nginx — TLS (Let's Encrypt), SPA statik, /api proxy, /files presigned yo'li

finalize-ep-01 yangiladi

Yangilandi: pr_url

finalize-ep-01 yangiladi

Yangilandi: branch, commit_sha

devops-1 izoh qoldirdi

Follow-up tuzatish (status o'zgartirilmadi, done qoladi). 1) Spec chetlanishi: nginx template'da `location /minio/` yozilgan edi, ADR-001 §2.7 esa `/files` deb belgilaydi -> `/files/` ga o'tkazildi. proxy_pass oxiridagi slash saqlangani uchun upstream yo'l o'zgarmaydi: /files/erpbom/<kalit> -> MinIO /erpbom/<kalit>. 2) QA ogohlantirgan SigV4 Host xavfi TASDIQLANDI va tuzatildi: presigned URL imzosi `host` header'ini qamrab oladi (X-Amz-SignedHeaders=host), `proxy_set_header Host $host` mijoz domenini uzatgani uchun imzo buzilardi. Endi `$proxy_host` (= minio:9000, MINIO_ENDPOINT hosti). HAQIQIY SO'ROV natijasi (vaqtinchalik minio+nginx stack, real template, TLS, mc 5-daqiqalik presigned GET): to'g'ridan-to'g'ri MinIO -> 200 + to'g'ri tarkib (nazorat); nginx Host $host -> 403 SignatureDoesNotMatch; nginx Host $proxy_host -> 200 + to'g'ri tarkib. `nginx -t` toza. 3) Backend'da MinIO klienti hali YO'Q (faqat common/storage/package-info.java izohi) -> presigned URL generatsiya qiluvchi kod yo'q, moslashtiradigan joy topilmadi; MINIO_ENDPOINT bog'liqligi docker-compose.yml izohida qayd etildi. 4) TEKSHIRILMAY QOLGANI: haqiqiy domen + Let's Encrypt sertifikati bilan VPS'da sinalmadi (self-signed + --resolve ishlatildi) va app<->MinIO real integratsiyasi yo'qligi sababli faqat mc generatsiya qilgan presigned URL sinaldi. Commit: a60e45c (branch feat/EP-01-erpbom-backend, push yo'q).

qa-ep-01-t04-s02 statusni o'zgartirdi Review → Bajarildi

QA 2-aylanish: AC 151 mustaqil isbotlandi (D1 certbot haqiqatan yuguradi, exit 1/3.7s ACME xatosi bilan, qotmaydi; D2 restart nginx soxta LE sertifikatni CN=QA2-FAKE-LE ga almashtirdi). Mutatsiya bilan tekshiruv haqiqiyligi isbotlandi (reload -> almashmadi), Makefile git checkout bilan tiklandi, status toza. Regressiya (health/SPA/API-404/actuator/301/ACME) va S01 (AC 144) TOZA. Commit gigiyenasi: HEAD faqat deploy/Makefile. 4/4 mezon.

qa-ep-01-t04-s02 izoh qoldirdi

QA 2-aylanish (qa-EP-01-T04-S02) — AC 151 QAYTA TEKSHIRUV. Hammasini O'ZIM yurgizdim, coder da'vosini takrorlamadim. Izolyatsiya: docker compose -p qat04s02c, o'z env faylim (BIND_ADDR=127.0.0.1, NGINX_HTTP_PORT=58080, NGINX_HTTPS_PORT=58443, ERP_DOMAIN=localhost, ERP_TLS_MODE=letsencrypt). Oxirida down -v + o'z image'larim (qat04s02c-nginx/app) o'chirildi; begona 7 konteyner (erpbom-postgres/minio/pgbouncer/redis/scratch-pg, pmboard-app-1, pmboard-web-1) boshida ham, oxirida ham 7/7 tirik, StartedAt o'zgarmagan. VERDIKT: AC 151 O'TDI -> is_met=true. 4/4 mezon. Regressiya YO'Q. Barg `done`. === [D1] certbot-init endi haqiqatan certbot'ni ishga tushiradi — TASDIQLANDI === Tuzatish: deploy/Makefile:89 `run --rm --entrypoint certbot certbot certonly ... --non-interactive`. (1) Tuzatilgan shakl: `... run --rm --entrypoint certbot certbot certonly --help` -> EXIT=0, 2.64s, certbot'ning haqiqiy help matni chiqdi (68 qator). QOTMADI. (2) NAZORAT (tuzatishdan oldingi shakl, --entrypoint'siz): `... run --rm certbot certonly --help` -> 40s timeout, EXIT=124, certbot'dan BIRORTA qator chiqmadi, orqada `Up 39 seconds` konteyner qoldi (o'zim `docker rm -f` bilan tozaladim). Ya'ni farqni aynan `--entrypoint certbot` beryapti — tekshiruvim doim-yashil emas. (3) HAQIQIY RETSEPT TANASI (Makefile:86-90 ni bash'ga ajratib oldim, make o'rnatilmagan): ERP_DOMAIN=localhost, CERTBOT_EMAIL=qa-test@example.com bilan -> 3.70s, CERTBOT_STEP_EXIT=1, chiqish: "Saving debug log to /var/log/letsencrypt/letsencrypt.log" + "Unable to register an account with ACME server. The ACME server believes qa-test@example.com is an invalid email address." Ya'ni certbot HAQIQATAN ishga tushdi, ACME serverga chiqdi va aniq exit kod bilan tez tugadi. Qotish YO'Q, jimgina o'tib ketish YO'Q, orqada qolgan konteyner YO'Q (0 ta). Soxta domen/email uchun bu kutilgan natija. === [D2] restart nginx yangi sertifikatni ko'taradi — TASDIQLANDI === Tuzatish: deploy/Makefile:91 `exec nginx nginx -s reload` -> `restart nginx`. Usul (1-aylanishdagidek): to'liq stack ERP_TLS_MODE=letsencrypt bilan ko'tarildi (postgres+minio+app+nginx+certbot, hammasi healthy). LE sertifikat yo'q -> entrypoint log: "OGOHLANTIRISH: /etc/letsencrypt/live/localhost topilmadi", `openssl s_client -connect 127.0.0.1:58443` -> subject=CN = localhost (self-signed fallback). Keyin certbot-conf volume'iga O'ZIM soxta LE sertifikat qo'ydim: /etc/letsencrypt/live/localhost/{fullchain,privkey}.pem, CN=QA2-FAKE-LE. 🔴 MUTATSIYA (avval mutant, keyin tuzatish — bir xil holat ustida): - MUTANT: Makefile:91 ni vaqtincha `$(COMPOSE_LE) exec nginx nginx -s reload` ga qaytardim (git diff: 1 fayl, 1 qator) va o'sha qatorni yurgizdim -> "signal process started", EXIT=0 (ya'ni JIMGINA "muvaffaqiyat"), lekin openssl s_client -> subject=CN = localhost. Sertifikat ALMASHMADI; /etc/nginx/certs/ hamon oddiy fayl (symlink emas). Demak tekshiruvim aynan shu tuzatishni o'lchayapti. - TIKLASH: `git checkout -- deploy/Makefile` -> Makefile:91 = `$(COMPOSE_LE) restart nginx`, `git status --porcelain` BO'SH (toza). - TUZATISH: `$(COMPOSE_LE) restart nginx` -> entrypoint log: "[erpbom-tls] Let's Encrypt sertifikat ulandi: /etc/letsencrypt/live/localhost"; openssl s_client -> subject=CN = QA2-FAKE-LE (notAfter=Sep 16 2026); /etc/nginx/certs/{fullchain,privkey}.pem ENDI symlink -> /etc/letsencrypt/live/localhost/*.pem. Ya'ni ERP_TLS_MODE=letsencrypt runbook'i (make prod-up-letsencrypt -> make certbot-init) endi uchidan-uchiga funksional. === (c) REGRESSIYA — TOZA === - https://localhost:58443/api/v1/actuator/health -> 200, CT=application/vnd.spring-boot.actuator.v3+json, {"status":"UP", db UP} - /orders/1 -> 200 text/html, 434 bayt, erpbom-web/dist/index.html bilan diff BO'SH (bayt-ma-bayt bir xil) - /api/v1/does-not-exist -> 404, CT=application/json, {"code":"NOT_FOUND","message":"So'ralgan yo'l topilmadi","request_id":...} — SPA fallback API'ni YUTMAYDI - /actuator/env -> 404 - curl -I http://localhost:58080/ -> 301 Moved Permanently; /orders/1?x=2 -> Location: https://localhost/orders/1?x=2 (URI+query saqlanadi) - /.well-known/acme-challenge/qa2token456 (certbot-www volume'iga o'zim yozdim) -> 200, body "QA2-ACME-PROOF-TOKEN" — 301 EMAS, redirect'dan to'g'ri mustasno === (d) S01 REGRESSIYASI — TOZA (AC 144 saqlangan) === - prod `docker compose config`: `published:` FAQAT nginx'da (58080, 58443). Boshqa servisda `ports:` yo'q. - docker inspect: erpbom-dev-postgres {"5432/tcp":null}, erpbom-dev-minio {"9000/tcp":null}, erpbom-app {"8080/tcp":null}, erpbom-certbot {"80/tcp":null,"443/tcp":null}; erpbom-nginx faqat 127.0.0.1:58080/58443. - host `ss -ltn`: mening stack'imdan faqat 127.0.0.1:58080 va 58443. (127.0.0.1:5432 ko'rinadi, lekin u BEGONA `erpbom-scratch-pg` konteyneri — mening postgres'im inspect'da null.) === (e) COMMIT GIGIYENASI — TOZA === - `git show --stat HEAD` (2c03eb7): FAQAT deploy/Makefile (1 fayl, +30/-4). - Oxirgi 3 commitning fayl ro'yxatida deploy/** dan tashqari yagona fayl — `.gitignore` (55f4f48, S01 commit'i, .env ni ignore qilish; oldingi aylanishda allaqachon qabul qilingan). `.github/workflows/`, `openapi/`, `src/` TEGILMAGAN. - Branch: feat/EP-01-erpbom-backend; ish oxirida `git status --porcelain` BO'SH. === 148/149/150 (yengil qayta tekshiruv) === Yuqoridagi (c) regressiyasi 148 (health 200 nginx orqali), 149 (SPA fallback + API yutilmasligi) va 150 (/actuator/env 404) ni qayta tasdiqladi. 1-aylanishdagi chuqur tekshiruv (mutatsiya M1/M2, MinIO console yopiqligi) kuchida qoladi. === NOBLOKLOVCHI ESLATMA (AC'ga kirmaydi, tuzatish talab qilinmaydi) === Makefile:86 (va 114) `set -a; source .env; set +a` — .env dagi tirnoqsiz, probelli qiymat (mas. ERP_COMPANY_NAME=Mening Kompaniyam) bash'da "command not found" beradi. Retseptni buzmaydi (xato o'lik emas) va docker compose --env-file buni boshqacha o'qiydi, lekin VPS'da real kompaniya nomi yozilganda chalg'ituvchi chiqish beradi. .env.example'da qiymatlarni tirnoq ichida ko'rsatish yetarli bo'lardi.

qa-ep-01-t04-s02 qabul mezonini belgiladi

✓ 80 → 443 redirect ishlaydi; certbot rejimi konfiguratsiyada bor (`ERP_TLS_MODE=letsencrypt`)

devops-1 statusni o'zgartirdi Ishlanyapti → Review

devops-1 izoh qoldirdi

AC 151 D1/D2 tuzatildi (commit 2c03eb7, deploy/Makefile). Isbot — izolyatsiya: docker compose -p erpqa151 (o'z test project'i), toza .env (BIND_ADDR=127.0.0.1, NGINX_HTTP_PORT=58080, NGINX_HTTPS_PORT=58443, ERP_DOMAIN=localhost, ERP_TLS_MODE=letsencrypt). Oxirida down -v bilan to'liq tozalandi, begona konteynerlar (erpbom-postgres/minio/pgbouncer/redis/scratch-pg, pmboard-*) tekkanim yo'q. [D1] Buyruq: docker compose ... --profile letsencrypt run --rm --entrypoint certbot certbot certonly --help -> 2.4s, exit 0, help chiqdi (avval --entrypoint'siz QA 40s timeout/exit 143 bilan qotgan edi — endi qotmaydi). Haqiqiy retsept tanasini domen=localhost bilan yurgizganda (ACME haqiqiy tarmoqqa chiqadi): --non-interactive'siz 90s'da timeout (124) bilan qotib qoldi va orqada 'Up' holatdagi konteyner qoldirdi (keyingi urinish 'Another instance of Certbot is already running' berdi) — bu QA aytmagan qo'shimcha qotish nuqtasi edi, --non-interactive bilan tuzatdim. Shundan keyin: exit 1, 2.7-3.6s, 'Unable to register an account... invalid email address' (ACME serverga haqiqatan yetib bordi, xato bilan tez tugadi, qotmadi) — test uchun normal, chunki qa-test@example.com/localhost haqiqiy emas. [D2] docker exec erpbom-nginx nginx -s reload (eski usul, nazorat) -> sertifikat CN=localhost (o'zgarmadi, xato tasdiqlandi). Keyin docker compose -p erpqa151 ... --profile prod --profile letsencrypt restart nginx (tuzatilgan retsept) -> entrypoint log "Let's Encrypt sertifikat ulandi" va openssl s_client -connect 127.0.0.1:58443 -servername localhost | openssl x509 -noout -subject -> CN=CODER-FAKE-LE-CERT (certbot-conf volume'iga o'zim generatsiya qilgan soxta LE sertifikat, avval self-signed CN=localhost edi). Regressiya (to'liq stack: postgres+minio+app+nginx, app build cache orqali tez ko'tarildi, hammasi healthy): /api/v1/actuator/health=200 (DB UP); /orders/1=200 index.html (SPA fallback); /api/v1/does-not-exist=404 JSON ({"code":"NOT_FOUND"...}, SPA yutmadi); /actuator/env=404; MinIO konsol porti tashqariga ochilmagan (docker port tekshirildi). 80->443: 301, Location: https://localhost/. ACME challenge (/.well-known/acme-challenge/<token>, certbot-www volume'ga qo'lda joylashtirilgan token) -> 200, redirect'dan mustasno ishladi. 148/149/150 regressiyasi YO'Q. AC 151'ni is_met qilmadim — QA hal qiladi.

qa-ep-01-t04-s02 statusni o'zgartirdi Review → Ishlanyapti

QA qaytardi: AC151 yiqildi — ERP_TLS_MODE=letsencrypt funksional emas. [D1] Makefile:63-64 certbot-init hech qachon birinchi sertifikat olmaydi (compose entrypoint override run argumentlarini yutadi; isbot: run --rm certbot certonly --help -> 40s qotib qoldi/exit 143, --entrypoint certbot bilan darhol ishladi). [D2] Makefile:65 nginx -s reload yangi sertifikatni ko-tarmaydi (certs symlink faqat container start-da, entrypoint.sh:34-36; isbot: reload-dan keyin CN=localhost, restart-dan keyin CN=QA-FAKE-LETSENCRYPT-CERT). 148/149/150 tasdiqlandi. S01 regressiya YO-Q.

qa-ep-01-t04-s02 izoh qoldirdi

QA (qa-EP-01-T04-S02) — mustaqil tekshiruv. Stack O'ZIM ko'tarildi: docker compose -p qat04s02, .env: BIND_ADDR=127.0.0.1 NGINX_HTTP_PORT=58080 NGINX_HTTPS_PORT=58443 ERP_DOMAIN=localhost. Oxirida down -v; begona konteynerlarga tegilmadi (7/7 tirik). VERDIKT: QAYTARILDI — 148/149/150 tasdiqlandi, 151 YIQILDI. === AC 148 ✅ === curl -k https://localhost:58443/api/v1/actuator/health -> 200 {"status":"UP",...db/diskSpace/ping/ssl UP} (nginx orqali; app:8080 host'ga umuman publish qilinmagan). Faqat health ochiq: /api/v1/actuator/{beans,env,configprops,loggers,mappings,metrics,heapdump,threaddump,shutdown} -> hammasi 404 JSON. Traversal urinishlari (/api/v1/actuator/health/../env) -> 404. === AC 149 ✅ === / va /orders/1 -> 200 text/html, bayt-ma-bayt BIR XIL va erpbom-web/dist/index.html bilan diff BO'SH. Haqiqiy Vite build: /assets/index-B7VJiObS.js -> 200, 283416 bayt (placeholder emas). TESKARI tekshiruv: /api/v1/does-not-exist, /api/v1/orders/999999, /api/v1/, /api/v1/foo/bar/baz -> 404 CT=application/json (SPA fallback API'ni YUTMAYDI). === AC 150 ✅ === /actuator/env, /actuator/, /actuator/beans, /actuator/heapdump -> 404. MinIO console tashqaridan yopiq: docker inspect erpbom-dev-minio -> {"9000/tcp":null} (9001 umuman publish emas), host ss -ltn da 9000/9001 YO'Q, nginx'da console proxy qilinmagan (faqat /minio/ -> minio:9000 S3 API, kredensialsiz 403). === AC 151 ❌ YIQILDI === Birinchi yarmi ✅: http://localhost:58080/ -> 301 https://localhost/ ; URI+query saqlanadi (/orders/1?x=2 -> https://localhost/orders/1?x=2). ACME challenge 301'dan TO'G'RI mustasno — certbot-www volume'iga token yozib tekshirdim: GET /.well-known/acme-challenge/testtoken123 -> 200 'QA-ACME-PROOF-TOKEN' (301 emas). default.conf.template:25-27 to'g'ri. Ikkinchi yarmi ❌ — letsencrypt rejimi ISHLAMAYDI, ikkita defekt: [D1] deploy/Makefile:63-64 + deploy/docker-compose.yml:206-210 — `make certbot-init` HECH QACHON birinchi sertifikat olmaydi. certbot servisining compose `entrypoint:` i (`/bin/sh -c "trap exit TERM; while :; do certbot renew ...; done"`) `docker compose run` argumentlarini YUTIB YUBORADI: ular sh -c skriptiga pozitsion parametr bo'lib tushadi va e'tiborsiz qoladi — konteyner renew tsikliga kirib QOTIB QOLADI. ISBOT: `... run --rm certbot certonly --help` -> 40 s dan keyin timeout bilan o'ldirildi (exit 143), certbot help CHIQMADI. NAZORAT: `... run --rm --entrypoint certbot certbot certonly --help` -> darhol help chiqdi, exit 0. Ya'ni sabab aynan entrypoint override. TUZATISH: Makefile:63 ga `--entrypoint certbot` qo'shilsin: $(COMPOSE_LE) run --rm --entrypoint certbot certbot certonly --webroot -w /var/www/certbot -d "$$ERP_DOMAIN" --email "$$CERTBOT_EMAIL" --agree-tos --no-eff-email [D2] deploy/Makefile:65 — `exec nginx nginx -s reload` yangi sertifikatni KO'TARMAYDI. /etc/nginx/certs/{fullchain,privkey}.pem symlink'lari FAQAT konteyner start'ida, /docker-entrypoint.d/50-erpbom-tls.sh (deploy/nginx/entrypoint.sh:34-36) tomonidan yaratiladi. `nginx -s reload` bu skriptni qayta yurgizmaydi. ISBOT: ERP_TLS_MODE=letsencrypt da nginx ko'tarildi (LE cert yo'q -> self-signed fallback, log: 'OGOHLANTIRISH: /etc/letsencrypt/live/localhost topilmadi'). certbot-conf volume'iga soxta LE sertifikat (CN=QA-FAKE-LETSENCRYPT-CERT) qo'ydim: `nginx -s reload` dan KEYIN -> openssl s_client: subject=CN = localhost (HAMON self-signed) `docker restart` dan KEYIN -> subject=CN = QA-FAKE-LETSENCRYPT-CERT (log: 'Let's Encrypt sertifikat ulandi') TUZATISH: Makefile:65 `$(COMPOSE_LE) exec nginx nginx -s reload` -> `$(COMPOSE_LE) restart nginx` (yoki entrypoint mantiqini reload'ga chidamli qilish). Natija: ERP_TLS_MODE=letsencrypt o'z runbook'i (make prod-up-letsencrypt -> make certbot-init) orqali haqiqiy sertifikat BERA OLMAYDI. Rejim konfiguratsiyada 'bor', lekin funksional emas. === MUTATSIYA (tekshiruv soxta emasligi isboti) === M1: default.conf.template:74-76 `location ^~ /actuator/ { return 404; }` olib tashlandi -> /actuator/env 404 -> 200 (index.html), /actuator/beans -> 200. Ya'ni AC150 tekshiruvim aynan shu qoidani o'lchayapti. M2: :107 `try_files $uri $uri/ /index.html` -> `=404` -> /orders/1 200 -> 404 (nazorat: / hamon 200, /api/v1/actuator/health hamon 200). Ya'ni AC149 chuqur yo'l tekshiruvim haqiqiy. Har ikkisidan keyin `git checkout -- deploy/nginx/templates/default.conf.template`; commit'dagi fayl bilan diff BO'SH, `git status` TOZA, baseline natijalar qayta tiklandi. === S01 REGRESSIYASI — TOZA (143/144/146 o'z holicha qoladi) === - prod `docker compose config`: `ports:` FAQAT nginx'da. Runtime: docker inspect -> postgres {"5432/tcp":null}, minio {"9000/tcp":null}, app {"8080/tcp":null}; host ss -ltn da 5432/9000/9001/8080 YO'Q (faqat 127.0.0.1:58080/58443 = nginx). AC144 saqlangan. - dev overlay ISHLAYDI: -f docker-compose.yml -f docker-compose.dev.yml --profile dev up -d -> postgres healthy (127.0.0.1:55432), minio healthy (127.0.0.1:59000/59001), minio-init logi 'Bucket created successfully local/erpbom', mc stat local/erpbom OK. AC143 saqlangan. - deploy/.env gitignored (git check-ignore -> .gitignore:6). .env.example da ERP_TLS_MODE, CERTBOT_EMAIL, NGINX_CLIENT_MAX_BODY_SIZE, BIND_ADDR, NGINX_HTTPS_PORT bor; sir qiymatlar (DB_PASSWORD/JWT_SECRET/MINIO_*) BO'SH. AC146 saqlangan. === QO'SHIMCHA (bloklovchi emas, spec muvofiqligi) === + Xavfsizlik sarlavhalari statik VA API javoblarida bor: HSTS max-age=31536000; includeSubDomains, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin. TLSv1.3 + HTTP/2 tasdiqlandi. + client_max_body_size=20m ishlaydi: 25MB POST -> 413, 1MB POST -> 404 (o'tadi). CROSS_CUTTING P. + AR-1/AR-3/AR-4 buzilmagan: compose'da pgbouncer/redis/rabbitmq yo'q; bitta ${ERP_DOMAIN} server bloki, subdomen/wildcard yo'q. + Commit gigiyenasi TOZA: git show --stat HEAD -> faqat deploy/** (6 fayl); .github/, openapi/, src/ tegilmagan. erpbom-web repo'si TOZA (status bo'sh, oxirgi commit 3baee36 — bu ish emas). === KELGUSI ISH UCHUN ESLATMA (bu subtask AC'siga kirmaydi) === - ADR §2.7 nginx yo'lini `/files` deb ataydi, amalda `/minio/` qilingan (task description ikkalasiga ruxsat beradi). MinIO integratsiyasi tushganda nom kelishib olinsin (AR-7 / 09_auth R43). - default.conf.template:94-99 `/minio/` da `proxy_set_header Host $host` — SigV4 presigned URL imzosi Host+path ustidan hisoblanadi. Ilova presigned URL'ni minio:9000 uchun generatsiya qilsa, https://<domen>/minio/... orqali imzo TEKSHIRUVDAN O'TMAYDI. MinIO taskida hisobga olinsin. - nginx access_log sukut bo'yicha to'liq query string yozadi -> presigned URL'dagi X-Amz-Signature log'ga tushadi (5 daq amal qiladi, lekin AR-7 uchun e'tiborga olinsin). - nginx inbound X-Request-Id ni o'zining $request_id bilan ALMASHTIRADI, app esa yana o'zinikini generatsiya qiladi (client 'QA-TRACE-12345' javobda aks etmadi) — uchidan-uchiga korrelyatsiya hali yo'q. - /actuator (slashsiz) va /ACTUATOR/env -> 200 index.html (SPA fallback; app'ga YETMAYDI, sizib chiqish emas). Qat'iyroq istalsa: location ~* ^/actuator(/|$).

qa-ep-01-t04-s02 qabul mezonini belgiladi

✗ 80 → 443 redirect ishlaydi; certbot rejimi konfiguratsiyada bor (`ERP_TLS_MODE=letsencrypt`)

qa-ep-01-t04-s02 qabul mezonini belgiladi

✓ `/actuator/env` nginx orqali 404/403; MinIO console porti tashqaridan yopiq

qa-ep-01-t04-s02 qabul mezonini belgiladi

✓ `https://localhost/` SPA `index.html` ni beradi, chuqur yo'l (`/orders/1`) ham `index.html` ga tushadi

qa-ep-01-t04-s02 qabul mezonini belgiladi

✓ Lokal (self-signed) rejimda `https://localhost/api/v1/actuator/health` → 200 nginx orqali

coder-ep-01-t04-s02 statusni o'zgartirdi Ishlanyapti → Review

coder-ep-01-t04-s02 fayllarni qayd etdi

6 ta fayl qayd etildi

coder-ep-01-t04-s02 qabul mezonini belgiladi

✓ 80 → 443 redirect ishlaydi; certbot rejimi konfiguratsiyada bor (`ERP_TLS_MODE=letsencrypt`)

coder-ep-01-t04-s02 qabul mezonini belgiladi

✓ `/actuator/env` nginx orqali 404/403; MinIO console porti tashqaridan yopiq

coder-ep-01-t04-s02 qabul mezonini belgiladi

✓ `https://localhost/` SPA `index.html` ni beradi, chuqur yo'l (`/orders/1`) ham `index.html` ga tushadi

coder-ep-01-t04-s02 qabul mezonini belgiladi

✓ Lokal (self-signed) rejimda `https://localhost/api/v1/actuator/health` → 200 nginx orqali

coder-ep-01-t04-s02 izoh qoldirdi

nginx qatlami tayyor: deploy/nginx/{Dockerfile,entrypoint.sh,templates/default.conf.template}, docker-compose.yml (nginx build+env+volumes, certbot servisi --profile letsencrypt, certbot-www/certbot-conf volume), .env.example (ERP_TLS_MODE, CERTBOT_EMAIL, NGINX_CLIENT_MAX_BODY_SIZE), Makefile (web-build, prod-up-letsencrypt, certbot-init). Izoh: mezon 148 yoli (/api/v1/actuator/health) ilovaning haqiqiy /actuator/health bilan mos EMAS edi (app faqat shu, REST esa /api/v1/**). Yechim: nginx location = /api/v1/actuator/health -> proxy_pass http://app:8080/actuator/health (aniq moslik), boshqa /actuator/* esa location ^~ /actuator/ { return 404; } bilan yopilgan. Java kod/openapi/ ga tegilmadi. SPA statik: erpbom-web/dist bind-volume orqali (../../erpbom-web/dist:/usr/share/nginx/html:ro) — erpbom-web repoga yozilmadi, faqat mavjud build oqildi (make web-build qoshildi kelgusi tayyorlovlar uchun). HAQIQIY TEKSHIRUV (izolyatsiyalangan test: docker compose -p erpbom-s02-test ..., .env: BIND_ADDR=127.0.0.1 NGINX_HTTP_PORT=58080 NGINX_HTTPS_PORT=58443 ERP_DOMAIN=localhost ERP_TLS_MODE=selfsigned; tugagach down -v bilan toza tozalandi, docker ps oldin/keyin bir xil): - curl -k https://localhost:58443/api/v1/actuator/health -> 200 {status:UP,...} (AC148) - https://localhost:58443/ -> 200 index.html; https://localhost:58443/orders/1 -> 200, xuddi index.html bilan bir xil (diff bosh); https://localhost:58443/api/v1/yoq-yol -> 404 JSON {code:NOT_FOUND,...} (SPA fallbackka tushmadi) (AC149) - https://localhost:58443/actuator/env -> 404; /actuator/ -> 404; /actuator/beans -> 404; docker inspect erpbom-dev-minio -> faqat {9000/tcp:null} (9001 konsol umuman publish qilinmagan) (AC150) - http://localhost:58080/ -> 301 -> https://localhost/; ERP_TLS_MODE=letsencrypt config: docker-compose.yml certbot servisi (--profile letsencrypt) + entrypoint.sh letsencrypt tarmogi + .env.example ERP_TLS_MODE/CERTBOT_EMAIL (AC151) TLS: TLSv1.3, HTTP/2 ishlaydi (curl -v tasdiqladi). nginx faqat 127.0.0.1 ga bogʻlandi (docker inspect).

coder-ep-01-t04-s02 statusni o'zgartirdi Backlog → Ishlanyapti

Agent ishni boshladi

coder-ep-01-t04-s02 ishga oldi

pm-agent bog'liqlik qo'shdi

→ EP-01-T04-S01

pm-agent yaratdi

nginx — TLS (Let's Encrypt), SPA statik, /api proxy, /files presigned yo'li