IIS Configuration Guide v0.1 — CXK Tuổi Bạc

Phiên bản: 0.1 DRAFT
Server: Windows Server 2022 + IIS 10
Backend: FastAPI (Python 3.12) via HttpPlatformHandler

1. Architecture Overview

NCT Browser/Voice ──► IIS (port 443/80)
                        │
                        ├─► Static files (HTML/CSS/JS)
                        │
                        └─► /api/* ──► HttpPlatformHandler
                                        │
                                        └─► FastAPI (uvicorn, port 8000)
                                              │
                                              ├─► Knowledge Base (files/MSSQL)
                                              ├─► LLM API (Gemini/GPT)
                                              └─► Audit Log (MSSQL)

2. Prerequisites

# Install IIS features
Install-WindowsFeature Web-Server,Web-WebSockets,Web-Asp-Net45 -IncludeManagementTools

# Install HttpPlatformHandler v1.2
# Download from: https://www.iis.net/downloads/microsoft/httpplatformhandler
# Or via Web Platform Installer

# Install Python 3.12
# Download from: https://www.python.org/downloads/
# Ensure added to PATH

# Install FastAPI dependencies
pip install fastapi uvicorn python-multipart pyodbc

3. IIS Site Configuration

web.config

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <system.webServer>
    <handlers>
      <add name="httpPlatformHandler" 
           path="api/*" 
           verb="*" 
           modules="httpPlatformHandler" 
           resourceType="Unspecified" />
    </handlers>

    <httpPlatform 
      processPath="C:\Python312\python.exe"
      arguments="-m uvicorn app.main:app --host 127.0.0.1 --port %HTTP_PLATFORM_PORT%"
      stdoutLogEnabled="true"
      stdoutLogFile=".\logs\stdout"
      startupTimeLimit="60"
      requestTimeout="00:05:00">
      <environmentVariables>
        <environmentVariable name="PYTHONPATH" value="." />
        <environmentVariable name="CXK_DB_CONNECTION" 
          value="Driver={ODBC Driver 18 for SQL Server};Server=localhost;Database=CXK_TuoiBac;Trusted_Connection=yes;" />
        <environmentVariable name="CXK_ENV" value="production" />
      </environmentVariables>
    </httpPlatform>

    <!-- Static files -->
    <staticContent>
      <mimeMap fileExtension=".json" mimeType="application/json" />
      <mimeMap fileExtension=".woff2" mimeType="font/woff2" />
    </staticContent>

    <!-- Security headers -->
    <httpProtocol>
      <customHeaders>
        <add name="X-Content-Type-Options" value="nosniff" />
        <add name="X-Frame-Options" value="DENY" />
        <add name="X-XSS-Protection" value="1; mode=block" />
        <add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains" />
        <add name="Content-Security-Policy" 
             value="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com" />
      </customHeaders>
    </httpProtocol>

    <!-- HTTPS redirect -->
    <rewrite>
      <rules>
        <rule name="HTTP to HTTPS redirect" stopProcessing="true">
          <match url="(.*)" />
          <conditions>
            <add input="{HTTPS}" pattern="off" ignoreCase="true" />
          </conditions>
          <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" 
                  redirectType="Permanent" />
        </rule>
      </rules>
    </rewrite>
  </system.webServer>
</configuration>

4. SSL Certificate

# Option 1: Let's Encrypt via win-acme
# Download: https://github.com/win-acme/win-acme

# Option 2: Self-signed for dev
New-SelfSignedCertificate -DnsName "cxk.local" -CertStoreLocation cert:\LocalMachine\My

5. Application Pool Settings

6. Firewall Rules

# Allow HTTPS
New-NetFirewallRule -DisplayName "CXK HTTPS" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow

# Allow HTTP (redirect only)
New-NetFirewallRule -DisplayName "CXK HTTP" -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow

# Block direct FastAPI access
New-NetFirewallRule -DisplayName "Block FastAPI Direct" -Direction Inbound -Protocol TCP -LocalPort 8000 -Action Block

7. Health Check Endpoint

FastAPI should expose GET /api/health:

{
  "status": "healthy",
  "version": "0.1.0",
  "db_connected": true,
  "kb_items_count": 19,
  "timestamp": "2026-09-28T10:00:00Z"
}

IIS Health Check monitoring via Application Request Routing.

8. Deployment Checklist

• [ ] Windows Server 2022 updated
• [ ] IIS installed with WebSockets + HttpPlatformHandler
• [ ] Python 3.12 installed
• [ ] MSSQL 2022 running, CXK_TuoiBac database created
• [ ] SSL certificate installed
• [ ] web.config deployed
• [ ] FastAPI app deployed
• [ ] Firewall rules applied
• [ ] Health check passing
• [ ] Audit log writing to MSSQL