📚 Services Web Mail Nginx Apache Postfix HAProxy SSL

# Redirection HTTP → HTTPS
server {{
    listen 80;
    server_name app.exemple.fr;
    return 301 https://$server_name$request_uri;
}}

server {{
    listen 443 ssl http2;
    server_name app.exemple.fr;

    # Certificat SSL (généré par certbot)
    ssl_certificate     /etc/letsencrypt/live/app.exemple.fr/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/app.exemple.fr/privkey.pem;

    # Protocoles et ciphers sécurisés
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    add_header Strict-Transport-Security "max-age=31536000" always;

    # Reverse proxy vers l'application locale
    location / {{
        proxy_pass         http://127.0.0.1:3000;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_read_timeout 60s;
    }}

    # Servir les fichiers statiques directement
    location /static/ {{
        alias /var/www/app/static/;
        expires 30d;
    }}
}}

# Installer certbot
apt install -y certbot python3-certbot-nginx

# Obtenir un certificat (renouvellement auto configuré)
certbot --nginx -d app.exemple.fr -d www.exemple.fr

# Renouveler manuellement (auto via timer systemd)
certbot renew --dry-run

# Vérifier la date d'expiration
echo | openssl s_client -connect app.exemple.fr:443 2>/dev/null | \
  openssl x509 -noout -dates

global
    log /dev/log local0
    maxconn 4096
    user haproxy
    group haproxy

defaults
    mode http
    timeout connect 5s
    timeout client  30s
    timeout server  30s
    option httplog

# Frontend HTTP avec redirection HTTPS
frontend http_front
    bind *:80
    redirect scheme https code 301

# Frontend HTTPS
frontend https_front
    bind *:443 ssl crt /etc/ssl/certs/cert.pem
    default_backend web_servers

# Backend — répartition en round-robin
backend web_servers
    balance     roundrobin
    option      httpchk GET /health
    http-check  expect status 200
    server web1 192.168.1.10:8080 check inter 5s
    server web2 192.168.1.11:8080 check inter 5s
    server web3 192.168.1.12:8080 check inter 5s backup

# Interface de statistiques
listen stats
    bind *:9999
    stats enable
    stats uri /haproxy-stats
    stats auth admin:MonMotDePasse!
    stats refresh 10s

# Identité du serveur
myhostname = mail.entreprise.fr
mydomain   = entreprise.fr
myorigin   = $mydomain

# Interfaces d'écoute
inet_interfaces = all
inet_protocols  = ipv4

# Domaines acceptés
mydestination = $myhostname, localhost.$mydomain, $mydomain

# Sécurité TLS
smtpd_tls_cert_file = /etc/ssl/certs/mail.crt
smtpd_tls_key_file  = /etc/ssl/private/mail.key
smtpd_use_tls       = yes
smtpd_tls_security_level = may
smtp_tls_security_level  = may

# Anti-spam basique
smtpd_recipient_restrictions =
    permit_mynetworks,
    reject_unauth_destination,
    reject_rbl_client zen.spamhaus.org

<VirtualHost *:80>
    ServerName site.exemple.fr
    Redirect permanent / https://site.exemple.fr/
</VirtualHost>

<VirtualHost *:443>
    ServerName site.exemple.fr
    DocumentRoot /var/www/site

    SSLEngine on
    SSLCertificateFile    /etc/ssl/certs/site.crt
    SSLCertificateKeyFile /etc/ssl/private/site.key

    <Directory /var/www/site>
        Options -Indexes
        AllowOverride All
        Require all granted
    </Directory>

    ErrorLog  ${{APACHE_LOG_DIR}}/site_error.log
    CustomLog ${{APACHE_LOG_DIR}}/site_access.log combined
</VirtualHost>