Admin
22213a5592
- Unknown hostnames and direct IP access no longer land on the first vhost (Gitea): port 80 closes the connection, except for ACME challenges, and port 443 refuses the handshake. - Mozilla intermediate ciphers (forward secrecy only, no CBC), session cache, no session tickets, and HSTS with a short max-age for now. - Set X-Forwarded-For to the client address instead of appending to whatever the client sent.
14 lines
702 B
Plaintext
14 lines
702 B
Plaintext
# Mozilla "intermediate" profile, without the DHE suites (they'd need a
|
|
# dhparam file): forward secrecy on every connection, no CBC.
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
|
|
ssl_prefer_server_ciphers off;
|
|
ssl_session_cache shared:SSL:10m;
|
|
ssl_session_timeout 1d;
|
|
ssl_session_tickets off;
|
|
|
|
# Short max-age for now: raise it (e.g. 63072000) once every hostname is
|
|
# confirmed working over https. A location that sets its own add_header
|
|
# stops inheriting this one.
|
|
add_header Strict-Transport-Security "max-age=86400" always;
|