From ccd829b9f0767e1102391b31e17500aef8c8c63d Mon Sep 17 00:00:00 2001
From: tim <tim@noreply.localhost>
Date: Wed, 6 Nov 2024 04:45:03 +0000
Subject: [PATCH] Initial commit

---
 example template.conf | 69 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 69 insertions(+)
 create mode 100644 example template.conf

diff --git a/example template.conf b/example template.conf
new file mode 100644
index 0000000..4f9387d
--- /dev/null
+++ b/example template.conf	
@@ -0,0 +1,69 @@
+server {
+  listen 80;
+  listen [::]:80;
+
+  server_name <<domain>>;
+
+  access_log /var/log/nginx/<<domain>>.access.log;
+  error_log /var/log/nginx/<<domain>>.error.log;
+
+  location /.well-known {
+    alias /var/www/<<domain>>/.well-known;
+  }
+
+  # Redirect all non-https requests
+  rewrite ^ https://$host$request_uri? permanent;
+}
+
+
+
+server {
+  listen [::]:443 ssl http2;
+  listen 443 ssl http2;
+
+  server_name <<domain>>;
+
+  # Certificate(s) and private key
+#  ssl_certificate /etc/nginx/certs/<<domain>>/fullchain.cer;
+#  ssl_certificate_key /etc/nginx/certs/<<domain>>/key.key;
+
+  ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
+  ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
+
+  charset UTF-8;
+
+  access_log /var/log/nginx/<<domain>>.access.log;
+  error_log /var/log/nginx/<<domain>>.error.log;
+
+#  add_header X-Frame-Options "ALLOW-FROM *";
+#  autoindex on;
+
+  root /var/www/<<domain>>;
+  index index.html index.htm;
+
+#  location /.well-known {
+#    alias /var/www/<<domain>>/.well-known;
+#  }
+
+  # RFC-7919 recommended: https://wiki.mozilla.org/Security/Server_Side_TLS#ffdhe4096
+  #ssl_dhparam /etc/ssl/ffdhe4096.pem;
+
+  # Or, generate random dhparam
+  # openssl dhparam 4096 -out /etc/ssl/dhparam.pem
+  ssl_dhparam /etc/ssl/dhparam.pem;
+
+  ssl_protocols TLSv1.3 TLSv1.2;
+  ssl_prefer_server_ciphers on;
+  ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA512:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:ECDH+AESGCM:ECDH+AES256:DH+AESGCM:DH+AES256:RSA+AESGCM:!aNULL:!eNULL:!LOW:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS;
+
+  ssl_session_cache shared:TLS:2m;
+  ssl_buffer_size 4k;
+
+  # OCSP stapling
+  ssl_stapling on;
+  ssl_stapling_verify on;
+  resolver 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]; # Cloudflare
+
+  # Set HSTS to 365 days
+  add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload' always;
+}
\ No newline at end of file