Admin
22213a5592
- Unknown hostnames and direct IP access no longer land on the first vhost (Gitea): port 80 closes the connection, except for ACME challenges, and port 443 refuses the handshake. - Mozilla intermediate ciphers (forward secrecy only, no CBC), session cache, no session tickets, and HSTS with a short max-age for now. - Set X-Forwarded-For to the client address instead of appending to whatever the client sent.
26 lines
693 B
Plaintext
26 lines
693 B
Plaintext
# Catch-all for Host headers no vhost claims (scanners, direct IP access,
|
|
# stale DNS). Without it nginx hands them to the first vhost it loaded,
|
|
# i.e. Gitea. ACME stays reachable here so a certificate for a new hostname
|
|
# can be issued before its vhost exists.
|
|
server {
|
|
listen 80 default_server;
|
|
listen [::]:80 default_server;
|
|
server_name _;
|
|
|
|
location /.well-known/acme-challenge/ {
|
|
root /var/www/certbot;
|
|
}
|
|
|
|
location / {
|
|
return 444;
|
|
}
|
|
}
|
|
|
|
# No certificate to present for an unknown name, so refuse the handshake.
|
|
server {
|
|
listen 443 ssl default_server;
|
|
listen [::]:443 ssl default_server;
|
|
server_name _;
|
|
ssl_reject_handshake on;
|
|
}
|