69 lines
1.8 KiB
Plaintext
69 lines
1.8 KiB
Plaintext
|
server {
|
||
|
|
listen 80;
|
||
|
|
listen [::]:80;
|
||
|
|
|
||
|
|
server_name <<domain>>;
|
||
|
|
|
||
|
|
access_log /var/log/nginx/<<domain>>.access.log;
|
||
|
|
error_log /var/log/nginx/<<domain>>.error.log;
|
||
|
|
|
||
|
|
location /.well-known {
|
||
|
|
alias /var/www/<<domain>>/.well-known;
|
||
|
|
}
|
||
|
|
|
||
|
|
# Redirect all non-https requests
|
||
|
|
rewrite ^ https://$host$request_uri? permanent;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
server {
|
||
|
|
listen [::]:443 ssl http2;
|
||
|
|
listen 443 ssl http2;
|
||
|
|
|
||
|
|
server_name <<domain>>;
|
||
|
|
|
||
|
|
# Certificate(s) and private key
|
||
|
|
# ssl_certificate /etc/nginx/certs/<<domain>>/fullchain.cer;
|
||
|
|
# ssl_certificate_key /etc/nginx/certs/<<domain>>/key.key;
|
||
|
|
|
||
|
|
ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
|
||
|
|
ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
|
||
|
|
|
||
|
|
charset UTF-8;
|
||
|
|
|
||
|
|
access_log /var/log/nginx/<<domain>>.access.log;
|
||
|
|
error_log /var/log/nginx/<<domain>>.error.log;
|
||
|
|
|
||
|
|
# add_header X-Frame-Options "ALLOW-FROM *";
|
||
|
|
# autoindex on;
|
||
|
|
|
||
|
|
root /var/www/<<domain>>;
|
||
|
|
index index.html index.htm;
|
||
|
|
|
||
|
|
# location /.well-known {
|
||
|
|
# alias /var/www/<<domain>>/.well-known;
|
||
|
|
# }
|
||
|
|
|
||
|
|
# RFC-7919 recommended: https://wiki.mozilla.org/Security/Server_Side_TLS#ffdhe4096
|
||
|
|
#ssl_dhparam /etc/ssl/ffdhe4096.pem;
|
||
|
|
|
||
|
|
# Or, generate random dhparam
|
||
|
|
# openssl dhparam 4096 -out /etc/ssl/dhparam.pem
|
||
|
|
ssl_dhparam /etc/ssl/dhparam.pem;
|
||
|
|
|
||
|
|
ssl_protocols TLSv1.3 TLSv1.2;
|
||
|
|
ssl_prefer_server_ciphers on;
|
||
|
|
ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA512:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:ECDH+AESGCM:ECDH+AES256:DH+AESGCM:DH+AES256:RSA+AESGCM:!aNULL:!eNULL:!LOW:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS;
|
||
|
|
|
||
|
|
ssl_session_cache shared:TLS:2m;
|
||
|
|
ssl_buffer_size 4k;
|
||
|
|
|
||
|
|
# OCSP stapling
|
||
|
|
ssl_stapling on;
|
||
|
|
ssl_stapling_verify on;
|
||
|
|
resolver 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]; # Cloudflare
|
||
|
|
|
||
|
|
# Set HSTS to 365 days
|
||
|
|
add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload' always;
|
||
|
|
}
|