Skip to content

Instantly share code, notes, and snippets.

@katopz
Created April 16, 2016 16:08
Show Gist options
  • Save katopz/ea97e15399181928948ebe1d4454aff1 to your computer and use it in GitHub Desktop.
Save katopz/ea97e15399181928948ebe1d4454aff1 to your computer and use it in GitHub Desktop.
Working?
worker_processes auto;
user www-data;
pid /run/nginx.pid;
daemon off;
events {
worker_connections 1024;
accept_mutex off;
}
http {
sendfile on;
gzip on;
gzip_comp_level 6;
gzip_min_length 20;
gzip_proxied any;
gzip_types text/plain text/css application/json application/x-javascript application/javascript text/xml application/xml application/xml+rss text/javascript;
gzip_vary on;
gzip_disable "MSIE [1-6]\.(?!.*SV1)";
proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=gh-pages:10m inactive=360m;
proxy_cache_key "$scheme$request_method$host$request_uri";
proxy_temp_path /tmp/nginx;
server {
listen 80;
server_name rabbot.io;
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl http2;
server_name rabbot.io;
# letsencrypt
ssl_certificate /etc/letsencrypt/live/rabbot.io/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/rabbot.io/privkey.pem;
# SSL Security: https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
ssl_protocols TLSv1.2;
ssl_ciphers 'kEECDH+ECDSA+AES128 kEECDH+ECDSA+AES256 kEECDH+AES128 kEECDH+AES256 kEDH+AES128 kEDH+AES256 DES-CBC3-SHA +SHA !aNULL !eNULL !LOW !kECDH !DSS !MD5 !EXP !PSK !SRP !CAMELLIA !SEED';
ssl_prefer_server_ciphers on;
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
# openssl dhparam -out dhparam.pem 4096
ssl_dhparam /etc/nginx/ssl/dhparam.pem;
# SSL performance
# https://imququ.com/post/my-nginx-conf-for-wpo.html#toc-4
# https://raymii.org/s/tutorials/OCSP_Stapling_on_nginx.html
# "AddTrustCA.crt"
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_session_tickets on;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx/stapling.pem;
# http2 server push
add_header Link '</css/main.css>; rel=preload; as=stylesheet';
add_header Host rabbots.github.io;
server_tokens off; # removed pound sign
location / {
proxy_cache gh-pages;
proxy_cache_valid 200 302 1h;
proxy_pass https://rabbots.github.io;
proxy_redirect https://rabbots.github.io https://rabbot.io;
proxy_redirect http://rabbots.github.io https://rabbot.io;
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment