docs: nginx TLS с корпоративным wildcard VeriSign

deploy/README.md

@@ -5,7 +5,8 @@
 1. [docs/install-ubuntu-24.04-native.md](../docs/install-ubuntu-24.04-native.md)
 2. `deploy/env.native.example` → `/opt/security-alert-center/config/sac-api.env`
 3. `deploy/systemd/sac-api.service` → `/etc/systemd/system/`
-4. `deploy/nginx/sac.conf.example` → `/etc/nginx/sites-available/sac`
+4. `deploy/nginx/sac.conf.tls.example` → `/etc/nginx/sites-available/sac` (wildcard TLS)  
+   или `sac.conf.example` — только HTTP / отладка
 
 ## Альтернатива: Docker
 

deploy/nginx/sac.conf.tls.example

@@ -0,0 +1,48 @@
+# /etc/nginx/sites-available/sac
+# HTTPS с корпоративным wildcard-сертификатом (например VeriSign / DigiCert).
+# Покрывает sac.kalinamall.ru при CN/SAN *.kalinamall.ru или sac.kalinamall.ru
+#
+# Перед включением:
+#   1) Положите fullchain и ключ (см. docs/install-ubuntu-24.04-native.md §9)
+#   2) Подставьте пути в ssl_certificate / ssl_certificate_key ниже
+#   3) sudo nginx -t && sudo systemctl reload nginx
+
+upstream sac_api {
+    server 127.0.0.1:8000;
+    keepalive 8;
+}
+
+# Редирект HTTP → HTTPS
+server {
+    listen 80;
+    listen [::]:80;
+    server_name sac.kalinamall.ru;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name sac.kalinamall.ru;
+
+    # --- замените пути на ваши файлы wildcard ---
+    ssl_certificate     /etc/ssl/sac/fullchain.pem;
+    ssl_certificate_key /etc/ssl/sac/privkey.pem;
+
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:SAC_SSL:10m;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers off;
+
+    client_max_body_size 2m;
+
+    location / {
+        proxy_pass http://sac_api;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 60s;
+    }
+}