificate_keys": [],
"ssl_certificates": []
},
{
"has_tls": true,
"index": 4,
"listens": [
"443 ssl http2"
],
"locations": [
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"http://192.168.0.110:8929"
],
"roots": [],
"websocket_upgrade": false
}
],
"proxy_passes": [
"http://192.168.0.110:8929"
],
"server_names": [
"gitlab.wooo.work"
],
"ssl_certificate_keys": [
"/etc/letsencrypt/live/gitlab.wooo.work/privkey.pem"
],
"ssl_certificates": [
"/etc/letsencrypt/live/gitlab.wooo.work/fullchain.pem"
]
},
{
"has_tls": false,
"index": 5,
"listens": [
"80"
],
"locations": [
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"http://127.0.0.1:3301"
],
"roots": [],
"websocket_upgrade": false
}
],
"proxy_passes": [
"http://127.0.0.1:3301"
],
"server_names": [
"signoz.wooo.work"
],
"ssl_certificate_keys": [],
"ssl_certificates": []
},
{
"has_tls": false,
"index": 6,
"listens": [
"80"
],
"locations": [],
"proxy_passes": [],
"server_names": [
"www.tsenyang.com",
"tsenyang.com"
],
"ssl_certificate_keys": [],
"ssl_certificates": []
},
{
"has_tls": true,
"index": 7,
"listens": [
"443 ssl http2"
],
"locations": [
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"http://127.0.0.1:3000"
],
"roots": [],
"websocket_upgrade": false
}
],
"proxy_passes": [
"http://127.0.0.1:3000"
],
"server_names": [
"www.tsenyang.com",
"tsenyang.com"
],
"ssl_certificate_keys": [
"/etc/letsencrypt/live/www.tsenyang.com/privkey.pem"
],
"ssl_certificates": [
"/etc/letsencrypt/live/www.tsenyang.com/fullchain.pem"
]
},
{
"has_tls": false,
"index": 8,
"listens": [
"80"
],
"locations": [
{
"auth_basic": [],
"path": "/.well-known/acme-challenge/",
"proxy_passes": [],
"roots": [
"/var/www/html"
],
"websocket_upgrade": false
},
{
"auth_basic": [],
"path": "/",
"proxy_passes": [],
"roots": [],
"websocket_upgrade": false
}
],
"proxy_passes": [],
"server_names": [
"stock.wooo.work"
],
"ssl_certificate_keys": [],
"ssl_certificates": []
},
{
"has_tls": true,
"index": 9,
"listens": [
"443 ssl http2"
],
"locations": [
{
"auth_basic": [],
"path": "= /admin",
"proxy_passes": [],
"roots": [],
"websocket_upgrade": false
},
{
"auth_basic": [
"off"
],
"path": "/admin/",
"proxy_passes": [
"http://192.168.0.110:31235"
],
"roots": [],
"websocket_upgrade": true
},
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"http://192.168.0.110:31235"
],
"roots": [],
"websocket_upgrade": true
}
],
"proxy_passes": [
"http://192.168.0.110:31235",
"http://192.168.0.110:31235"
],
"server_names": [
"stock.wooo.work"
],
"ssl_certificate_keys": [
"/etc/letsencrypt/live/stock.wooo.work/privkey.pem"
],
"ssl_certificates": [
"/etc/letsencrypt/live/stock.wooo.work/fullchain.pem"
]
},
{
"has_tls": false,
"index": 10,
"listens": [
"80"
],
"locations": [],
"proxy_passes": [],
"server_names": [
"mo.wooo.work"
],
"ssl_certificate_keys": [],
"ssl_certificates": []
},
{
"has_tls": true,
"index": 11,
"listens": [
"443 ssl http2"
],
"locations": [
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"http://127.0.0.1:5003"
],
"roots": [],
"websocket_upgrade": false
}
],
"proxy_passes": [
"http://127.0.0.1:5003"
],
"server_names": [
"mo.wooo.work"
],
"ssl_certificate_keys": [
"/etc/letsencrypt/live/mo.wooo.work/privkey.pem"
],
"ssl_certificates": [
"/etc/letsencrypt/live/mo.wooo.work/fullchain.pem"
]
},
{
"has_tls": false,
"index": 12,
"listens": [
"80"
],
"locations": [],
"proxy_passes": [],
"server_names": [
"bitan.wooo.work"
],
"ssl_certificate_keys": [],
"ssl_certificates": []
},
{
"has_tls": true,
"index": 13,
"listens": [
"443 ssl http2"
],
"locations": [
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"http://192.168.0.110:3003"
],
"roots": [],
"websocket_upgrade": true
}
],
"proxy_passes": [
"http://192.168.0.110:3003"
],
"server_names": [
"bitan.wooo.work"
],
"ssl_certificate_keys": [
"/etc/letsencrypt/live/bitan.wooo.work/privkey.pem"
],
"ssl_certificates": [
"/etc/letsencrypt/live/bitan.wooo.work/fullchain.pem"
]
},
{
"has_tls": true,
"index": 14,
"listens": [
"443 ssl"
],
"locations": [
{
"auth_basic": [],
"path": "/.well-known/acme-challenge/",
"proxy_passes": [],
"roots": [
"/var/www/html"
],
"websocket_upgrade": false
},
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"https://192.168.0.110"
],
"roots": [],
"websocket_upgrade": true
}
],
"proxy_passes": [
"https://192.168.0.110"
],
"server_names": [
"vtuber.wooo.work"
],
"ssl_certificate_keys": [
"/etc/letsencrypt/live/vtuber.wooo.work/privkey.pem"
],
"ssl_certificates": [
"/etc/letsencrypt/live/vtuber.wooo.work/fullchain.pem"
]
},
{
"has_tls": false,
"index": 15,
"listens": [
"80"
],
"locations": [],
"proxy_passes": [],
"server_names": [
"vtuber.wooo.work"
],
"ssl_certificate_keys": [],
"ssl_certificates": []
}
],
"ssl_certificate_keys": [
"/etc/letsencrypt/live/aiops.wooo.work/privkey.pem",
"/etc/letsencrypt/live/bitan.wooo.work/privkey.pem",
"/etc/letsencrypt/live/gitlab.wooo.work/privkey.pem",
"/etc/letsencrypt/live/mo.wooo.work/privkey.pem",
"/etc/letsencrypt/live/stock.wooo.work/privkey.pem",
"/etc/letsencrypt/live/vtuber.wooo.work/privkey.pem",
"/etc/letsencrypt/live/www.tsenyang.com/privkey.pem"
],
"ssl_certificates": [
"/etc/letsencrypt/live/aiops.wooo.work/fullchain.pem",
"/etc/letsencrypt/live/bitan.wooo.work/fullchain.pem",
"/etc/letsencrypt/live/gitlab.wooo.work/fullchain.pem",
"/etc/letsencrypt/live/mo.wooo.work/fullchain.pem",
"/etc/letsencrypt/live/stock.wooo.work/fullchain.pem",
"/etc/letsencrypt/live/vtuber.wooo.work/fullchain.pem",
"/etc/letsencrypt/live/www.tsenyang.com/fullchain.pem"
],
"websocket_routes": [
{
"auth_basic": [],
"path": "/api/v1/ws",
"proxy_passes": [
"http://192.168.0.125:32334/api/v1/ws"
],
"roots": [],
"server_names": [
"aiops.wooo.work"
]
},
{
"auth_basic": [
"off"
],
"path": "/admin/",
"proxy_passes": [
"http://192.168.0.110:31235"
],
"roots": [],
"server_names": [
"stock.wooo.work"
]
},
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"http://192.168.0.110:31235"
],
"roots": [],
"server_names": [
"stock.wooo.work"
]
},
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"http://192.168.0.110:3003"
],
"roots": [],
"server_names": [
"bitan.wooo.work"
]
},
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"https://192.168.0.110"
],
"roots": [],
"server_names": [
"vtuber.wooo.work"
]
}
]
},
"raw_sha256": "6fec2bde00cc0935296738ff6bc4564528fe53e7794d518d1a5dbc57feb5c498"
},
"repo_source_path": "infra/ansible/roles/nginx/templates/188-all-sites.conf.j2",
"role": "public_gateway_all_sites"
},
{
"comparison": {
"drift_detected": null,
"note": "尚未提供 live conf 匯出檔;本階段不 SSH、不讀 live、不 reload。",
"status": "repo_only_no_live_evidence"
},
"config_id": "host188_internal_tools_https",
"control_tier": "C0",
"host": "192.168.0.188",
"live_input": {
"path": null,
"provided": false,
"summary": null
},
"live_path": "owner_confirmation_required",
"owner_gate": "public_tools_owner_response_required",
"repo_source": {
"line_count": 149,
"normalized_sha256": "0b67241536252c0da30198be88ccb9a2f283073ad5e1e3ff2cbc4ebea3ff30d4",
"parsed": {
"acme_routes": [
{
"auth_basic": [],
"path": "/.well-known/acme-challenge/",
"proxy_passes": [],
"roots": [
"/var/www/certbot"
],
"server_names": [
"gitea.wooo.work",
"sentry.wooo.work",
"langfuse.wooo.work",
"harbor.wooo.work",
"registry.wooo.work",
"stock.wooo.work"
]
}
],
"admin_routes": [],
"listens": [
"443 ssl http2",
"80"
],
"proxy_passes": [
"http://127.0.0.1:3301",
"http://192.168.0.110:3001",
"http://192.168.0.110:3100",
"http://192.168.0.110:31235",
"http://192.168.0.110:5000",
"http://192.168.0.110:9000"
],
"server_block_count": 8,
"server_names": [
"gitea.wooo.work",
"harbor.wooo.work",
"langfuse.wooo.work",
"registry.wooo.work",
"sentry.wooo.work",
"signoz.wooo.work",
"stock.wooo.work"
],
"servers": [
{
"has_tls": false,
"index": 1,
"listens": [
"80"
],
"locations": [
{
"auth_basic": [],
"path": "/.well-known/acme-challenge/",
"proxy_passes": [],
"roots": [
"/var/www/certbot"
],
"websocket_upgrade": false
},
{
"auth_basic": [],
"path": "/",
"proxy_passes": [],
"roots": [],
"websocket_upgrade": false
}
],
"proxy_passes": [],
"server_names": [
"gitea.wooo.work",
"sentry.wooo.work",
"langfuse.wooo.work",
"harbor.wooo.work",
"registry.wooo.work",
"stock.wooo.work"
],
"ssl_certificate_keys": [],
"ssl_certificates": []
},
{
"has_tls": true,
"index": 2,
"listens": [
"443 ssl http2"
],
"locations": [
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"http://127.0.0.1:3301"
],
"roots": [],
"websocket_upgrade": true
}
],
"proxy_passes": [
"http://127.0.0.1:3301"
],
"server_names": [
"signoz.wooo.work"
],
"ssl_certificate_keys": [
"/etc/letsencrypt/live/sentry.wooo.work/privkey.pem"
],
"ssl_certificates": [
"/etc/letsencrypt/live/sentry.wooo.work/fullchain.pem"
]
},
{
"has_tls": true,
"index": 3,
"listens": [
"443 ssl http2"
],
"locations": [
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"http://192.168.0.110:31235"
],
"roots": [],
"websocket_upgrade": false
}
],
"proxy_passes": [
"http://192.168.0.110:31235"
],
"server_names": [
"stock.wooo.work"
],
"ssl_certificate_keys": [
"/etc/letsencrypt/live/stock.wooo.work/privkey.pem"
],
"ssl_certificates": [
"/etc/letsencrypt/live/stock.wooo.work/fullchain.pem"
]
},
{
"has_tls": true,
"index": 4,
"listens": [
"443 ssl http2"
],
"locations": [
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"http://192.168.0.110:9000"
],
"roots": [],
"websocket_upgrade": false
}
],
"proxy_passes": [
"http://192.168.0.110:9000"
],
"server_names": [
"sentry.wooo.work"
],
"ssl_certificate_keys": [
"/etc/letsencrypt/live/sentry.wooo.work/privkey.pem"
],
"ssl_certificates": [
"/etc/letsencrypt/live/sentry.wooo.work/fullchain.pem"
]
},
{
"has_tls": true,
"index": 5,
"listens": [
"443 ssl http2"
],
"locations": [
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"http://192.168.0.110:3001"
],
"roots": [],
"websocket_upgrade": true
}
],
"proxy_passes": [
"http://192.168.0.110:3001"
],
"server_names": [
"gitea.wooo.work"
],
"ssl_certificate_keys": [
"/etc/letsencrypt/live/sentry.wooo.work/privkey.pem"
],
"ssl_certificates": [
"/etc/letsencrypt/live/sentry.wooo.work/fullchain.pem"
]
},
{
"has_tls": true,
"index": 6,
"listens": [
"443 ssl http2"
],
"locations": [
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"http://192.168.0.110:3100"
],
"roots": [],
"websocket_upgrade": false
}
],
"proxy_passes": [
"http://192.168.0.110:3100"
],
"server_names": [
"langfuse.wooo.work"
],
"ssl_certificate_keys": [
"/etc/letsencrypt/live/sentry.wooo.work/privkey.pem"
],
"ssl_certificates": [
"/etc/letsencrypt/live/sentry.wooo.work/fullchain.pem"
]
},
{
"has_tls": true,
"index": 7,
"listens": [
"443 ssl http2"
],
"locations": [
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"http://192.168.0.110:5000"
],
"roots": [],
"websocket_upgrade": false
}
],
"proxy_passes": [
"http://192.168.0.110:5000"
],
"server_names": [
"harbor.wooo.work"
],
"ssl_certificate_keys": [
"/etc/letsencrypt/live/harbor.wooo.work/privkey.pem"
],
"ssl_certificates": [
"/etc/letsencrypt/live/harbor.wooo.work/fullchain.pem"
]
},
{
"has_tls": true,
"index": 8,
"listens": [
"443 ssl http2"
],
"locations": [
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"http://192.168.0.110:5000"
],
"roots": [],
"websocket_upgrade": false
}
],
"proxy_passes": [
"http://192.168.0.110:5000"
],
"server_names": [
"registry.wooo.work"
],
"ssl_certificate_keys": [
"/etc/letsencrypt/live/registry.wooo.work/privkey.pem"
],
"ssl_certificates": [
"/etc/letsencrypt/live/registry.wooo.work/fullchain.pem"
]
}
],
"ssl_certificate_keys": [
"/etc/letsencrypt/live/harbor.wooo.work/privkey.pem",
"/etc/letsencrypt/live/registry.wooo.work/privkey.pem",
"/etc/letsencrypt/live/sentry.wooo.work/privkey.pem",
"/etc/letsencrypt/live/stock.wooo.work/privkey.pem"
],
"ssl_certificates": [
"/etc/letsencrypt/live/harbor.wooo.work/fullchain.pem",
"/etc/letsencrypt/live/registry.wooo.work/fullchain.pem",
"/etc/letsencrypt/live/sentry.wooo.work/fullchain.pem",
"/etc/letsencrypt/live/stock.wooo.work/fullchain.pem"
],
"websocket_routes": [
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"http://127.0.0.1:3301"
],
"roots": [],
"server_names": [
"signoz.wooo.work"
]
},
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"http://192.168.0.110:3001"
],
"roots": [],
"server_names": [
"gitea.wooo.work"
]
}
]
},
"raw_sha256": "791ac846869e03d3ad3052f1068fc30905f00e7a4975228e055b42827b1956b8"
},
"repo_source_path": "infra/ansible/roles/nginx/templates/188-internal-tools-https.conf.j2",
"role": "public_internal_tools_https"
},
{
"comparison": {
"drift_detected": null,
"note": "尚未提供 live conf 匯出檔;本階段不 SSH、不讀 live、不 reload。",
"status": "repo_only_no_live_evidence"
},
"config_id": "host110_ollama_proxy",
"control_tier": "C1",
"host": "192.168.0.110",
"live_input": {
"path": null,
"provided": false,
"summary": null
},
"live_path": "/etc/nginx/sites-enabled/110-ollama-proxy.conf",
"owner_gate": "ai_provider_proxy_owner_response_required",
"repo_source": {
"line_count": 104,
"normalized_sha256": "8f065c79659c76cbfc1dff497546de30977f07dd32751376504a73efd5f48277",
"parsed": {
"acme_routes": [],
"admin_routes": [],
"listens": [
"11435",
"11436",
"11437",
"[::]:11435",
"[::]:11436",
"[::]:11437"
],
"proxy_passes": [
"http://192.168.0.111:11434",
"http://34.143.170.20:11434",
"http://34.21.145.224:11434"
],
"server_block_count": 3,
"server_names": [],
"servers": [
{
"has_tls": false,
"index": 1,
"listens": [
"11435",
"[::]:11435"
],
"locations": [
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"http://34.143.170.20:11434"
],
"roots": [],
"websocket_upgrade": false
},
{
"auth_basic": [],
"path": "/nginx-health",
"proxy_passes": [],
"roots": [],
"websocket_upgrade": false
}
],
"proxy_passes": [
"http://34.143.170.20:11434"
],
"server_names": [],
"ssl_certificate_keys": [],
"ssl_certificates": []
},
{
"has_tls": false,
"index": 2,
"listens": [
"11436",
"[::]:11436"
],
"locations": [
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"http://34.21.145.224:11434"
],
"roots": [],
"websocket_upgrade": false
},
{
"auth_basic": [],
"path": "/nginx-health",
"proxy_passes": [],
"roots": [],
"websocket_upgrade": false
}
],
"proxy_passes": [
"http://34.21.145.224:11434"
],
"server_names": [],
"ssl_certificate_keys": [],
"ssl_certificates": []
},
{
"has_tls": false,
"index": 3,
"listens": [
"11437",
"[::]:11437"
],
"locations": [
{
"auth_basic": [],
"path": "/",
"proxy_passes": [
"http://192.168.0.111:11434"
],
"roots": [],
"websocket_upgrade": false
},
{
"auth_basic": [],
"path": "/nginx-health",
"proxy_passes": [],
"roots": [],
"websocket_upgrade": false
}
],
"proxy_passes": [
"http://192.168.0.111:11434"
],
"server_names": [],
"ssl_certificate_keys": [],
"ssl_certificates": []
}
],
"ssl_certificate_keys": [],
"ssl_certificates": [],
"websocket_routes": []
},
"raw_sha256": "46332f8e3172027c98e5dbe804af5cffe12b4b0b256ceb24b5c5ec31129a42d3"
},
"repo_source_path": "infra/ansible/roles/nginx/templates/110-ollama-proxy.conf.j2",
"role": "ollama_proxy_gateway"
}
],
"execution_boundaries": {
"host_write_executed": false,
"nginx_reload_executed": false,
"nginx_test_executed": false,
"runtime_gate_opened": false,
"secret_value_collected": false,
"ssh_executed": false
},
"generated_at": "2026-06-11T12:00:00+08:00",
"git_commit": "eca53646",
"mode": "repo_only",
"next_steps": [
"由 owner 提供脫敏 live conf 匯出檔後重跑比較模式。",
"若偵測 drift只建立 evidence 與 owner decision不自動覆寫 live。",
"任何 Nginx reload 仍需 maintenance window、rollback owner、nginx -t 與 route smoke。"
],
"schema_version": "nginx_config_drift_detector_v1",
"summary": {
"drift_detected_count": 0,
"live_evidence_collected": false,
"live_input_count": 0,
"repo_source_inventory_complete": true,
"source_config_count": 3
}
}