Admin
22213a5592
- Unknown hostnames and direct IP access no longer land on the first vhost (Gitea): port 80 closes the connection, except for ACME challenges, and port 443 refuses the handshake. - Mozilla intermediate ciphers (forward secrecy only, no CBC), session cache, no session tickets, and HSTS with a short max-age for now. - Set X-Forwarded-For to the client address instead of appending to whatever the client sent.
10 lines
400 B
Plaintext
10 lines
400 B
Plaintext
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
# The edge is the first hop, so whatever X-Forwarded-For the client sent is
|
|
# made up: replace it instead of appending to it.
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|