fix: nginx proxy timeout for long SSH/WinRM agent actions (0.20.3)

Raise proxy_read_timeout to 960s for agent-update and related API paths so bootstrap git clone does not hit 504 from nginx.

backend/app/version.py

@@ -1,5 +1,5 @@
 """Единый источник версии SAC (API, health, логи, OpenAPI)."""
 
 APP_NAME = "Security Alert Center"
-APP_VERSION = "0.20.2"
+APP_VERSION = "0.20.3"
 APP_VERSION_LABEL = f"{APP_NAME} v.{APP_VERSION}"

deploy/nginx/sac.conf.example

@@ -31,6 +31,19 @@ server {
 
     client_max_body_size 2m;
 
+    # SSH/WinRM и git-probe: backend ждёт до 900s
+    location ~ ^/api/v1/(hosts/[0-9]+/actions/(agent-update|agent-update-fallback|ssh-test|winrm-test)|settings/agent-updates/test-git) {
+        proxy_pass http://sac_api;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_connect_timeout 30s;
+        proxy_send_timeout 960s;
+        proxy_read_timeout 960s;
+    }
+
     location / {
         proxy_pass http://sac_api;
         proxy_http_version 1.1;

deploy/nginx/sac.conf.tls.example

@@ -56,6 +56,19 @@ server {
 
     client_max_body_size 2m;
 
+    # SSH/WinRM и git-probe: backend ждёт до 900s
+    location ~ ^/api/v1/(hosts/[0-9]+/actions/(agent-update|agent-update-fallback|ssh-test|winrm-test)|settings/agent-updates/test-git) {
+        proxy_pass http://sac_api;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_connect_timeout 30s;
+        proxy_send_timeout 960s;
+        proxy_read_timeout 960s;
+    }
+
     location / {
         proxy_pass http://sac_api;
         proxy_http_version 1.1;

tools/patch-nginx-sac-long-timeout.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# Одноразовый hotfix: увеличить proxy_read_timeout для долгих SSH/WinRM API.
+# Запуск на SAC-сервере: sudo bash patch-nginx-sac-long-timeout.sh
+set -euo pipefail
+
+CFG="${SAC_NGINX_SITE:-/etc/nginx/sites-available/sac}"
+
+if [[ "$(id -u)" -ne 0 ]]; then
+  echo "Run as root: sudo bash $0" >&2
+  exit 1
+fi
+
+if [[ ! -f "$CFG" ]]; then
+  echo "Config not found: $CFG" >&2
+  exit 1
+fi
+
+if grep -q 'agent-update-fallback' "$CFG"; then
+  echo "Already patched: $CFG"
+else
+  cp "$CFG" "${CFG}.bak-$(date +%Y%m%d%H%M%S)"
+  python3 - "$CFG" <<'PY'
+import sys
+from pathlib import Path
+
+path = Path(sys.argv[1])
+text = path.read_text(encoding="utf-8")
+block = """
+    # SSH/WinRM и git-probe: backend ждёт до 900s
+    location ~ ^/api/v1/(hosts/[0-9]+/actions/(agent-update|agent-update-fallback|ssh-test|winrm-test)|settings/agent-updates/test-git) {
+        proxy_pass http://sac_api;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_connect_timeout 30s;
+        proxy_send_timeout 960s;
+        proxy_read_timeout 960s;
+    }
+
+"""
+needle = "    location / {"
+if needle not in text:
+    raise SystemExit(f"needle not found in {path}")
+path.write_text(text.replace(needle, block + needle, 1), encoding="utf-8")
+print(f"Patched {path}")
+PY
+fi
+
+nginx -t
+systemctl reload nginx
+echo "nginx reloaded OK"