Initial commit: ROA2WEB - FastAPI + Vue.js + Telegram Bot

Modern ERP Reports Application with microservices architecture

Tech Stack:
- Backend: FastAPI + python-oracledb (Oracle DB integration)
- Frontend: Vue.js 3 + PrimeVue + Vite
- Telegram Bot: python-telegram-bot + SQLite
- Infrastructure: Shared database pool, JWT authentication, SSH tunnel

Features:
- FastAPI backend with async Oracle connection pool
- Vue.js 3 responsive frontend with PrimeVue components
- Telegram bot alternative interface
- Microservices architecture with shared components
- Complete deployment support (Linux Docker + Windows IIS)
- Comprehensive testing (Playwright E2E + pytest)

Repository Structure:
- reports-app/ - Main application (backend, frontend, telegram-bot)
- shared/ - Shared components (database pool, auth, utils)
- deployment/ - Deployment scripts (Linux & Windows)
- docs/ - Project documentation
- security/ - Security scanning and git hooks

nginx/conf/nginx.conf

@@ -0,0 +1,78 @@
+# Main Nginx configuration optimized for production
+user nginx;
+worker_processes auto;
+error_log /var/log/nginx/error.log warn;
+pid /var/run/nginx.pid;
+
+# Worker configuration
+events {
+    worker_connections 1024;
+    use epoll;
+    multi_accept on;
+}
+
+http {
+    # MIME types
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    # Logging format
+    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                    '$status $body_bytes_sent "$http_referer" '
+                    '"$http_user_agent" "$http_x_forwarded_for" '
+                    'rt=$request_time uct="$upstream_connect_time" '
+                    'uht="$upstream_header_time" urt="$upstream_response_time"';
+
+    access_log /var/log/nginx/access.log main;
+
+    # Performance optimizations
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout 65;
+    types_hash_max_size 2048;
+    server_tokens off;
+
+    # Buffer sizes
+    client_body_buffer_size 128k;
+    client_max_body_size 50m;
+    client_header_buffer_size 1k;
+    large_client_header_buffers 4 4k;
+    output_buffers 1 32k;
+    postpone_output 1460;
+
+    # Timeouts
+    client_header_timeout 30s;
+    client_body_timeout 30s;
+    send_timeout 30s;
+
+    # Gzip compression
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_min_length 1000;
+    gzip_types
+        text/plain
+        text/css
+        text/xml
+        text/javascript
+        application/json
+        application/javascript
+        application/xml+rss
+        application/atom+xml
+        image/svg+xml;
+
+    # Rate limiting
+    limit_req_zone $binary_remote_addr zone=api:10m rate=100r/m;
+    limit_req_zone $binary_remote_addr zone=static:10m rate=1000r/m;
+    limit_req_status 429;
+
+    # Connection limiting
+    limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;
+    limit_conn conn_limit_per_ip 10;
+
+    # Include configurations
+    include /etc/nginx/conf.d/*.conf;
+    include /etc/nginx/sites-enabled/*.conf;
+}

nginx/conf/security.conf

@@ -0,0 +1,16 @@
+# Security headers and configurations
+
+# Security headers
+add_header X-Frame-Options DENY always;
+add_header X-Content-Type-Options nosniff always;
+add_header X-XSS-Protection "1; mode=block" always;
+add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
+
+# HSTS (HTTP Strict Transport Security)
+add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+
+# Content Security Policy
+add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https:; frame-src 'none'; object-src 'none'; base-uri 'self';" always;
+
+# Hide server information (configured in main nginx.conf)

nginx/conf/sites-enabled/roa2web.conf

@@ -0,0 +1,172 @@
+# ROA2WEB Virtual Host Configuration
+
+# HTTP server for development (no redirect)
+server {
+    listen 80;
+    server_name localhost roa2web.local;
+    
+    # Let's Encrypt challenge (for future production use)
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+    
+    # Development: serve content directly via HTTP
+    location /api/ {
+        proxy_pass http://roa_backend;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+    
+    location /health {
+        proxy_pass http://roa_backend/health;
+        proxy_set_header Host $host;
+    }
+    
+    location /api/health {
+        proxy_pass http://roa_backend/health;
+        proxy_set_header Host $host;
+    }
+    
+    location / {
+        proxy_pass http://roa_frontend;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+}
+
+# HTTPS main server (disabled for development)
+# server {
+#     listen 443 ssl http2;
+#     server_name localhost roa2web.local;
+#     
+#     # SSL configuration
+#     include /etc/nginx/conf.d/ssl.conf;
+#     
+#     # Security headers
+#     include /etc/nginx/conf.d/security.conf;
+#     
+#     # Logging
+#     access_log /var/log/nginx/roa2web_access.log main;
+#     error_log /var/log/nginx/roa2web_error.log warn;
+#     
+#     # API routes - proxy to FastAPI backend
+#     location /api/ {
+#         # Rate limiting for API
+#         limit_req zone=api burst=20 nodelay;
+#         
+#         # Proxy configuration
+#         proxy_pass http://roa_backend;
+#         proxy_set_header Host $host;
+#         proxy_set_header X-Real-IP $remote_addr;
+#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+#         proxy_set_header X-Forwarded-Proto $scheme;
+#         proxy_set_header X-Forwarded-Host $host;
+#         proxy_set_header X-Forwarded-Port $server_port;
+#         
+#         # Timeouts
+#         proxy_connect_timeout 30s;
+#         proxy_send_timeout 30s;
+#         proxy_read_timeout 30s;
+#         
+#         # Buffering
+#         proxy_buffering on;
+#         proxy_buffer_size 4k;
+#         proxy_buffers 8 4k;
+#         
+#         # No caching for API responses
+#         add_header Cache-Control "no-cache, no-store, must-revalidate";
+#         add_header Pragma "no-cache";
+#         add_header Expires "0";
+#     }
+#     
+#     # Health check endpoints
+#     location /health {
+#         access_log off;
+#         proxy_pass http://health_backend/health;
+#         proxy_set_header Host $host;
+#     }
+#     
+#     # Backend health check
+#     location /api/health {
+#         access_log off;
+#         proxy_pass http://roa_backend/health;
+#         proxy_set_header Host $host;
+#     }
+#     
+#     # Static assets with caching
+#     location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+#         limit_req zone=static burst=50 nodelay;
+#         
+#         proxy_pass http://roa_frontend;
+#         proxy_set_header Host $host;
+#         
+#         # Long-term caching for assets with hash
+#         expires 1y;
+#         add_header Cache-Control "public, immutable";
+#         add_header Vary "Accept-Encoding";
+#         
+#         # Gzip compression
+#         gzip_static on;
+#     }
+#     
+#     # Frontend SPA - everything else goes to Vue.js
+#     location / {
+#         limit_req zone=static burst=100 nodelay;
+#         
+#         proxy_pass http://roa_frontend;
+#         proxy_set_header Host $host;
+#         proxy_set_header X-Real-IP $remote_addr;
+#         proxy_set_header X-Forwarded-for $proxy_add_x_forwarded_for;
+#         proxy_set_header X-Forwarded-Proto $scheme;
+#         
+#         # Short caching for HTML files
+#         add_header Cache-Control "no-cache, must-revalidate";
+#         expires 5m;
+#     }
+#     
+#     # Deny access to sensitive files
+#     location ~ /\. {
+#         deny all;
+#         access_log off;
+#         log_not_found off;
+#     }
+#     
+#     location ~ \.(sql|env|key|pem)$ {
+#         deny all;
+#         access_log off;
+#         log_not_found off;
+#     }
+# }
+
+# Development HTTP server (for local development)
+server {
+    listen 8080;
+    server_name dev.localhost;
+    
+    # Simple HTTP setup for development
+    location /api/ {
+        proxy_pass http://roa_backend;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+    
+    location /health {
+        proxy_pass http://roa_backend/health;
+        proxy_set_header Host $host;
+    }
+    
+    location /api/health {
+        proxy_pass http://roa_backend/health;
+        proxy_set_header Host $host;
+    }
+    
+    location / {
+        proxy_pass http://roa_frontend;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+}

nginx/conf/ssl.conf

@@ -0,0 +1,26 @@
+# SSL/TLS Configuration
+# Modern SSL configuration for security
+
+# SSL protocols and ciphers
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+ssl_prefer_server_ciphers off;
+
+# SSL session configuration
+ssl_session_cache shared:SSL:10m;
+ssl_session_timeout 10m;
+ssl_session_tickets off;
+
+# OCSP stapling
+ssl_stapling on;
+ssl_stapling_verify on;
+
+# SSL optimization
+ssl_buffer_size 8k;
+
+# Default SSL certificate paths (to be replaced by Let's Encrypt)
+# ssl_certificate /etc/ssl/certs/roa2web.crt;
+# ssl_certificate_key /etc/ssl/private/roa2web.key;
+
+# Diffie-Hellman parameters
+ssl_dhparam /etc/ssl/certs/dhparam.pem;

nginx/conf/upstream.conf

@@ -0,0 +1,19 @@
+# Upstream configuration for load balancing
+
+# Backend FastAPI services
+upstream roa_backend {
+    server roa-backend:8000 max_fails=3 fail_timeout=30s;
+    keepalive 32;
+}
+
+# Frontend services (for direct access if needed)
+upstream roa_frontend {
+    server roa-frontend:3000 max_fails=3 fail_timeout=30s;
+    keepalive 32;
+}
+
+# Health check backend
+upstream health_backend {
+    server roa-backend:8000;
+    keepalive 2;
+}