Redmineの設定

本番環境向けDocker・Nginx最適化を実施する。

実装内容¶

Docker本番設定¶

# docker-compose.prod.yml
version: '3.8'
services:
  mcp-gateway:
    build: 
      context: .
      dockerfile: Dockerfile.prod
    container_name: mcp-gateway
    restart: unless-stopped
    environment:
      - NODE_ENV=production
      - LOG_LEVEL=info
    volumes:
      - ./ssh-keys:/app/ssh-keys:ro
      - ./logs:/app/logs:rw
    networks:
      - proxy-network
      - unified-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          memory: 256M

  mcp-redis:
    image: redis:7-alpine
    container_name: mcp-redis
    restart: unless-stopped
    command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru
    volumes:
      - redis-data:/data
    networks:
      - unified-network

Nginx設定最適化¶

# /etc/nginx/sites-available/mcp.call2arm.com.conf
server {
    listen 80;
    server_name mcp.call2arm.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name mcp.call2arm.com;

    # SSL設定強化
    ssl_certificate /etc/letsencrypt/live/call2arm.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/call2arm.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;

    # セキュリティヘッダー
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;
    add_header X-XSS-Protection "1; mode=block";
    add_header Referrer-Policy "strict-origin-when-cross-origin";

    # Rate limiting
    limit_req_zone $binary_remote_addr zone=mcp:10m rate=10r/m;
    limit_req zone=mcp burst=20 nodelay;

    location / {
        proxy_pass http://mcp-gateway:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # SSE最適化
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_buffering off;
        proxy_cache off;
        proxy_read_timeout 300;
        proxy_connect_timeout 10;
    }

    location /health {
        proxy_pass http://mcp-gateway:3000/health;
        access_log off;
    }
}

成果物¶

• 本番Docker設定完了
• Nginx設定最適化
• SSL・セキュリティ強化

作業時間: 4時間¶

依存: Monitoring-1完了¶