fix ssl shit
This commit is contained in:
parent
3476c35c4d
commit
e418b5a342
|
@ -23,9 +23,14 @@ server {
|
|||
listen [::]:80;
|
||||
|
||||
server_name 0.vern.cc;
|
||||
include snippets/lets-encrypt.conf;
|
||||
include snippets/headers.conf;
|
||||
include common/0x0.conf;
|
||||
ssl_certificate_key /etc/letsencrypt/live/vern.cc/privkey.pem;
|
||||
ssl_certificate /etc/letsencrypt/live/vern.cc/fullchain.pem;
|
||||
ssl_dhparam /etc/letsencrypt/live/vern.cc/dhparam;
|
||||
# intermediate configuration
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
ssl_prefer_server_ciphers off;
|
||||
}
|
||||
|
||||
server {
|
||||
|
|
|
@ -62,17 +62,6 @@ server {
|
|||
# that includes both domains in order for things to work as expected.
|
||||
include snippets/lets-encrypt.conf;
|
||||
# Speeds things up a little bit when resuming a session
|
||||
ssl_session_timeout 5m;
|
||||
ssl_session_cache shared:SSL:5m;
|
||||
|
||||
# You'll need nginx 1.13.0 or better to support TLSv1.3
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
|
||||
# https://cipherli.st/
|
||||
ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
|
||||
ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header Access-Control-Allow-Origin "${allowed_origins}";
|
||||
|
|
|
@ -29,7 +29,13 @@ server {
|
|||
listen [::]:80;
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
include snippets/lets-encrypt.conf;
|
||||
ssl_certificate_key /etc/letsencrypt/live/vern.cc/privkey.pem;
|
||||
ssl_certificate /etc/letsencrypt/live/vern.cc/fullchain.pem;
|
||||
ssl_dhparam /etc/letsencrypt/live/vern.cc/dhparam;
|
||||
# intermediate configuration
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
ssl_prefer_server_ciphers off;
|
||||
include snippets/headers.conf;
|
||||
server_name mirror.vern.cc mirrors.vern.cc;
|
||||
|
||||
|
|
|
@ -1,12 +1,6 @@
|
|||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
#add_header Content-Security-Policy "default-src 'self'; font-src 'self'; img-src 'self' https://i.creativecommons.org/ https://licensebuttons.net/; style-src 'self' 'unsafe-inline'" always;
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
# intermediate configuration
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
ssl_prefer_server_ciphers off;
|
||||
add_header Referrer-Policy "same-origin" always;
|
||||
|
|
|
@ -6,6 +6,20 @@ ssl_dhparam /etc/letsencrypt/live/vern.cc/dhparam;
|
|||
|
||||
# verify chain of trust of OCSP response using Root CA and Intermediate certs
|
||||
# ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;
|
||||
ssl_session_timeout 1d;
|
||||
ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
|
||||
ssl_session_tickets off;
|
||||
|
||||
# intermediate configuration
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384;
|
||||
ssl_prefer_server_ciphers off;
|
||||
|
||||
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
|
||||
add_header Strict-Transport-Security "max-age=63072000" always;
|
||||
|
||||
# OCSP stapling
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
# replace with the IP address of your resolver
|
||||
resolver 213.186.33.99;
|
||||
resolver 173.255.236.85;
|
||||
|
|
Loading…
Reference in New Issue