mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-05-06 19:19:19 +02:00
8613f71112
- lib/AdminAuth.php: new class with requireLogin(), login(), logout(), isAuthenticated(); starts session with hardened cookie params (HttpOnly, SameSite=Strict, Secure, Path=/admin) — also resolves item #8 (session cookie hardening) - requireLogin() auto-authenticates from nginx Basic Auth credentials ($_SERVER['PHP_AUTH_PW']) so the user only sees one browser prompt; falls back to /admin/login.php if the proxy is absent/misconfigured - config/admin_credentials.php: gitignored credential store; define ADMIN_PASSWORD_HASH with a bcrypt hash to enable PHP auth - config/admin_credentials.example.php: template for the above - config/bootstrap.php: auto-loads admin_credentials.php if present - .gitignore: exclude config/admin_credentials.php - public/admin/login.php: fallback login form (shown only when nginx Basic Auth is bypassed / proxy absent) - public/admin/logout.php: session destruction + redirect to login - All 7 admin PHP files: replace session_start() with AdminAuth::requireLogin() (defence-in-depth behind nginx Basic Auth) - public/admin/inc/head.php: Déconnexion button when ADMIN_PASSWORD_HASH is defined - nginx/PHP_AUTH_LAYER.md: documents dual-auth architecture, UX flow, and setup instructions - docs/TODO.SECURITY.md: items #2 and #8 moved to Resolved; priority order updated (all CRITICAL done)
Nginx Configuration - Post-ERG
This directory contains nginx configuration and setup scripts for the Post-ERG thesis website.
📁 Files
posterg.conf- Complete nginx configuration filesetup-password.sh- Script to create admin passwordsSETUP.md- Detailed setup instructionsQUICK_REFERENCE.md- Command reference and troubleshooting
🚀 Quick Start
1. Deploy nginx configuration (automated)
# From your local machine
just deploy-nginx
# Then on the server:
ssh posterg
sudo bash /tmp/deploy-production.sh
The deployment script will:
- ✅ Fix file permissions (posterg group)
- ✅ Set up admin password (if needed)
- ✅ Install nginx configuration
- ✅ Test and reload nginx
- ✅ Verify PHP-FPM is running
2. SSL/TLS
SSL/TLS is handled by the upstream reverse proxy and is already working. No additional SSL setup is needed on this server.
🔒 Security Features
Admin Panel Protection
- Password required for
/formulaire/(admin panel) - HTTP Basic Authentication
- Rate limited: 10 requests/minute
File Access Protection
- Database files (
.db) - BLOCKED - Sensitive files (
.md,.sql,.env) - BLOCKED - Shared directory - BLOCKED
- Tests directory - BLOCKED
- Cache directory - BLOCKED
- Hidden files (
.git, etc.) - BLOCKED
Rate Limiting
- General requests: 30/minute
- Search endpoint: 30/minute
- Admin panel: 10/minute
Security Headers
- ✅ X-Frame-Options (clickjacking protection)
- ✅ X-Content-Type-Options (MIME sniffing protection)
- ✅ X-XSS-Protection (XSS filter)
- ✅ Strict-Transport-Security (force HTTPS)
- ✅ Referrer-Policy (referrer control)
- ✅ Permissions-Policy (disable browser features)
SSL/TLS
- TLS 1.2 and 1.3 only
- Strong cipher suites
- OCSP stapling
- HSTS enabled
📚 Documentation
-
SETUP.md - Complete setup guide
- Installation steps
- Configuration details
- Testing procedures
- Troubleshooting
- Performance tuning
- Security checklist
-
QUICK_REFERENCE.md - Command reference
- Common operations
- Password management
- Nginx control
- Log viewing
- Testing commands
- Troubleshooting
🧪 Testing
Test your configuration:
# Test admin authentication
curl -I https://posterg.erg.be/formulaire/
# Test file protection
curl -I https://posterg.erg.be/database/posterg.db
# Test security headers
curl -I https://posterg.erg.be/ | grep -E "X-|Strict-Transport"
🆘 Quick Help
Admin can't log in
# Reset password
sudo htpasswd /etc/nginx/.htpasswd-posterg admin
502 Bad Gateway
# Check PHP-FPM
sudo systemctl status php8.2-fpm
sudo systemctl restart php8.2-fpm
Configuration errors
# Test and show errors
sudo nginx -t
📊 Monitoring
# Watch access logs
sudo tail -f /var/log/nginx/posterg_access.log
# Watch error logs
sudo tail -f /var/log/nginx/posterg_error.log
# Check nginx status
sudo systemctl status nginx
🔄 Maintenance
Change admin password
sudo htpasswd /etc/nginx/.htpasswd-posterg admin
Reload after config changes
sudo nginx -t && sudo systemctl reload nginx
Renew SSL certificate
sudo certbot renew
📞 Support
For detailed instructions, see:
- SETUP.md - Complete setup guide
- QUICK_REFERENCE.md - Command reference
For issues:
- Check nginx error logs:
sudo tail /var/log/nginx/posterg_error.log - Test configuration:
sudo nginx -t - Check PHP-FPM:
sudo systemctl status php8.2-fpm