ENTERPRISE: Optimize system reliability and container deployment

Major improvements:
- Fix file manager paste operation timeout issues for small files
- Remove complex copyItem existence checks that caused hangs
- Simplify copy commands for better reliability
- Add comprehensive timeout protection for move operations
- Remove JWT debug logging for production security
- Fix nginx SSL variable syntax errors
- Default to HTTP-only mode to eliminate setup complexity
- Add dynamic SSL configuration switching in containers
- Use environment-appropriate SSL certificate paths
- Implement proper encryption architecture fixes
- Add authentication middleware to all backend services
- Resolve WebSocket timing race conditions

Breaking changes:
- SSL now disabled by default (set ENABLE_SSL=true to enable)
- Nginx configurations dynamically selected based on SSL setting
- Container paths automatically used in production environment

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

docker/Dockerfile

@@ -76,6 +76,7 @@ RUN apk add --no-cache nginx gettext su-exec && \
     chown -R node:node /app/data
 
 COPY docker/nginx.conf /etc/nginx/nginx.conf
+COPY docker/nginx-https.conf /etc/nginx/nginx-https.conf
 COPY --from=frontend-builder /app/dist /usr/share/nginx/html
 COPY --from=frontend-builder /app/src/locales /usr/share/nginx/html/locales
 RUN chown -R nginx:nginx /usr/share/nginx/html

docker/entrypoint.sh

@@ -2,9 +2,25 @@
 set -e
 
 export PORT=${PORT:-8080}
+export ENABLE_SSL=${ENABLE_SSL:-false}
+export SSL_PORT=${SSL_PORT:-8443}
+export SSL_CERT_PATH=${SSL_CERT_PATH:-/app/ssl/termix.crt}
+export SSL_KEY_PATH=${SSL_KEY_PATH:-/app/ssl/termix.key}
+
 echo "Configuring web UI to run on port: $PORT"
 
-envsubst '${PORT}' < /etc/nginx/nginx.conf > /etc/nginx/nginx.conf.tmp
+# Choose nginx configuration based on SSL setting
+# Default: HTTP-only for easy setup
+# Set ENABLE_SSL=true to use HTTPS with automatic redirect
+if [ "$ENABLE_SSL" = "true" ]; then
+    echo "SSL enabled - using HTTPS configuration with redirect"
+    NGINX_CONF_SOURCE="/etc/nginx/nginx-https.conf"
+else
+    echo "SSL disabled - using HTTP-only configuration (default)"
+    NGINX_CONF_SOURCE="/etc/nginx/nginx.conf"
+fi
+
+envsubst '${PORT} ${SSL_PORT} ${SSL_CERT_PATH} ${SSL_KEY_PATH}' < $NGINX_CONF_SOURCE > /etc/nginx/nginx.conf.tmp
 mv /etc/nginx/nginx.conf.tmp /etc/nginx/nginx.conf
 
 mkdir -p /app/data

docker/nginx-https.conf

@@ -0,0 +1,212 @@
+events {
+    worker_connections 1024;
+}
+
+http {
+    include mime.types;
+    default_type application/octet-stream;
+
+    sendfile on;
+    keepalive_timeout 65;
+
+    # SSL Configuration
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384;
+    ssl_prefer_server_ciphers off;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 10m;
+
+    # HTTP Server - Redirect to HTTPS
+    server {
+        listen ${PORT};
+        server_name localhost;
+
+        # Redirect all HTTP traffic to HTTPS
+        return 301 https://$server_name:${SSL_PORT}$request_uri;
+    }
+
+    # HTTPS Server
+    server {
+        listen ${SSL_PORT} ssl;
+        server_name localhost;
+
+        # SSL Certificate paths
+        ssl_certificate ${SSL_CERT_PATH};
+        ssl_certificate_key ${SSL_KEY_PATH};
+
+        # Security headers for HTTPS
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+        add_header X-Frame-Options DENY always;
+        add_header X-Content-Type-Options nosniff always;
+        add_header X-XSS-Protection "1; mode=block" always;
+
+        location / {
+            root /usr/share/nginx/html;
+            index index.html index.htm;
+        }
+
+        location ~ ^/users(/.*)?$ {
+            proxy_pass http://127.0.0.1:8081;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        location ~ ^/version(/.*)?$ {
+            proxy_pass http://127.0.0.1:8081;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        location ~ ^/releases(/.*)?$ {
+            proxy_pass http://127.0.0.1:8081;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        location ~ ^/alerts(/.*)?$ {
+            proxy_pass http://127.0.0.1:8081;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        location ~ ^/credentials(/.*)?$ {
+            proxy_pass http://127.0.0.1:8081;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        location /ssh/ {
+            proxy_pass http://127.0.0.1:8081;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        # WebSocket proxy for authenticated terminal connections
+        location /ssh/websocket/ {
+            # Pass to WebSocket server with authentication support
+            proxy_pass http://127.0.0.1:8082/;
+            proxy_http_version 1.1;
+
+            # WebSocket upgrade headers
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_set_header Host $host;
+            proxy_cache_bypass $http_upgrade;
+
+            # Pass client information for authentication logging
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+
+            # Important: Pass query parameters (contains JWT token)
+            proxy_pass_request_args on;
+
+            # WebSocket timeouts (longer for terminal sessions)
+            proxy_read_timeout 86400s;  # 24 hours
+            proxy_send_timeout 86400s;  # 24 hours
+            proxy_connect_timeout 10s;  # Quick auth check
+
+            # Disable buffering for real-time terminal
+            proxy_buffering off;
+            proxy_request_buffering off;
+
+            # Handle connection errors gracefully
+            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
+        }
+
+        location /ssh/tunnel/ {
+            proxy_pass http://127.0.0.1:8083;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        location /ssh/file_manager/recent {
+            proxy_pass http://127.0.0.1:8081;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        location /ssh/file_manager/pinned {
+            proxy_pass http://127.0.0.1:8081;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        location /ssh/file_manager/shortcuts {
+            proxy_pass http://127.0.0.1:8081;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        location /ssh/file_manager/ssh/ {
+            proxy_pass http://127.0.0.1:8084;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        location /health {
+            proxy_pass http://127.0.0.1:8081;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        location ~ ^/status(/.*)?$ {
+            proxy_pass http://127.0.0.1:8085;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        location ~ ^/metrics(/.*)?$ {
+            proxy_pass http://127.0.0.1:8085;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        error_page 500 502 503 504 /50x.html;
+        location = /50x.html {
+            root /usr/share/nginx/html;
+        }
+    }
+}

docker/nginx.conf

@@ -16,26 +16,12 @@ http {
     ssl_session_cache shared:SSL:10m;
     ssl_session_timeout 10m;
 
-    # HTTP Server - Redirect to HTTPS
+    # HTTP Server - Redirect to HTTPS when SSL enabled
     server {
         listen ${PORT};
         server_name localhost;
 
-        # Redirect all HTTP traffic to HTTPS
-        return 301 https://$server_name:${SSL_PORT:-8443}$request_uri;
-    }
-
-    # HTTPS Server
-    server {
-        listen ${SSL_PORT:-8443} ssl;
-        server_name localhost;
-
-        # SSL Certificate paths
-        ssl_certificate ${SSL_CERT_PATH:-/app/ssl/termix.crt};
-        ssl_certificate_key ${SSL_KEY_PATH:-/app/ssl/termix.key};
-
-        # Security headers for HTTPS
-        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+        # Security headers
         add_header X-Frame-Options DENY always;
         add_header X-Content-Type-Options nosniff always;
         add_header X-XSS-Protection "1; mode=block" always;