From 9f8038d5f499bb215c97367870e365f07d3df361 Mon Sep 17 00:00:00 2001 From: Boban Blaskovic Date: Mon, 1 Jun 2026 00:18:14 +0200 Subject: [PATCH] =?UTF-8?q?Site=20Details:=203=20new=20tabs=20=E2=80=94=20?= =?UTF-8?q?vHost=20/=20SSL-TLS=20/=20SSH-FTP?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit vHost tab: - HTTP-version segmented (HTTP/1.1 | HTTP/2 | HTTP/3 QUIC). - vhost config grid: server_name, document_root, client_max_body_size, keepalive_timeout, worker_connections, access_log. - 5 toggle-rows: HTTP→HTTPS redirect, HSTS, Brotli+gzip, server_tokens, HTTP/2 server push. - Custom Headers kv-card (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). - Rate Limit kv-card (/wp-login.php 5 req/min, /xmlrpc.php blocked). - Actions: 'nginx -t (Syntax-Check)', 'vHost speichern + reload'. SSL / TLS tab: - Cert-Provider segmented (Let's Encrypt | Cloudflare Origin | Custom). - CN + SAN + TLS-min (1.2 | 1.3) + Cipher Suite (Mozilla Modern/ Intermediate/Old). - 4 toggle-rows: OCSP Stapling, Auto-Renewal, CAA-Check, CT-Log. - Cert Details card (Issuer, Signature ECDSA P-256, Key 256-bit, Issued/Expires dates, SSL-Labs A+). - Bisherige Zertifikate table. - Actions: download, renew now, save+reload. SSH / FTP tab: - SSH-Benutzer table (deploy/m.weber/ci-bot) with username, public-key fingerprint, shell, last-login, scope pill, row actions for rotate-key + delete. - SFTP table (redakteur/backup-puller) with chroot, protocol pill, quota, last-upload. - Zugriffs-Policy card: 5 toggle-rows (password-auth off, root-login no, fail2ban, IP-allowlist, 2FA-SSH). - Actions: 'Public Key importieren', 'SSH/SFTP-Benutzer anlegen'. Volt state: httpVersion, hsts, hstsMaxAge, forceHttps, brotli, tlsMin, sslProvider — all wire:click-toggleable via $set/$toggle. All 5 site-details Pest tests still green. --- .../views/livewire/pages/sites/show.blade.php | 315 +++++++++++++++++- 1 file changed, 314 insertions(+), 1 deletion(-) diff --git a/app/resources/views/livewire/pages/sites/show.blade.php b/app/resources/views/livewire/pages/sites/show.blade.php index 54ab9ed..9a2a6f1 100644 --- a/app/resources/views/livewire/pages/sites/show.blade.php +++ b/app/resources/views/livewire/pages/sites/show.blade.php @@ -18,6 +18,15 @@ new #[Layout('layouts.app')] class extends Component { /** Set of dir paths currently expanded in file tree. */ public array $openDirs = ['htdocs', 'htdocs/wp-content', 'htdocs/wp-content/themes', 'htdocs/wp-content/themes/storefront-child', 'logs']; + /** vhost / http / tls settings (in-memory for now). */ + public string $httpVersion = 'http2'; // http1 | http2 | http3 + public bool $hsts = true; + public int $hstsMaxAge = 31536000; + public bool $forceHttps = true; + public bool $brotli = true; + public string $tlsMin = '1.3'; + public string $sslProvider = 'letsencrypt'; // letsencrypt | custom | cloudflare + public function mount(Site $site): void { $this->site = $site->load(['server', 'certificate', 'crons']); @@ -320,7 +329,7 @@ new #[Layout('layouts.app')] class extends Component { {{-- ── Tab bar ── --}}
- @foreach (['overview' => ['Übersicht', ''], 'wp' => ['WordPress', ''], 'php' => ['PHP / ini', ''], 'files' => ['Datei-Manager', ''], 'cron' => ['Cronjobs', ''], 'logs' => ['Logs', '']] as $key => [$label, $svg]) + @foreach (['overview' => ['Übersicht', ''], 'wp' => ['WordPress', ''], 'vhost' => ['vHost', ''], 'ssl' => ['SSL / TLS', ''], 'access' => ['SSH / FTP', ''], 'php' => ['PHP / ini', ''], 'files' => ['Datei-Manager', ''], 'cron' => ['Cronjobs', ''], 'logs' => ['Logs', '']] as $key => [$label, $svg])
@endif + {{-- ────── VHOST ────── --}} + @if ($tab === 'vhost') +
+
+
+

+ + Virtual Host +

+ {{ $site->domain }} · nginx +
+
+ {{-- HTTP version --}} +
+ +
+ @foreach (['http1' => 'HTTP/1.1', 'http2' => 'HTTP/2', 'http3' => 'HTTP/3 (QUIC)'] as $v => $lbl) + + @endforeach +
+ HTTP/3 nutzt QUIC über UDP — schneller bei verlustbehafteten Verbindungen. +
+ +
+
+ +
+
+
+ +
+
+
+ +
M
+
+
+ +
sek
+
+
+ +
+
+
+ +
+
+
+ +
+
+
HTTP → HTTPS Redirect
alle :80 anfragen mit 301 auf https umleiten
+ +
+
+
HSTS (Strict-Transport-Security)
browser merkt sich https-only für {{ number_format($hstsMaxAge / 86400, 0, ',', '.') }} tage
+ +
+
+
Brotli + gzip Kompression
text-assets vor auslieferung komprimieren
+ +
+
+
server_tokens off
nginx-version aus header entfernen
+ +
+
+
HTTP/2 Server Push
kritische assets im voraus an client streamen
+ +
+
+
+
+ + +
+
+ +
+
+

Custom Headers

+
+
X-Frame-OptionsSAMEORIGIN
+
X-Content-Type-Optionsnosniff
+
Referrer-Policystrict-origin
+
Permissions-Policycamera=(), mic=()
+
+
+
+

Rate Limit

aktiv
+
+
Zone-Größe10 MB
+
/wp-login.php5 req / min
+
/xmlrpc.phpgeblockt
+
Burst20
+
+
+
+
+ @endif + + {{-- ────── SSL / TLS ────── --}} + @if ($tab === 'ssl') +
+
+
+

+ + SSL / TLS Zertifikat +

+ gültig · 54 tage +
+
+
+ +
+ @foreach (['letsencrypt' => "Let's Encrypt", 'cloudflare' => 'Cloudflare Origin', 'custom' => 'Custom Upload'] as $v => $lbl) + + @endforeach +
+
+ +
+
+ +
+
+
+ +
+
+
+ +
+ @foreach (['1.2' => 'TLS 1.2', '1.3' => 'TLS 1.3'] as $v => $lbl) + + @endforeach +
+
+
+ + +
+
+ +
+
+
OCSP Stapling
cert-revocation-status mit response cachen
+ +
+
+
Auto-Renewal
erneuerung 30 tage vor ablauf
+ +
+
+
CAA-Record-Check
vor neuausstellung dns-caa prüfen
+ +
+
+
Certificate Transparency Log
cert in öffentliches ct-log eintragen
+ +
+
+
+
+ + + +
+
+ +
+
+

Cert Details

+
+
AusstellerLet's Encrypt R3
+
SignaturECDSA P-256
+
Schlüsselgröße256 bit
+
Ausgestellt am2026-03-22
+
Läuft ab am2026-06-20
+
SSL-Labs RatingA+
+
+
+
+

Bisherige Zertifikate

+
+ + + + + + + +
AusgestelltAbgelaufenStatus
2026-03-222026-06-20aktuell
2025-12-212026-03-21ersetzt
2025-09-222025-12-21ersetzt
+
+
+
+
+ @endif + + {{-- ────── SSH / FTP ────── --}} + @if ($tab === 'access') +
+ {{-- SSH-Users --}} +
+
+

+ + SSH-Benutzer +

+ key-only · password-auth aus +
+
+ + + + + + + +
UsernamePublic KeyShellLetzter LoginScope
deployssh-ed25519 AAAAC3NzaC1l…7Q deploy@bergmann/bin/bashvor 14 min/var/www/bergmann
m.weberssh-ed25519 AAAAC3NzaC1l…1F m.weber@laptop/bin/bashheute, 09:42/var/www/bergmann
ci-botssh-rsa AAAAB3NzaC1y…XY github-actions/usr/bin/rrsyncvor 2hdeploy only
+
+
+ + +
+
+ + {{-- SFTP / FTP-Users --}} +
+
+

SFTP / FTP-Benutzer

+ chroot · explicit-tls erzwungen +
+
+ + + + + + +
UsernameChrootProtokollQuotaLetzter Upload
redakteur/uploads/2026SFTP2.4 / 5 GBheute, 11:02
backup-puller/backupsSFTP128 GBheute, 03:00
+
+
+ +
+
+ + {{-- Security policy --}} +
+

Zugriffs-Policy

+
+
+
Password-Auth deaktiviert
SSH nur über Public-Key zulassen
+ +
+
+
Root-Login verbieten
PermitRootLogin no
+ +
+
+
fail2ban (3 Versuche → 1h Ban)
automatische IP-Sperre nach fehlversuchen
+ +
+
+
IP-Allowlist
SSH nur aus 10.10.0.0/16 + büro-WAN
+ +
+
+
2FA für SSH (Google Authenticator)
zusätzlich zum public key
+ +
+
+
+ +
+
+
+ @endif + {{-- ────── WP + PHP (kompakte Hardcoded-Konfig nach Template) ────── --}} @if ($tab === 'wp')