commit e25a99c

grunfink  ·  2024-01-06 06:16:58 +0000 UTC
parents 5e2f4e9, f86f688 
Merge pull request 'improvement(nginx): Adjust nginx template to proper SSL/TLS cipher & protocols' (#98) from gyptazy/snac2:feature/adjust-nginx-ssl-tls-config into master

Reviewed-on: https://codeberg.org/grunfink/snac2/pulls/98
3 files changed,  +39, -0
M examples/nginx-alpine-ssl/Dockerfile
M examples/nginx-alpine-ssl/default.conf
A examples/nginx-alpine-ssl/dhparam.pem
M examples/nginx-alpine-ssl/Dockerfile
+1, -0 
1@@ -3,6 +3,7 @@ RUN apk add nginx
2 RUN mkdir -p /run/nginx
3 ADD default.conf /etc/nginx/http.d/default.conf
4 ADD *.key /etc/ssl/private/
5+ADD *.pem /etc/ssl/private/
6 ADD *.crt /etc/ssl/certs/
7 WORKDIR /var/www/localhost/htdocs
8 COPY entrypoint.sh /usr/local/bin
M examples/nginx-alpine-ssl/default.conf
+25, -0 
 1@@ -3,8 +3,33 @@ server {
 2     listen [::]:80 default_server;
 3     listen 443 ssl http2 default_server;
 4     listen [::]:443 ssl http2 default_server;
 5+
 6+    # SSL configuration
 7+    # SSL cert/key files
 8     ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
 9     ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
10+    # For production regenerate this dhparam key by running:
11+    # $> openssl dhparam -out dhparam.pem 4096
12+    ssl_dhparam /etc/ssl/private/dhparam.pem;
13+
14+    # SSL ciphers/protocols
15+    ssl_protocols TLSv1.3 TLSv1.2;
16+    ssl_prefer_server_ciphers on;
17+    ssl_ecdh_curve secp521r1:secp384r1;
18+    ssl_ciphers EECDH+AESGCM:EECDH+AES256;
19+
20+    # SSL misc
21+    ssl_session_cache shared:TLS:2m;
22+    ssl_buffer_size 4k;
23+
24+    # OCSP stapling
25+    ssl_stapling on;
26+    ssl_stapling_verify on;
27+    resolver 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]; # Cloudflare
28+
29+    # Set HSTS to 365 days
30+    # Note: Activate this on production usage
31+    #add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload' always;
32 
33     location /.well-known/webfinger {
34         proxy_http_version      1.1;
A examples/nginx-alpine-ssl/dhparam.pem
+13, -0 
 1@@ -0,0 +1,13 @@
 2+-----BEGIN DH PARAMETERS-----
 3+MIICDAKCAgEAuuCMfojExX8aqV+rD89xCK6lu4vkYohoyQsG8yttLQ8vHwF86ams
 4+qFO/nTL8RmEboB3AeME0QBxdSb1GlS3c3G7v87yzw3O2vb6Hv1wyS7w7BRujFdTN
 5+nQXOOY1aON5XdMY0nhkClqVC7Ov8re++sm017YtdZxtrwZoxccNuW9cxQzMDxwx3
 6+Hp7PR198McObTIDh8Ak9V6BLXk+jsYyvtgs2dKp+nu3D4+rG0Kg/0tbCi1zZeU4u
 7++YqBQlZ8lLB1DcZWDfHkfkg64ifWOf6XDCn4kpxwkHjkynJpM9I6fmMO6kkpPROY
 8+WjUVCShbH5CjRVf+4gmuRF+cXDR3Ie/mRyU3If6tnIb4BU2VVw49y5XaEiF/jPKh
 9+2JVPxtP/rJ6M0cHjj/TTm2XomAI7bn3bfHoUkeD93rIMiFJvPPFrHxrAEb2i5hdh
10+1JQ4T+4FZS+BktedFPPjrG66Tk2Y3jBXoxwtMV2dy+j39bdIPLuHEPiXrU4onI1o
11+7SOtqbfohJB7Wb/9fOAzaQU32Rlq7ZEeqj6ZIFf5ct3nz6JrmblAEZTne/gwKFNP
12+yD7N4ey+Xq9+ojn4B8DeoOObtpUHQMb4fRPY7QM0yLvpVOrN5iJDWCJ8e6BimaAq
13+CwXQK86fIYnMVOSAASABPjnmgV5+xU+JtMulOF4cGSo18S0wqz9/hwcCAQICAgFF
14+-----END DH PARAMETERS-----