diff options
28 files changed, 62 insertions, 244 deletions
diff --git a/linux/nginx/etc/nginx/conf.d/cleberg.dev.conf b/linux/nginx/etc/nginx/conf.d/cleberg.dev.conf index 088c9ff..69282e0 100644 --- a/linux/nginx/etc/nginx/conf.d/cleberg.dev.conf +++ b/linux/nginx/etc/nginx/conf.d/cleberg.dev.conf @@ -1,7 +1,7 @@ server { - listen 10010; + listen 127.0.0.1:10010; server_name cleberg.dev; root /var/www/cleberg.dev/; include custom.d/basic.conf; diff --git a/linux/nginx/etc/nginx/conf.d/cleberg.io.conf b/linux/nginx/etc/nginx/conf.d/cleberg.io.conf deleted file mode 100644 index 8b13789..0000000 --- a/linux/nginx/etc/nginx/conf.d/cleberg.io.conf +++ /dev/null @@ -1 +0,0 @@ - diff --git a/linux/nginx/etc/nginx/conf.d/cleberg.net.conf b/linux/nginx/etc/nginx/conf.d/cleberg.net.conf index e01276f..6030fd0 100644 --- a/linux/nginx/etc/nginx/conf.d/cleberg.net.conf +++ b/linux/nginx/etc/nginx/conf.d/cleberg.net.conf @@ -1,11 +1,14 @@ server { - listen 10011; + listen 127.0.0.1:10011; server_name cleberg.net paske4urhs6nttrtlkuwa5cowum3fjkc6yv6kl4ncx3mjxcd77764nqd.onion; - error_log /var/log/nginx/cleberg.net.error.log; + + # No per-vhost error_log: it overrode the global "off" and wrote visitor + # IPs to disk. + + # basic.conf now carries HSTS + Permissions-Policy. CSP stays explicit -- + # the shared policy is written for this vhost (it allows img.cleberg.net). include custom.d/basic.conf; - include custom.d/security/strict-transport-security.conf; include custom.d/security/content-security-policy.conf; - include custom.d/security/permissions-policy.conf; root /var/www/cleberg.net/; include custom.d/redirects/blog.conf; port_in_redirect off; @@ -48,14 +51,3 @@ server { try_files $uri =404; } } - -server { - listen 10012; - server_name hutch.cleberg.net; - include custom.d/basic.conf; - include custom.d/security/strict-transport-security.conf; - include custom.d/security/content-security-policy.conf; - include custom.d/security/permissions-policy.conf; - location = /privacy.html { return 301 https://zerolabs.sh/hutch/privacy-policy/; } - location = / { return 301 https://zerolabs.sh/hutch/; } -} diff --git a/linux/nginx/etc/nginx/conf.d/cleberg.net_wildcard.conf b/linux/nginx/etc/nginx/conf.d/cleberg.net_wildcard.conf deleted file mode 100644 index 8b13789..0000000 --- a/linux/nginx/etc/nginx/conf.d/cleberg.net_wildcard.conf +++ /dev/null @@ -1 +0,0 @@ - diff --git a/linux/nginx/etc/nginx/conf.d/cv.conf b/linux/nginx/etc/nginx/conf.d/cv.conf index 5cbece2..3dc73a2 100644 --- a/linux/nginx/etc/nginx/conf.d/cv.conf +++ b/linux/nginx/etc/nginx/conf.d/cv.conf @@ -1,5 +1,5 @@ server { - listen 10014; + listen 127.0.0.1:10014; server_name cv.cleberg.net; add_header Onion-Location "http://xe43aewwiybmbo5qsstx7t5kmgkd2ei4bkkvqinwd7fxfmkekvnjbbad.onion$request_uri" always; include custom.d/basic.conf; @@ -9,7 +9,7 @@ server { } server { - listen 10015; + listen 127.0.0.1:10015; server_name xe43aewwiybmbo5qsstx7t5kmgkd2ei4bkkvqinwd7fxfmkekvnjbbad.onion; include custom.d/basic.conf; root /var/www/cv/; diff --git a/linux/nginx/etc/nginx/conf.d/files.conf b/linux/nginx/etc/nginx/conf.d/files.conf index 7fc7247..684e895 100644 --- a/linux/nginx/etc/nginx/conf.d/files.conf +++ b/linux/nginx/etc/nginx/conf.d/files.conf @@ -1,6 +1,10 @@ server { - listen 10017; - server_name files.cleberg.net; + listen 127.0.0.1:10017; + # files.cleberg.net was retired 2026-08-03: it and files.krz.sh both routed + # here, so one origin served byte-identical content under both identities. + # The real-name hostname was removed; this vhost is krz-only now. Named + # explicitly rather than left to default-server fallback. + server_name files.krz.sh; add_header Onion-Location "http://yt2y635dc6zyxziy5ytkfz36bmkgcxuccq3meom6qp44gjdat54wt5id.onion$request_uri" always; include custom.d/basic.conf; root /var/www/files/; @@ -9,7 +13,7 @@ server { } server { - listen 10018; + listen 127.0.0.1:10018; server_name yt2y635dc6zyxziy5ytkfz36bmkgcxuccq3meom6qp44gjdat54wt5id.onion; include custom.d/basic.conf; root /var/www/files/; diff --git a/linux/nginx/etc/nginx/conf.d/git.conf b/linux/nginx/etc/nginx/conf.d/git.conf index 884000c..a3690d1 100644 --- a/linux/nginx/etc/nginx/conf.d/git.conf +++ b/linux/nginx/etc/nginx/conf.d/git.conf @@ -3,13 +3,14 @@ # Repos are scanned from /git (scan-path in /etc/cgitrc). server { - listen 10046; + listen 127.0.0.1:10046; server_name git.krz.sh; - error_log /var/log/nginx/git.krz.sh.error.log; + # No per-vhost error_log: it overrode the global "off" and wrote visitor + # IPs to disk for the pseudonymous vhost. + + # basic.conf now carries HSTS + Permissions-Policy. include custom.d/basic.conf; - include custom.d/security/strict-transport-security.conf; - include custom.d/security/permissions-policy.conf; # The shared CSP (default-src 'self', no style-src) breaks cgit: the # pygments source-filter writes an inline <style> block into every blob @@ -51,8 +52,14 @@ server { fastcgi_pass unix:/run/fcgiwrap.socket; fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend; fastcgi_param GIT_PROJECT_ROOT /git; - fastcgi_param GIT_HTTP_EXPORT_ALL 1; fastcgi_param PATH_INFO $uri; + + # GIT_HTTP_EXPORT_ALL is deliberately absent. git-http-backend tests + # it with getenv(), so ANY value -- including "0" -- exports every + # repo under GIT_PROJECT_ROOT. The variable must simply not be set. + # Export is now opt-in per repo via a git-daemon-export-ok marker, + # so a repo dropped into /git is not published by accident. + fastcgi_param QUERY_STRING $args; # /git is owned by uid 1001, which maps to no account on this host, diff --git a/linux/nginx/etc/nginx/conf.d/hn.conf b/linux/nginx/etc/nginx/conf.d/hn.conf index f993a69..4b2cab2 100644 --- a/linux/nginx/etc/nginx/conf.d/hn.conf +++ b/linux/nginx/etc/nginx/conf.d/hn.conf @@ -1,11 +1,8 @@ server { - listen 10023; - listen 10024; - server_name hn.zerolabs.sh r3yfeffyj7ornpikojmw75u3sn2la7tqnmcmwgv2ov7if24sm5czqeid.onion hn.cleberg.net; + listen 127.0.0.1:10023; + listen 127.0.0.1:10024; + server_name hn.zerolabs.sh r3yfeffyj7ornpikojmw75u3sn2la7tqnmcmwgv2ov7if24sm5czqeid.onion; - if ($host = hn.cleberg.net) { - return 301 https://hn.zerolabs.sh$request_uri; - } root /var/www/hn/output/; autoindex on; add_header Onion-Location "http://r3yfeffyj7ornpikojmw75u3sn2la7tqnmcmwgv2ov7if24sm5czqeid.onion$request_uri" always; diff --git a/linux/nginx/etc/nginx/conf.d/img.conf b/linux/nginx/etc/nginx/conf.d/img.conf index 3b13c8a..16c9ab0 100644 --- a/linux/nginx/etc/nginx/conf.d/img.conf +++ b/linux/nginx/etc/nginx/conf.d/img.conf @@ -1,5 +1,5 @@ server { - listen 10025; + listen 127.0.0.1:10025; server_name img.cleberg.net; add_header Onion-Location "http://ltf2dfg7tj263ll24lxuq7igejcrhcazjp6whgg6u6vyjir2iahqggad.onion$request_uri" always; include custom.d/basic.conf; @@ -9,7 +9,7 @@ server { } server { - listen 10026; + listen 127.0.0.1:10026; server_name ltf2dfg7tj263ll24lxuq7igejcrhcazjp6whgg6u6vyjir2iahqggad.onion; include custom.d/basic.conf; root /var/www/img/; diff --git a/linux/nginx/etc/nginx/conf.d/krz.sh.conf b/linux/nginx/etc/nginx/conf.d/krz.sh.conf index eaf9900..0169dbe 100644 --- a/linux/nginx/etc/nginx/conf.d/krz.sh.conf +++ b/linux/nginx/etc/nginx/conf.d/krz.sh.conf @@ -1,5 +1,5 @@ server { - listen 10047; + listen 127.0.0.1:10047; server_name krz.sh; root /var/www/krz.sh/; absolute_redirect off; diff --git a/linux/nginx/etc/nginx/conf.d/office.conf b/linux/nginx/etc/nginx/conf.d/office.conf index 6d864aa..74c7032 100644 --- a/linux/nginx/etc/nginx/conf.d/office.conf +++ b/linux/nginx/etc/nginx/conf.d/office.conf @@ -1,17 +1,14 @@ server { - listen 10031; - server_name office.zerolabs.sh office.cleberg.net; + listen 127.0.0.1:10031; + server_name office.zerolabs.sh; - if ($host = office.cleberg.net) { - return 301 https://office.zerolabs.sh$request_uri; - } add_header Onion-Location "http://uwtjz6pof52bzdkj242mub77ls2ji3qiznbsuoir235rxynqxadpghid.onion$request_uri" always; root /var/www/office/; include custom.d/basic.conf; location / { try_files $uri $uri/ /index.html; } } server { - listen 10032; + listen 127.0.0.1:10032; server_name uwtjz6pof52bzdkj242mub77ls2ji3qiznbsuoir235rxynqxadpghid.onion; include custom.d/basic.conf; root /var/www/office/; diff --git a/linux/nginx/etc/nginx/conf.d/org.conf b/linux/nginx/etc/nginx/conf.d/org.conf index f93c19e..fbf84a0 100644 --- a/linux/nginx/etc/nginx/conf.d/org.conf +++ b/linux/nginx/etc/nginx/conf.d/org.conf @@ -1,17 +1,14 @@ server { - listen 10033; - server_name org.zerolabs.sh org.cleberg.net; + listen 127.0.0.1:10033; + server_name org.zerolabs.sh; - if ($host = org.cleberg.net) { - return 301 https://org.zerolabs.sh$request_uri; - } add_header Onion-Location "http://7vsifofpucgi3wva52nbwhwglrmbyxgdapbkkmgniqlsskspux5zocyd.onion$request_uri" always; root /var/www/org/; include custom.d/basic.conf; location / { try_files $uri $uri/ /index.html; } } server { - listen 10034; + listen 127.0.0.1:10034; server_name 7vsifofpucgi3wva52nbwhwglrmbyxgdapbkkmgniqlsskspux5zocyd.onion; include custom.d/basic.conf; root /var/www/org/; diff --git a/linux/nginx/etc/nginx/conf.d/projects.conf b/linux/nginx/etc/nginx/conf.d/projects.conf index f537af2..bcdfae9 100644 --- a/linux/nginx/etc/nginx/conf.d/projects.conf +++ b/linux/nginx/etc/nginx/conf.d/projects.conf @@ -1,10 +1,7 @@ server { - listen 10040; - server_name projects.zerolabs.sh projects.cleberg.net; + listen 127.0.0.1:10040; + server_name projects.zerolabs.sh; - if ($host = projects.cleberg.net) { - return 301 https://projects.zerolabs.sh$request_uri; - } add_header Onion-Location "http://krednuajd2wpt67ozmkollddpbdphpeyh74hbenagzoxqjncrtrgxkid.onion$request_uri" always; root /var/www/projects/; autoindex on; @@ -13,7 +10,7 @@ server { } server { - listen 10041; + listen 127.0.0.1:10041; server_name krednuajd2wpt67ozmkollddpbdphpeyh74hbenagzoxqjncrtrgxkid.onion; include custom.d/basic.conf; root /var/www/projects/; diff --git a/linux/nginx/etc/nginx/conf.d/reminiscecleberg.com.conf b/linux/nginx/etc/nginx/conf.d/reminiscecleberg.com.conf index 86a8571..02b1721 100644 --- a/linux/nginx/etc/nginx/conf.d/reminiscecleberg.com.conf +++ b/linux/nginx/etc/nginx/conf.d/reminiscecleberg.com.conf @@ -1,7 +1,7 @@ server { - listen 10043; + listen 127.0.0.1:10043; server_name reminiscecleberg.com; root /var/www/reminiscecleberg.com/; include custom.d/basic.conf; diff --git a/linux/nginx/etc/nginx/conf.d/rogue.conf b/linux/nginx/etc/nginx/conf.d/rogue.conf index 03e0b98..1618be3 100644 --- a/linux/nginx/etc/nginx/conf.d/rogue.conf +++ b/linux/nginx/etc/nginx/conf.d/rogue.conf @@ -1,5 +1,5 @@ server { - listen 10001; + listen 127.0.0.1:10001; server_name rogue.krz.sh; root /var/www/rogue; diff --git a/linux/nginx/etc/nginx/conf.d/rss.conf b/linux/nginx/etc/nginx/conf.d/rss.conf index ed97427..44bde88 100644 --- a/linux/nginx/etc/nginx/conf.d/rss.conf +++ b/linux/nginx/etc/nginx/conf.d/rss.conf @@ -1,11 +1,8 @@ upstream freshrss { server 127.0.0.1:8099; keepalive 64; } server { - listen 10045; - server_name rss.zerolabs.sh rss.cleberg.net; + listen 127.0.0.1:10045; + server_name rss.zerolabs.sh; - if ($host = rss.cleberg.net) { - return 301 https://rss.zerolabs.sh$request_uri; - } include custom.d/basic.conf; location / { proxy_pass http://freshrss/; diff --git a/linux/nginx/etc/nginx/conf.d/zerolabs.sh.conf b/linux/nginx/etc/nginx/conf.d/zerolabs.sh.conf index afdc3e3..0f5e5be 100644 --- a/linux/nginx/etc/nginx/conf.d/zerolabs.sh.conf +++ b/linux/nginx/etc/nginx/conf.d/zerolabs.sh.conf @@ -5,8 +5,13 @@ map $host $krz_target { } server { - listen 10000; + listen 127.0.0.1:10000; server_name zerolabs.sh *.zerolabs.sh; + # This vhost is a bare redirect and does not include basic.conf, so HSTS + # is set explicitly -- otherwise the redirect hop is the one response on + # this domain without it. + include custom.d/security/strict-transport-security.conf; + return 301 https://$krz_target$request_uri; } diff --git a/linux/nginx/etc/nginx/custom.d/basic.conf b/linux/nginx/etc/nginx/custom.d/basic.conf index 8de788c..3c6cfce 100644 --- a/linux/nginx/etc/nginx/custom.d/basic.conf +++ b/linux/nginx/etc/nginx/custom.d/basic.conf @@ -4,5 +4,13 @@ include custom.d/security/referrer-policy.conf; include custom.d/security/x-content-type-options.conf; include custom.d/security/x-frame-options.conf; +include custom.d/security/strict-transport-security.conf; +include custom.d/security/permissions-policy.conf; include custom.d/location/security_file_access.conf; #include custom.d/cross-origin/requests.conf; + +# HSTS and Permissions-Policy live here, not per-vhost: every vhost is HTTPS +# via the tunnel, so the commitment is universal. CSP is deliberately NOT +# here -- it is content-type-mapped and a blanket policy breaks app UIs, so +# it stays per-vhost until the per-app pass. Note that rogue.conf does not +# include this file (intentional: it strips headers as a byte-size test). diff --git a/linux/nginx/etc/nginx/custom.d/tls/certificate_files.conf b/linux/nginx/etc/nginx/custom.d/tls/certificate_files.conf deleted file mode 100644 index 7726591..0000000 --- a/linux/nginx/etc/nginx/custom.d/tls/certificate_files.conf +++ /dev/null @@ -1,2 +0,0 @@ -# Legacy include name: cleberg.net certificate (most zerolabs/cleberg.net vhosts). -include certificate_files_cleberg_net.conf; diff --git a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_dev.conf b/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_dev.conf deleted file mode 100644 index d74f2c8..0000000 --- a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_dev.conf +++ /dev/null @@ -1,3 +0,0 @@ -ssl_certificate /etc/letsencrypt/live/cleberg.dev/fullchain.pem; -ssl_certificate_key /etc/letsencrypt/live/cleberg.dev/privkey.pem; -ssl_trusted_certificate /etc/letsencrypt/live/cleberg.dev/chain.pem; diff --git a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_io.conf b/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_io.conf deleted file mode 100644 index a94c829..0000000 --- a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_io.conf +++ /dev/null @@ -1,3 +0,0 @@ -ssl_certificate /etc/letsencrypt/live/cleberg.io/fullchain.pem; -ssl_certificate_key /etc/letsencrypt/live/cleberg.io/privkey.pem; -ssl_trusted_certificate /etc/letsencrypt/live/cleberg.io/chain.pem; diff --git a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_net.conf b/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_net.conf deleted file mode 100644 index afd7aa9..0000000 --- a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_cleberg_net.conf +++ /dev/null @@ -1,16 +0,0 @@ -# ---------------------------------------------------------------------- -# | Certificate files — cleberg.net | -# ---------------------------------------------------------------------- - -# This default SSL certificate will be served whenever the client lacks support -# for SNI (Server Name Indication). -# -# (1) Certificate and key files location -# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate -# -# (2) Intermediate certificate for OCSP stapling -# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_trusted_certificate - -ssl_certificate /etc/letsencrypt/live/cleberg.net/fullchain.pem; -ssl_certificate_key /etc/letsencrypt/live/cleberg.net/privkey.pem; -ssl_trusted_certificate /etc/letsencrypt/live/cleberg.net/chain.pem; diff --git a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_reminiscecleberg_com.conf b/linux/nginx/etc/nginx/custom.d/tls/certificate_files_reminiscecleberg_com.conf deleted file mode 100644 index 00f9ef7..0000000 --- a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_reminiscecleberg_com.conf +++ /dev/null @@ -1,3 +0,0 @@ -ssl_certificate /etc/letsencrypt/live/reminiscecleberg.com/fullchain.pem; -ssl_certificate_key /etc/letsencrypt/live/reminiscecleberg.com/privkey.pem; -ssl_trusted_certificate /etc/letsencrypt/live/reminiscecleberg.com/chain.pem; diff --git a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_zerolabs_sh.conf b/linux/nginx/etc/nginx/custom.d/tls/certificate_files_zerolabs_sh.conf deleted file mode 100644 index 3a6ba1a..0000000 --- a/linux/nginx/etc/nginx/custom.d/tls/certificate_files_zerolabs_sh.conf +++ /dev/null @@ -1,3 +0,0 @@ -ssl_certificate /etc/letsencrypt/live/zerolabs.sh/fullchain.pem; -ssl_certificate_key /etc/letsencrypt/live/zerolabs.sh/privkey.pem; -ssl_trusted_certificate /etc/letsencrypt/live/zerolabs.sh/chain.pem; diff --git a/linux/nginx/etc/nginx/custom.d/tls/ocsp_stapling.conf b/linux/nginx/etc/nginx/custom.d/tls/ocsp_stapling.conf deleted file mode 100644 index 4a16fbc..0000000 --- a/linux/nginx/etc/nginx/custom.d/tls/ocsp_stapling.conf +++ /dev/null @@ -1,34 +0,0 @@ -# ---------------------------------------------------------------------- -# | Online Certificate Status Protocol stapling | -# ---------------------------------------------------------------------- - -# OCSP is a lightweight, only one record to help clients verify the validity of -# the server certificate. -# OCSP stapling allows the server to send its cached OCSP record during the TLS -# handshake, without the need of 3rd party OCSP responder. -# -# https://wiki.mozilla.org/Security/Server_Side_TLS#OCSP_Stapling -# https://tools.ietf.org/html/rfc6066#section-8 -# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling -# -# (1) Use Cloudflare 1.1.1.1 DNS resolver -# https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1/ -# -# (2) Use Google 8.8.8.8 DNS resolver -# https://developers.google.com/speed/public-dns/docs/using -# -# (3) Use OpenDNS resolver -# https://use.opendns.com - -ssl_stapling on; -ssl_stapling_verify on; - -resolver - # (1) - 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001] - # (2) - 8.8.8.8 8.8.4.4 [2001:4860:4860::8888] [2001:4860:4860::8844] - # (3) - # 208.67.222.222 208.67.220.220 [2620:119:35::35] [2620:119:53::53] - valid=60s; -resolver_timeout 2s; diff --git a/linux/nginx/etc/nginx/custom.d/tls/policy_balanced.conf b/linux/nginx/etc/nginx/custom.d/tls/policy_balanced.conf deleted file mode 100644 index f8a19c9..0000000 --- a/linux/nginx/etc/nginx/custom.d/tls/policy_balanced.conf +++ /dev/null @@ -1,20 +0,0 @@ -# ---------------------------------------------------------------------- -# | SSL policy - Balanced | -# ---------------------------------------------------------------------- - -# For services that need to support a wide range of clients, this configuration -# is reasonably balanced. -# -# (1) The NIST curves (prime256v1, secp384r1, secp521r1) are known to be weak -# and potentially vulnerable but are required to support Microsoft Edge -# and Safari. -# https://safecurves.cr.yp.to/ -# -# https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations -# https://nginx.org/en/docs/http/ngx_http_ssl_module.html - -ssl_protocols TLSv1.2; -ssl_ciphers EECDH+CHACHA20:EECDH+AES; - -# (1) -ssl_ecdh_curve X25519:prime256v1:secp521r1:secp384r1; diff --git a/linux/nginx/etc/nginx/custom.d/tls/policy_strict.conf b/linux/nginx/etc/nginx/custom.d/tls/policy_strict.conf deleted file mode 100644 index 8d0a70b..0000000 --- a/linux/nginx/etc/nginx/custom.d/tls/policy_strict.conf +++ /dev/null @@ -1,50 +0,0 @@ -# ---------------------------------------------------------------------- -# | SSL policy - Strict | -# ---------------------------------------------------------------------- - -# For services that don't need backward compatibility, the parameters below -# provide the highest level of security and performance. -# -# (!) This policy enforces a strong TLS configuration, which may raise -# errors with old clients. -# If a more compatible profile is required, use the "balanced" policy. -# -# (!) TLSv1.3 and its 0-RTT feature require NGINX >=1.15.4 and OpenSSL >=1.1.1 -# to be installed. -# -# (!) Don't enable `ssl_early_data` blindly! Requests sent within early data are -# subject to replay attacks. -# -# (1) The NIST curves (prime256v1, secp384r1, secp521r1) are known to be weak -# and potentially vulnerable. -# -# Add them back to the parameter `ssl_ecdh_curve` below to support -# Microsoft Edge and Safari. -# -# https://safecurves.cr.yp.to/ -# -# (2) Enables TLS 1.3 0-RTT, allows for faster resumption of TLS sessions. -# -# (!) Requests sent within early data are subject to replay attacks. -# To protect against such attacks at the application layer, the -# `$ssl_early_data` variable should be used: -# -# proxy_set_header Early-Data $ssl_early_data; -# -# The application should return response code 425 "Too Early" for anything -# that could contain user supplied data. -# -# https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/425 -# -# https://github.com/certbot/certbot/issues/6367 -# https://github.com/mozilla/server-side-tls/issues/217 -# https://nginx.org/en/docs/http/ngx_http_ssl_module.html - -ssl_protocols TLSv1.2 TLSv1.3; -ssl_ciphers EECDH+CHACHA20:EECDH+AES; - -# (1) -ssl_ecdh_curve X25519; - -# (2) -#ssl_early_data on; diff --git a/linux/nginx/etc/nginx/custom.d/tls/ssl_engine.conf b/linux/nginx/etc/nginx/custom.d/tls/ssl_engine.conf deleted file mode 100644 index 4c3b33a..0000000 --- a/linux/nginx/etc/nginx/custom.d/tls/ssl_engine.conf +++ /dev/null @@ -1,47 +0,0 @@ -# ---------------------------------------------------------------------- -# | SSL engine | -# ---------------------------------------------------------------------- - -# (1) Optimize SSL by caching session parameters for 24 hours. -# This cuts down on the number of expensive SSL handshakes. -# By enabling a cache, we tell the client to re-use the already -# negotiated state. -# Here 10m (10 MB) in ssl_session_cache is size value (not time). -# 1 MB cache can store about 4000 sessions, so we can store 40000 sessions. -# -# (2) Use a higher keepalive timeout to reduce the need for repeated handshakes -# (!) Shouldn't be done unless you serve primarily HTTPS. -# Default is 75s -# -# (3) SSL buffer size -# Set 1400 bytes to fit in one MTU. -# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_buffer_size -# -# (4) Disable session tickets -# Session tickets keys are not auto-rotated. Only a HUP / restart will do -# so and when a restart is performed the previous key is lost, which resets -# all previous sessions. -# Only enable session tickets if you set up a manual rotation mechanism. -# https://trac.nginx.org/nginx/changeset/1356a3b9692441e163b4e78be4e9f5a46c7479e9/nginx -# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_tickets -# -# (5) The TLS 1.2 and 1.3 ciphers in use in current policies are not considered -# dangerous. This directive let the client choose the one that best fits their needs. -# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers -# https://wiki.mozilla.org/Security/Server_Side_TLS - -# (1) -ssl_session_timeout 24h; -ssl_session_cache shared:SSL:10m; - -# (2) -keepalive_timeout 300s; - -# (3) -# ssl_buffer_size 1400; - -# (4) -ssl_session_tickets off; - -# (5) -ssl_prefer_server_ciphers off; |