FIX: Update Nginx fallback and SSL mount for Zero-Exposure architecture

docker-compose.yml

@@ -50,6 +50,7 @@ services:
       - ./nginx/conf.d:/etc/nginx/conf.d:ro
       - ./site/static:/usr/share/nginx/html/static:ro
       - ./certbot/www:/var/www/certbot:ro
+      - ./certbot/certs:/etc/letsencrypt:ro
     networks:
       - shield_net
     depends_on:

nginx/conf.d/default.conf

@@ -16,25 +16,63 @@ server {
     }
 }
 
-# 2. Порт 8080: Внутренний Fallback для Xray (Сеть shield_net)
+# 2. Порт 8080: Внутренний HTTP Fallback для Xray
 server {
     listen 8080 default_server;
     server_name _;
 
     client_max_body_size 16M;
 
-    # Статические файлы сайта Клуба ЖПЧХ (CSS, галерея)
     location /static/ {
         alias /usr/share/nginx/html/static/;
         expires 7d;
         add_header Cache-Control "public, no-transform";
     }
 
-    # Секретный шлюз выдачи подписок 3X-UI
-    # Маскируется под API клубных рецептов/архивов:
-    # URL: https://DOMAIN/api/v1/recipes/secret_TOKEN/SUB_ID
-    location ~ ^/api/v1/recipes/secret_([a-zA-Z0-9]+)/(.*)$ {
-        proxy_pass http://3x-ui:2053/sub/$2;
+    location ~ ^/api/v1/recipes/secret_([a-zA-Z0-9_]+)/(.*)$ {
+        resolver 127.0.0.11 valid=10s;
+        proxy_pass http://3x-ui:2096/sub/$2;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_connect_timeout 5s;
+        proxy_read_timeout 15s;
+    }
+
+    location / {
+        proxy_pass http://jpchx-app:8080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_connect_timeout 5s;
+        proxy_read_timeout 30s;
+    }
+}
+
+# 3. Порт 8443: Защищенный HTTPS Fallback для Reality SNI
+server {
+    listen 8443 ssl default_server;
+    server_name jpchx.matrixhasyou.ru;
+
+    ssl_certificate /etc/letsencrypt/live/jpchx.matrixhasyou.ru/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/jpchx.matrixhasyou.ru/privkey.pem;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+
+    client_max_body_size 16M;
+
+    location /static/ {
+        alias /usr/share/nginx/html/static/;
+        expires 7d;
+        add_header Cache-Control "public, no-transform";
+    }
+
+    location ~ ^/api/v1/recipes/secret_([a-zA-Z0-9_]+)/(.*)$ {
+        resolver 127.0.0.11 valid=10s;
+        proxy_pass http://3x-ui:2096/sub/$2;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -43,7 +81,6 @@ server {
         proxy_read_timeout 15s;
     }
 
-    # Полноценный сайт и интерактивный форум Клуба ЖПЧХ
     location / {
         proxy_pass http://jpchx-app:8080;
         proxy_set_header Host $host;