Fabien BOURGEOIS
578dd155fb
* Updated ciphers / protocols and other base conf ; * Run as nginx user, no more root then fork.
37 lines
1.2 KiB
Plaintext
37 lines
1.2 KiB
Plaintext
server {
|
||
listen ${NGINX_PORT} default_server;
|
||
listen ${NGINX_SSL_PORT} ssl default_server;
|
||
server_name ${NGINX_HOST};
|
||
ssl_certificate /etc/nginx/certs/req.pem;
|
||
ssl_certificate_key /etc/nginx/certs/cert.key;
|
||
|
||
ssl_protocols TLSv1.2 TLSv1.3; # don’t use SSLv3 ref: POODLE, nor TLSv1 / TLSv1.1
|
||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||
ssl_prefer_server_ciphers off;
|
||
|
||
ssl_dhparam /etc/nginx/certs/dhparams.pem; # Logjam
|
||
|
||
ssl_session_timeout 1d;
|
||
ssl_session_tickets off;
|
||
ssl_session_cache shared:TLS:10m; # About 40k sessions
|
||
|
||
# OCSP stapling
|
||
ssl_stapling on;
|
||
ssl_stapling_verify on;
|
||
# Set HSTS to 365 days
|
||
add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains' always;
|
||
|
||
# resolver 127.0.0.1;
|
||
|
||
# DDoS
|
||
client_body_buffer_size 1K;
|
||
client_header_buffer_size 1k;
|
||
client_max_body_size 1k;
|
||
large_client_header_buffers 2 1k;
|
||
|
||
location / {
|
||
root /var/www/html;
|
||
index index.html index.htm index.php;
|
||
}
|
||
}
|