46 lines
2.1 KiB
Plaintext
46 lines
2.1 KiB
Plaintext
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name _; # Acepta cualquier nombre porque Azure entra por IP o Dominio
|
|
|
|
# -------------------------------------------------------------------------
|
|
# 🔐 CERTIFICADOS SSL (Lado Servidor)
|
|
# -------------------------------------------------------------------------
|
|
ssl_certificate /etc/nginx/certs/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/privkey.pem;
|
|
|
|
# -------------------------------------------------------------------------
|
|
# 🛡️ VALIDACIÓN MTLS (CLIENTE AZURE)
|
|
# -------------------------------------------------------------------------
|
|
# Este es el CA que firma el certificado que Azure APIM presentará
|
|
ssl_client_certificate /etc/nginx/certs/azure-root-ca.crt;
|
|
ssl_verify_client on; # OBLIGATORIO: Exigir certificado al cliente
|
|
|
|
# -------------------------------------------------------------------------
|
|
# ⚡ OPTIMIZACIÓN SSL
|
|
# -------------------------------------------------------------------------
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers HIGH:!aNULL:!MD5;
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
location / {
|
|
# ---------------------------------------------------------------------
|
|
# 🕵️ DOBLE FACTOR: VALIDACIÓN DE HEADER SECRETO
|
|
# ---------------------------------------------------------------------
|
|
# Si el certificado es válido pero no tiene el secreto -> RECHAZAR
|
|
if ($http_x_tunnel_secret != "${TUNNEL_SECRET_TOKEN}") {
|
|
return 403 '{"error": "Forbidden: Invalid Secret Token"}';
|
|
}
|
|
|
|
# ---------------------------------------------------------------------
|
|
# 🚀 PROXY PASS AL BACKEND INTERNO
|
|
# ---------------------------------------------------------------------
|
|
proxy_pass http://backend-api:8000;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Client-DN $ssl_client_s_dn; # Pasamos quien nos llamó
|
|
}
|
|
}
|