cd3cb06c6a
This configuration allows to redirect any HTTP connection to HTTPS, on the same port. This is useful when using a custom port. I'm adding this config here because it needs to be included in every server configuration, not just the main one, and this file is included in each website configuration.
52 lines
2.0 KiB
Plaintext
52 lines
2.0 KiB
Plaintext
## Version 2020/10/29 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/ssl.conf
|
|
|
|
### Mozilla Recommendations
|
|
# generated 2020-06-17, Mozilla Guideline v5.4, nginx 1.18.0-r0, OpenSSL 1.1.1g-r0, intermediate configuration
|
|
# https://ssl-config.mozilla.org/#server=nginx&version=1.18.0-r0&config=intermediate&openssl=1.1.1g-r0&guideline=5.4
|
|
|
|
ssl_session_timeout 1d;
|
|
ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
|
|
ssl_session_tickets off;
|
|
|
|
# intermediate configuration
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
|
ssl_prefer_server_ciphers off;
|
|
|
|
# OCSP stapling
|
|
ssl_stapling on;
|
|
ssl_stapling_verify on;
|
|
|
|
|
|
### Linuxserver.io Defaults
|
|
|
|
# Certificates
|
|
ssl_certificate /config/keys/letsencrypt/fullchain.pem;
|
|
ssl_certificate_key /config/keys/letsencrypt/privkey.pem;
|
|
# verify chain of trust of OCSP response using Root CA and Intermediate certs
|
|
ssl_trusted_certificate /config/keys/letsencrypt/fullchain.pem;
|
|
|
|
# Diffie-Hellman Parameters
|
|
ssl_dhparam /config/nginx/dhparams.pem;
|
|
|
|
# Resolver
|
|
resolver 127.0.0.11 valid=30s; # Docker DNS Server
|
|
|
|
# Enable TLS 1.3 early data
|
|
ssl_early_data on;
|
|
|
|
# HSTS, remove # from the line below to enable HSTS
|
|
#add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
|
|
|
|
# Redirect http traffict to https on same port
|
|
error_page 497 301 =307 https://$host:$server_port$request_uri;
|
|
|
|
# Optional additional headers
|
|
#add_header Cache-Control "no-transform" always;
|
|
#add_header Content-Security-Policy "upgrade-insecure-requests; frame-ancestors 'self'";
|
|
#add_header Referrer-Policy "same-origin" always;
|
|
#add_header X-Content-Type-Options "nosniff" always;
|
|
#add_header X-Frame-Options "SAMEORIGIN" always;
|
|
#add_header X-UA-Compatible "IE=Edge" always;
|
|
#add_header X-XSS-Protection "1; mode=block" always;
|