update

5 files changed, 102 insertions, 5 deletions

diff --git a/terminaldweller.com/browsh/nginx.conf b/terminaldweller.com/browsh/nginx.conf
new file mode 100644
index 0000000..eb40f31
--- /dev/null
+++ b/terminaldweller.com/browsh/nginx.conf
@@ -0,0 +1,40 @@
+events {
+  worker_connections 1024;
+}
+http {
+  include /etc/nginx/mime.types;
+  server_tokens off;
+  limit_req_zone $binary_remote_addr zone=one:10m rate=30r/m;
+  server {
+    listen 443 ssl http2;
+    keepalive_timeout 60;
+    charset utf-8;
+    ssl_ciphers HIGH:!aNULL:!MD5:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+    ssl_certificate /certs/fullchain1.pem;
+    ssl_certificate_key /certs/privkey1.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_session_cache shared:SSL:50m;
+    ssl_session_timeout 1d;
+    ssl_session_tickets off;
+    ssl_prefer_server_ciphers on;
+    sendfile on;
+    tcp_nopush on;
+    # add_header X-Content-Type-Options "nosniff" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    # add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' unpkg.com cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' unpkg.com cdnjs.cloudflare.com; connect-src *;";
+    # add_header X-Frame-Options SAMEORIGIN always;
+    # add_header X-XSS-Protection "1; mode=block" always;
+    # add_header Permissions-Policy "geolocation=(self),midi=(self),sync-xhr=(self),microphone=(self),camera=(self),magnetometer=(self),gyroscope=(self),fullscreen=(self),payment=(self),usb=(self)";
+    # add_header Referrer-Policy "no-referrer";
+    fastcgi_hide_header X-Powered-By;
+    resolver 9.9.9.9 208.67.222.222;
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    ssl_trusted_certificate /certs/cert1.pem;
+
+    error_page 401 403 404 /404.html;
+    location / {
+      proxy_pass http://browsh:4333;
+    }
+  }
+}
diff --git a/terminaldweller.com/cargo/nginx.conf b/terminaldweller.com/cargo/nginx.conf
index eafeeee..bec87f2 100644
--- a/terminaldweller.com/cargo/nginx.conf
+++ b/terminaldweller.com/cargo/nginx.conf
@@ -5,10 +5,17 @@ http {
   server {
     listen 8080 ssl http2;
     keepalive_timeout 70;
-    ssl_certificate /certs/cert1.pem;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    ssl_ciphers HIGH:!aNULL:!MD5:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers on;
+    ssl_certificate /certs/fullchain1.pem;
     ssl_certificate_key /certs/privkey1.pem;
     ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers HIGH:!aNULL:!MD5;
+    add_header Content-Security-Policy "default-src 'self';";
+    add_header X-Frame-Options SAMEORIGIN always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "no-referrer";
     sendfile on;
     tcp_nopush on;
 
diff --git a/terminaldweller.com/cgit/cgit.conf b/terminaldweller.com/cgit/cgit.conf
index e180158..82a9877 100644
--- a/terminaldweller.com/cgit/cgit.conf
+++ b/terminaldweller.com/cgit/cgit.conf
@@ -1,10 +1,19 @@
-server.modules += ( "mod_cgi", "mod_rewrite", "mod_openssl" )
+server.modules += ( "mod_cgi", "mod_rewrite", "mod_openssl", "mod_setenv" )
 
 $SERVER["socket"] == ":443" {
     ssl.engine                    = "enable"
     ssl.pemfile                   = "/etc/certs/fullchain1.pem"
     ssl.privkey                   = "/etc/certs/privkey1.pem"
 
+    setenv.add-response-header = (
+	"Strict-Transport-Security"=>"max-age=63072000; includeSubdomains", 
+	"X-Frame-Options"=>"DENY",
+	"X-XSS-Protection"=>"1; mode=block",
+	"X-Content-Type-Options" => "nosniff",
+	"Content-Security-Policy" => "script-src 'self'; object-src 'self'",
+	"X-Permitted-Cross-Domain-Policies" => "none",
+	"Referrer-Policy" => "no-referrer")
+
     server.name          = "git.terminaldweller.com"
     server.document-root = "/usr/share/webapps/cgit/"
 
diff --git a/terminaldweller.com/ejabberd/ejabberd.yml b/terminaldweller.com/ejabberd/ejabberd.yml
index 228ac6d..815d702 100644
--- a/terminaldweller.com/ejabberd/ejabberd.yml
+++ b/terminaldweller.com/ejabberd/ejabberd.yml
@@ -1,7 +1,7 @@
 hosts:
   - jabber.terminaldweller.com
 
-auth_method: internal 
+auth_method: internal
 auth_password_format: scram # pragma: allowlist secret
 # anonymous_protocol: both
 allow_multiple_connections: true
@@ -16,6 +16,7 @@ define_macro:
     - "no_sslv3"
     - "no_tlsv1"
     - "no_tlsv1_1"
+    - "no_tlsv1_2"
     - "cipher_server_preference"
     - "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:RSA-PSK-AES256-GCM-SHA384:DHE-PSK-AES256-GCM-SHA384:RSA-PSK-CHACHA20-POLY1305:DHE-PSK-CHACHA20-POLY1305:ECDHE-PSK-CHACHA20-POLY1305:AES256-GCM-SHA384:PSK-AES256-GCM-SHA384:PSK-CHACHA20-POLY1305:RSA-PSK-AES128-GCM-SHA256:DHE-PSK-AES128-GCM-SHA256:AES128-GCM-SHA256:PSK-AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:ECDHE-PSK-AES256-CBC-SHA384:ECDHE-PSK-AES256-CBC-SHA:SRP-RSA-AES-256-CBC-SHA:SRP-AES-256-CBC-SHA:RSA-PSK-AES256-CBC-SHA384:DHE-PSK-AES256-CBC-SHA384:RSA-PSK-AES256-CBC-SHA:DHE-PSK-AES256-CBC-SHA:AES256-SHA:PSK-AES256-CBC-SHA384:PSK-AES256-CBC-SHA:ECDHE-PSK-AES128-CBC-SHA256:ECDHE-PSK-AES128-CBC-SHA:SRP-RSA-AES-128-CBC-SHA:SRP-AES-128-CBC-SHA:RSA-PSK-AES128-CBC-SHA256:DHE-PSK-AES128-CBC-SHA256:RSA-PSK-AES128-CBC-SHA:DHE-PSK-AES128-CBC-SHA:AES128-SHA:PSK-AES128-CBC-SHA256:PSK-AES128-CBC-SHA"
     - "no_compression"
@@ -200,7 +201,7 @@ max_fsm_queue: 10000
 acme:
   # for auto ACME requests, we need this to be true
   auto: false
-  contact: 
+  contact:
     - mailto:devi@terminaldweller.com
   ca_url: https://acme-v02.api.letsencrypt.org/directory
 
diff --git a/terminaldweller.com/rss-bridge/nginx.conf b/terminaldweller.com/rss-bridge/nginx.conf
new file mode 100644
index 0000000..b80883b
--- /dev/null
+++ b/terminaldweller.com/rss-bridge/nginx.conf
@@ -0,0 +1,40 @@
+events {
+  worker_connections 1024;
+}
+http {
+  include /etc/nginx/mime.types;
+  server_tokens off;
+  limit_req_zone $binary_remote_addr zone=one:10m rate=30r/m;
+  server {
+    listen 443 ssl;
+    keepalive_timeout 60;
+    charset utf-8;
+    ssl_certificate /certs/fullchain1.pem;
+    ssl_certificate_key /certs/privkey1.pem;
+    ssl_ciphers HIGH:!aNULL:!MD5:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_session_cache shared:SSL:50m;
+    ssl_session_timeout 1d;
+    ssl_session_tickets off;
+    ssl_prefer_server_ciphers on;
+    # sendfile on;
+    tcp_nopush on;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header Content-Security-Policy "default-src 'self';";
+    add_header X-Frame-Options SAMEORIGIN always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    # add_header Permissions-Policy "geolocation=(self),midi=(self),sync-xhr=(self),microphone=(self),camera=(self),magnetometer=(self),gyroscope=(self),fullscreen=(self),payment=(self),usb=(self)";
+    add_header Referrer-Policy "no-referrer";
+    fastcgi_hide_header X-Powered-By;
+    # resolver 9.9.9.9 208.67.222.222;
+    # ssl_stapling on;
+    # ssl_stapling_verify on;
+    ssl_trusted_certificate /certs/cert1.pem;
+
+    error_page 401 403 404 /404.html;
+    location / {
+      proxy_pass http://rssbridge:80;
+    }
+  }
+}