Skip to content

Instantly share code, notes, and snippets.

@soeric

soeric/nginx.conf

Forked from plentz/nginx.conf
Last active August 29, 2015 14:23
Download ZIP

Revisions

  1. Diego Plentz revised this gist Mar 13, 2015. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -54,7 +54,7 @@ server {
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    # ciphers chosen for forward secrecy and compatibility
    # http://blog.ivanristic.com/2013/08/configuring-apache-nginx-and-openssl-for-forward-secrecy.html
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK';
    ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";

    # enable ocsp stapling (mechanism by which a site can convey certificate revocation information to visitors in a privacy-preserving, scalable manner)
    # http://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
  2. Diego Plentz renamed this gist Feb 22, 2015. 1 changed file with 0 additions and 0 deletions.
    0 nginx_conf → nginx.conf
    View file
    File renamed without changes.
  3. Diego Plentz revised this gist Feb 22, 2015. No changes.
  4. Diego Plentz renamed this gist Feb 22, 2015. 1 changed file with 0 additions and 0 deletions.
    0 nginx.conf → nginx_conf
    View file
    File renamed without changes.
  5. Diego Plentz revised this gist Feb 22, 2015. No changes.
  6. Diego Plentz revised this gist Feb 22, 2015. No changes.
  7. Diego Plentz revised this gist Feb 22, 2015. 1 changed file with 3 additions and 3 deletions.
    6 changes: 3 additions & 3 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -1,6 +1,6 @@
    #read more here http://tautt.com/best-nginx-configuration-for-security/
    # read more here http://tautt.com/best-nginx-configuration-for-security/

    #don't send the nginx version number in error pages and Server header
    # don't send the nginx version number in error pages and Server header
    server_tokens off;

    # config to don't allow the browser to render the page inside an frame or iframe
    @@ -66,7 +66,7 @@ server {
    # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

    #... the rest of your configuration
    # ... the rest of your configuration
    }

    # redirect all http traffic to https
  8. Diego Plentz revised this gist Oct 23, 2014. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -73,5 +73,5 @@ server {
    server {
    listen 80;
    server_name .forgott.com;
    return 301 $scheme://$host$request_uri;
    return 301 https://$host$request_uri;
    }
  9. Diego Plentz revised this gist Oct 19, 2014. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -73,5 +73,5 @@ server {
    server {
    listen 80;
    server_name .forgott.com;
    rewrite ^ https://$host$request_uri permanent;
    return 301 $scheme://$host$request_uri;
    }
  10. Diego Plentz revised this gist Feb 20, 2014. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -1,3 +1,5 @@
    #read more here http://tautt.com/best-nginx-configuration-for-security/

    #don't send the nginx version number in error pages and Server header
    server_tokens off;

  11. Diego Plentz revised this gist Feb 20, 2014. 1 changed file with 0 additions and 1 deletion.
    1 change: 0 additions & 1 deletion nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -44,7 +44,6 @@ server {

    # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
    ssl_dhparam /etc/nginx/ssl/dhparam.pem;
    ssl_session_timeout 5m;

    # enables server-side protection from BEAST attacks
    # http://blog.ivanristic.com/2013/09/is-beast-still-a-threat.html
  12. @plentz plentz revised this gist Jan 11, 2014. 1 changed file with 4 additions and 4 deletions.
    8 changes: 4 additions & 4 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -1,10 +1,6 @@
    #don't send the nginx version number in error pages and Server header
    server_tokens off;

    # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
    # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

    # config to don't allow the browser to render the page inside an frame or iframe
    # and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
    # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
    @@ -65,6 +61,10 @@ server {
    ssl_stapling on;
    ssl_trusted_certificate /etc/nginx/ssl/star_forgott_com.crt;

    # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
    # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

    #... the rest of your configuration
    }

  13. @plentz plentz revised this gist Nov 26, 2013. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions gistfile1.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,2 @@
    # to generate your dhparam.pem file, run in the terminal
    openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
  14. @plentz plentz revised this gist Nov 26, 2013. 1 changed file with 7 additions and 3 deletions.
    10 changes: 7 additions & 3 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -43,8 +43,12 @@ server {

    # enable session resumption to improve https performance
    # http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_session_cache shared:SSL:50m;
    ssl_session_timeout 5m;

    # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
    ssl_dhparam /etc/nginx/ssl/dhparam.pem;
    ssl_session_timeout 5m;

    # enables server-side protection from BEAST attacks
    # http://blog.ivanristic.com/2013/09/is-beast-still-a-threat.html
    @@ -53,7 +57,7 @@ server {
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    # ciphers chosen for forward secrecy and compatibility
    # http://blog.ivanristic.com/2013/08/configuring-apache-nginx-and-openssl-for-forward-secrecy.html
    ssl_ciphers 'EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS';
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK';

    # enable ocsp stapling (mechanism by which a site can convey certificate revocation information to visitors in a privacy-preserving, scalable manner)
    # http://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
  15. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -9,7 +9,7 @@ add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
    # and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
    # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
    # https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
    add_header X-Frame-Options DENY;
    add_header X-Frame-Options SAMEORIGIN;

    # when serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
    # to disable content-type sniffing on some browsers.
  16. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 14 additions and 0 deletions.
    14 changes: 14 additions & 0 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -11,6 +11,20 @@ add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
    # https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
    add_header X-Frame-Options DENY;

    # when serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
    # to disable content-type sniffing on some browsers.
    # https://www.owasp.org/index.php/List_of_useful_HTTP_headers
    # currently suppoorted in IE > 8 http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx
    # http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx
    # 'soon' on Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=471020
    add_header X-Content-Type-Options nosniff;

    # This header enables the Cross-site scripting (XSS) filter built into most recent web browsers.
    # It's usually enabled by default anyway, so the role of this header is to re-enable the filter for
    # this particular website if it was disabled by the user.
    # https://www.owasp.org/index.php/List_of_useful_HTTP_headers
    add_header X-XSS-Protection "1; mode=block";

    # with Content Security Policy (CSP) enabled(and a browser that supports it(http://caniuse.com/#feat=contentsecuritypolicy),
    # you can tell the browser that it can only download content from the domains you explicitly allow
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
  17. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -16,7 +16,8 @@ add_header X-Frame-Options DENY;
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
    # https://www.owasp.org/index.php/Content_Security_Policy
    # I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
    # directives for css and js. more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
    # directives for css and js(if you have inline css or js, you will need to keep it too).
    # more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";

    server {
  18. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 1 addition and 2 deletions.
    3 changes: 1 addition & 2 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -16,8 +16,7 @@ add_header X-Frame-Options DENY;
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
    # https://www.owasp.org/index.php/Content_Security_Policy
    # I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
    # directives for css and js
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
    # directives for css and js. more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";

    server {
  19. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -15,7 +15,8 @@ add_header X-Frame-Options DENY;
    # you can tell the browser that it can only download content from the domains you explicitly allow
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
    # https://www.owasp.org/index.php/Content_Security_Policy
    # I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval' directives
    # I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
    # directives for css and js
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";

  20. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -15,9 +15,9 @@ add_header X-Frame-Options DENY;
    # you can tell the browser that it can only download content from the domains you explicitly allow
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
    # https://www.owasp.org/index.php/Content_Security_Policy
    # I've disabled it since it have some restrictions, like not executing inline JS anymore
    # I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval' directives
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
    # add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://ssl.google-analytics.com https://assets.zendesk.com; img-src 'self' https://ssl.google-analytics.com; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://themes.googleusercontent.com; frame-src 'none'; object-src 'none'";
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";

    server {
    listen 443 ssl default deferred;
  21. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -15,8 +15,8 @@ add_header X-Frame-Options DENY;
    # you can tell the browser that it can only download content from the domains you explicitly allow
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
    # https://www.owasp.org/index.php/Content_Security_Policy
    # I've disabled it since it have some restrictions, like not executing inline JS in Chrome
    # https://developer.chrome.com/extensions/contentSecurityPolicy.html#JSExecution
    # I've disabled it since it have some restrictions, like not executing inline JS anymore
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
    # add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://ssl.google-analytics.com https://assets.zendesk.com; img-src 'self' https://ssl.google-analytics.com; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://themes.googleusercontent.com; frame-src 'none'; object-src 'none'";

    server {
  22. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 3 additions and 3 deletions.
    6 changes: 3 additions & 3 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -15,9 +15,9 @@ add_header X-Frame-Options DENY;
    # you can tell the browser that it can only download content from the domains you explicitly allow
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
    # https://www.owasp.org/index.php/Content_Security_Policy
    add_header X-Content-Security-Policy "default-src 'self'; \
    script-src 'self' https://ssl.google-analytics.com; \
    img-src 'self' https://ssl.google-analytics.com";
    # I've disabled it since it have some restrictions, like not executing inline JS in Chrome
    # https://developer.chrome.com/extensions/contentSecurityPolicy.html#JSExecution
    # add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://ssl.google-analytics.com https://assets.zendesk.com; img-src 'self' https://ssl.google-analytics.com; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://themes.googleusercontent.com; frame-src 'none'; object-src 'none'";

    server {
    listen 443 ssl default deferred;
  23. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 9 additions and 0 deletions.
    9 changes: 9 additions & 0 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -4,12 +4,21 @@ server_tokens off;
    # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
    # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

    # config to don't allow the browser to render the page inside an frame or iframe
    # and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
    # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
    # https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
    add_header X-Frame-Options DENY;

    # with Content Security Policy (CSP) enabled(and a browser that supports it(http://caniuse.com/#feat=contentsecuritypolicy),
    # you can tell the browser that it can only download content from the domains you explicitly allow
    # http://www.html5rocks.com/en/tutorials/security/content-security-policy/
    # https://www.owasp.org/index.php/Content_Security_Policy
    add_header X-Content-Security-Policy "default-src 'self'; \
    script-src 'self' https://ssl.google-analytics.com; \
    img-src 'self' https://ssl.google-analytics.com";

    server {
    listen 443 ssl default deferred;
    server_name .forgott.com;
  24. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -44,5 +44,5 @@ server {
    server {
    listen 80;
    server_name .forgott.com;
    rewrite ^(.*)$ https://$host$request_uri permanent;
    rewrite ^ https://$host$request_uri permanent;
    }
  25. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 1 addition and 3 deletions.
    4 changes: 1 addition & 3 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -40,11 +40,9 @@ server {
    #... the rest of your configuration
    }

    # redirect all http traffic to https
    server {
    listen 80;
    server_name .forgott.com;

    # redirect all http traffic to https
    rewrite ^(.*)$ https://$host$request_uri permanent;
    break;
    }
  26. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 10 additions and 1 deletion.
    11 changes: 10 additions & 1 deletion nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -38,4 +38,13 @@ server {
    ssl_trusted_certificate /etc/nginx/ssl/star_forgott_com.crt;

    #... the rest of your configuration
    }
    }

    server {
    listen 80;
    server_name .forgott.com;

    # redirect all http traffic to https
    rewrite ^(.*)$ https://$host$request_uri permanent;
    break;
    }
  27. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 1 addition and 2 deletions.
    3 changes: 1 addition & 2 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -3,7 +3,7 @@ server_tokens off;

    # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
    # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
    add_header Strict-Transport-Security max-age=31536000;
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
    # config to don't allow the browser to render the page inside an frame or iframe
    # and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
    # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
    @@ -37,6 +37,5 @@ server {
    ssl_stapling on;
    ssl_trusted_certificate /etc/nginx/ssl/star_forgott_com.crt;


    #... the rest of your configuration
    }
  28. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 12 additions and 9 deletions.
    21 changes: 12 additions & 9 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -1,8 +1,18 @@
    #don't send the nginx version number in error pages and Server header
    server_tokens off;

    # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
    # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
    add_header Strict-Transport-Security max-age=31536000;
    # config to don't allow the browser to render the page inside an frame or iframe
    # and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
    # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
    # https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
    add_header X-Frame-Options DENY;

    server {
    listen 443 ssl default deferred;
    server_name .forgott.com;
    #don't send the nginx version number in error pages and Server header
    server_tokens off;

    ssl_certificate /etc/nginx/ssl/star_forgott_com.crt;
    ssl_certificate_key /etc/nginx/ssl/star_forgott_com.key;
    @@ -27,13 +37,6 @@ server {
    ssl_stapling on;
    ssl_trusted_certificate /etc/nginx/ssl/star_forgott_com.crt;

    # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
    # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
    add_header Strict-Transport-Security max-age=31536000;
    # config to don't allow the browser to render the page inside an frame or iframe
    # and avoid clickjacking https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
    # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
    add_header X-Frame-Options DENY;

    #... the rest of your configuration
    }
  29. @plentz plentz revised this gist Sep 28, 2013. 1 changed file with 12 additions and 3 deletions.
    15 changes: 12 additions & 3 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -6,10 +6,19 @@ server {

    ssl_certificate /etc/nginx/ssl/star_forgott_com.crt;
    ssl_certificate_key /etc/nginx/ssl/star_forgott_com.key;
    ssl_session_cache builtin:1000 shared:SSL:10m;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

    # enable session resumption to improve https performance
    # http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    # enables server-side protection from BEAST attacks
    # http://blog.ivanristic.com/2013/09/is-beast-still-a-threat.html
    ssl_prefer_server_ciphers on;
    # disable SSLv3(enabled by default since nginx 0.8.19) since it's less secure then TLS http://en.wikipedia.org/wiki/Secure_Sockets_Layer#SSL_3.0
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    # ciphers chosen for forward secrecy and compatibility
    # http://blog.ivanristic.com/2013/08/configuring-apache-nginx-and-openssl-for-forward-secrecy.html
    ssl_ciphers 'EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS';

    # enable ocsp stapling (mechanism by which a site can convey certificate revocation information to visitors in a privacy-preserving, scalable manner)
  30. @plentz plentz created this gist Sep 28, 2013.
    30 changes: 30 additions & 0 deletions nginx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,30 @@
    server {
    listen 443 ssl default deferred;
    server_name .forgott.com;
    #don't send the nginx version number in error pages and Server header
    server_tokens off;

    ssl_certificate /etc/nginx/ssl/star_forgott_com.crt;
    ssl_certificate_key /etc/nginx/ssl/star_forgott_com.key;
    ssl_session_cache builtin:1000 shared:SSL:10m;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS';

    # enable ocsp stapling (mechanism by which a site can convey certificate revocation information to visitors in a privacy-preserving, scalable manner)
    # http://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
    resolver 8.8.8.8;
    ssl_stapling on;
    ssl_trusted_certificate /etc/nginx/ssl/star_forgott_com.crt;

    # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
    # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
    add_header Strict-Transport-Security max-age=31536000;
    # config to don't allow the browser to render the page inside an frame or iframe
    # and avoid clickjacking https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
    # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
    add_header X-Frame-Options DENY;

    #... the rest of your configuration
    }