2016-10-04 09:32:47 +02:00
|
|
|
server {
|
2017-07-01 15:48:03 +02:00
|
|
|
listen ${NGINX_PORT} default_server;
|
2017-07-01 15:55:22 +02:00
|
|
|
listen ${NGINX_SSL_PORT} ssl default_server;
|
2016-10-04 09:32:47 +02:00
|
|
|
server_name ${NGINX_HOST};
|
2021-03-29 10:59:57 +02:00
|
|
|
ssl_certificate ${CERTIFICATE_PATH};
|
|
|
|
ssl_certificate_key ${CERTIFICATE_KEY_PATH};
|
2021-03-29 09:51:14 +02:00
|
|
|
|
2021-03-29 20:13:54 +02:00
|
|
|
ssl_protocols ${SSL_PROTOCOLS};
|
|
|
|
ssl_ciphers ${SSL_CIPHERS};
|
2021-03-29 09:51:14 +02:00
|
|
|
ssl_prefer_server_ciphers off;
|
|
|
|
|
2016-10-04 09:32:47 +02:00
|
|
|
ssl_dhparam /etc/nginx/certs/dhparams.pem; # Logjam
|
2021-03-29 09:51:14 +02:00
|
|
|
|
|
|
|
ssl_session_timeout 1d;
|
|
|
|
ssl_session_tickets off;
|
|
|
|
ssl_session_cache shared:TLS:10m; # About 40k sessions
|
|
|
|
|
2017-04-07 12:13:43 +02:00
|
|
|
# OCSP stapling
|
|
|
|
ssl_stapling on;
|
|
|
|
ssl_stapling_verify on;
|
|
|
|
# Set HSTS to 365 days
|
2021-03-29 09:51:14 +02:00
|
|
|
add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains' always;
|
|
|
|
|
|
|
|
# resolver 127.0.0.1;
|
2017-04-07 12:13:43 +02:00
|
|
|
|
2021-03-29 09:51:14 +02:00
|
|
|
# DDoS
|
|
|
|
client_body_buffer_size 1K;
|
|
|
|
client_header_buffer_size 1k;
|
|
|
|
client_max_body_size 1k;
|
|
|
|
large_client_header_buffers 2 1k;
|
2016-10-04 09:32:47 +02:00
|
|
|
|
|
|
|
location / {
|
|
|
|
root /var/www/html;
|
|
|
|
index index.html index.htm index.php;
|
|
|
|
}
|
|
|
|
}
|