Добавлены веб-приложение и сервер

config/main.py

@@ -15,6 +15,20 @@ config.read(
 
 
 class Main:
+    host = config.get(
+        section='Main',
+        option='host',
+        fallback='localhost',
+    )
+    port = config.getint(
+        section='Main',
+        option='port',
+    )
+    title = config.get(
+        section='Main',
+        option='title',
+        fallback='CIT IS Bot',
+    )
     cwd = config.get(
         section='Main',
         option='cwd',

main.py

@@ -1,7 +1,22 @@
 import asyncio
 
+import uvicorn
+
 from bot import bot, dp
+import config
+from web import app
+from server import Server
 
 
-if __name__ == "__main__":
+if __name__ == '__main__':
+    config = uvicorn.Config(
+        app=app,
+        host=config.Main.host,
+        port=config.Main.port,
+    )
+    server = Server(
+        config=config,
+    )
+
+    with server.run_in_thread():
         asyncio.run(dp.run_polling(bot))

nginx/main.conf

@@ -0,0 +1,29 @@
+server {
+    listen                  212.109.196.217:443 ssl;
+    listen                  [2a01:230:4:700::6969]:443 ssl;
+
+    server_name             cit.csasq.ru;
+    server_tokens           off;
+
+    ssl_certificate         /etc/letsencrypt/live/csasq.ru/fullchain.pem;
+    ssl_certificate_key     /etc/letsencrypt/live/csasq.ru/privkey.pem;
+
+    keepalive_timeout       30;
+
+    location / {
+        include                 /opt/cit-is-bot/nginx/secure-headers.conf;
+        include                 ./conf.d/http-proxy.conf;
+
+        proxy_pass              http://cit.csasq.ru;
+    }
+
+    location /static/ {
+        include                 /opt/cit-is-bot/nginx/secure-headers.conf;
+        include                 ./conf.d/gzip.conf;
+
+        root                    /opt/cit-is-bot;
+        expires                 -1;
+
+        add_header              Service-Worker-Allowed /;
+    }
+}

nginx/secure-headers.conf

@@ -0,0 +1,6 @@
+add_header	Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; script-src 'self' 'unsafe-inline' https://esm.run https://cdn.jsdelivr.net; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; media-src 'self' blob:; worker-src 'self' blob:";
+add_header	X-Frame-Options "DENY";
+add_header	X-Content-Type-Options "nosniff";
+add_header	Strict-Transport-Security "max-age=31536000; includeSubDomains";
+add_header	Referrer-Policy "origin";
+add_header	X-XSS-Protection "1; mode=block; report=mailto:security@csasq.ru";

requirements.txt

@@ -1,5 +1,8 @@
 aiogram
 APScheduler
+fastapi
+jinja2
 psycopg[binary]
 pydantic
 redis
+uvicorn

server/__init__.py

@@ -0,0 +1 @@
+from .main import Server

server/main.py

@@ -0,0 +1,21 @@
+import contextlib
+import time
+import threading
+
+import uvicorn
+
+
+class Server(uvicorn.Server):
+    @contextlib.contextmanager
+    def run_in_thread(self):
+        thread = threading.Thread(
+            target=self.run,
+        )
+        thread.start()
+        try:
+            while not self.started:
+                time.sleep(1e-3)
+            yield
+        finally:
+            self.should_exit = True
+            thread.join()

web/__init__.py

@@ -0,0 +1 @@
+from .main import app

web/main.py

@@ -0,0 +1,15 @@
+from fastapi import FastAPI
+
+import config
+
+
+app = FastAPI(
+    title=config.Main.title,
+)
+
+
+@app.get(
+    path='/',
+)
+async def _():
+    return ';-)'