aboutsummaryrefslogtreecommitdiffstats
path: root/terminaldweller.com
diff options
context:
space:
mode:
Diffstat (limited to 'terminaldweller.com')
-rw-r--r--terminaldweller.com/browsh/nginx.conf40
-rw-r--r--terminaldweller.com/cargo/nginx.conf11
-rw-r--r--terminaldweller.com/cgit/cgit.conf11
-rw-r--r--terminaldweller.com/ejabberd/ejabberd.yml5
-rw-r--r--terminaldweller.com/rss-bridge/nginx.conf40
5 files changed, 102 insertions, 5 deletions
diff --git a/terminaldweller.com/browsh/nginx.conf b/terminaldweller.com/browsh/nginx.conf
new file mode 100644
index 0000000..eb40f31
--- /dev/null
+++ b/terminaldweller.com/browsh/nginx.conf
@@ -0,0 +1,40 @@
+events {
+ worker_connections 1024;
+}
+http {
+ include /etc/nginx/mime.types;
+ server_tokens off;
+ limit_req_zone $binary_remote_addr zone=one:10m rate=30r/m;
+ server {
+ listen 443 ssl http2;
+ keepalive_timeout 60;
+ charset utf-8;
+ ssl_ciphers HIGH:!aNULL:!MD5:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+ ssl_certificate /certs/fullchain1.pem;
+ ssl_certificate_key /certs/privkey1.pem;
+ ssl_protocols TLSv1.2 TLSv1.3;
+ ssl_session_cache shared:SSL:50m;
+ ssl_session_timeout 1d;
+ ssl_session_tickets off;
+ ssl_prefer_server_ciphers on;
+ sendfile on;
+ tcp_nopush on;
+ # add_header X-Content-Type-Options "nosniff" always;
+ add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+ # add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' unpkg.com cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' unpkg.com cdnjs.cloudflare.com; connect-src *;";
+ # add_header X-Frame-Options SAMEORIGIN always;
+ # add_header X-XSS-Protection "1; mode=block" always;
+ # add_header Permissions-Policy "geolocation=(self),midi=(self),sync-xhr=(self),microphone=(self),camera=(self),magnetometer=(self),gyroscope=(self),fullscreen=(self),payment=(self),usb=(self)";
+ # add_header Referrer-Policy "no-referrer";
+ fastcgi_hide_header X-Powered-By;
+ resolver 9.9.9.9 208.67.222.222;
+ ssl_stapling on;
+ ssl_stapling_verify on;
+ ssl_trusted_certificate /certs/cert1.pem;
+
+ error_page 401 403 404 /404.html;
+ location / {
+ proxy_pass http://browsh:4333;
+ }
+ }
+}
diff --git a/terminaldweller.com/cargo/nginx.conf b/terminaldweller.com/cargo/nginx.conf
index eafeeee..bec87f2 100644
--- a/terminaldweller.com/cargo/nginx.conf
+++ b/terminaldweller.com/cargo/nginx.conf
@@ -5,10 +5,17 @@ http {
server {
listen 8080 ssl http2;
keepalive_timeout 70;
- ssl_certificate /certs/cert1.pem;
+ add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+ ssl_ciphers HIGH:!aNULL:!MD5:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+ ssl_prefer_server_ciphers on;
+ ssl_certificate /certs/fullchain1.pem;
ssl_certificate_key /certs/privkey1.pem;
ssl_protocols TLSv1.2 TLSv1.3;
- ssl_ciphers HIGH:!aNULL:!MD5;
+ add_header Content-Security-Policy "default-src 'self';";
+ add_header X-Frame-Options SAMEORIGIN always;
+ add_header X-Content-Type-Options "nosniff" always;
+ add_header X-XSS-Protection "1; mode=block" always;
+ add_header Referrer-Policy "no-referrer";
sendfile on;
tcp_nopush on;
diff --git a/terminaldweller.com/cgit/cgit.conf b/terminaldweller.com/cgit/cgit.conf
index e180158..82a9877 100644
--- a/terminaldweller.com/cgit/cgit.conf
+++ b/terminaldweller.com/cgit/cgit.conf
@@ -1,10 +1,19 @@
-server.modules += ( "mod_cgi", "mod_rewrite", "mod_openssl" )
+server.modules += ( "mod_cgi", "mod_rewrite", "mod_openssl", "mod_setenv" )
$SERVER["socket"] == ":443" {
ssl.engine = "enable"
ssl.pemfile = "/etc/certs/fullchain1.pem"
ssl.privkey = "/etc/certs/privkey1.pem"
+ setenv.add-response-header = (
+ "Strict-Transport-Security"=>"max-age=63072000; includeSubdomains",
+ "X-Frame-Options"=>"DENY",
+ "X-XSS-Protection"=>"1; mode=block",
+ "X-Content-Type-Options" => "nosniff",
+ "Content-Security-Policy" => "script-src 'self'; object-src 'self'",
+ "X-Permitted-Cross-Domain-Policies" => "none",
+ "Referrer-Policy" => "no-referrer")
+
server.name = "git.terminaldweller.com"
server.document-root = "/usr/share/webapps/cgit/"
diff --git a/terminaldweller.com/ejabberd/ejabberd.yml b/terminaldweller.com/ejabberd/ejabberd.yml
index 228ac6d..815d702 100644
--- a/terminaldweller.com/ejabberd/ejabberd.yml
+++ b/terminaldweller.com/ejabberd/ejabberd.yml
@@ -1,7 +1,7 @@
hosts:
- jabber.terminaldweller.com
-auth_method: internal
+auth_method: internal
auth_password_format: scram # pragma: allowlist secret
# anonymous_protocol: both
allow_multiple_connections: true
@@ -16,6 +16,7 @@ define_macro:
- "no_sslv3"
- "no_tlsv1"
- "no_tlsv1_1"
+ - "no_tlsv1_2"
- "cipher_server_preference"
- "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:RSA-PSK-AES256-GCM-SHA384:DHE-PSK-AES256-GCM-SHA384:RSA-PSK-CHACHA20-POLY1305:DHE-PSK-CHACHA20-POLY1305:ECDHE-PSK-CHACHA20-POLY1305:AES256-GCM-SHA384:PSK-AES256-GCM-SHA384:PSK-CHACHA20-POLY1305:RSA-PSK-AES128-GCM-SHA256:DHE-PSK-AES128-GCM-SHA256:AES128-GCM-SHA256:PSK-AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:ECDHE-PSK-AES256-CBC-SHA384:ECDHE-PSK-AES256-CBC-SHA:SRP-RSA-AES-256-CBC-SHA:SRP-AES-256-CBC-SHA:RSA-PSK-AES256-CBC-SHA384:DHE-PSK-AES256-CBC-SHA384:RSA-PSK-AES256-CBC-SHA:DHE-PSK-AES256-CBC-SHA:AES256-SHA:PSK-AES256-CBC-SHA384:PSK-AES256-CBC-SHA:ECDHE-PSK-AES128-CBC-SHA256:ECDHE-PSK-AES128-CBC-SHA:SRP-RSA-AES-128-CBC-SHA:SRP-AES-128-CBC-SHA:RSA-PSK-AES128-CBC-SHA256:DHE-PSK-AES128-CBC-SHA256:RSA-PSK-AES128-CBC-SHA:DHE-PSK-AES128-CBC-SHA:AES128-SHA:PSK-AES128-CBC-SHA256:PSK-AES128-CBC-SHA"
- "no_compression"
@@ -200,7 +201,7 @@ max_fsm_queue: 10000
acme:
# for auto ACME requests, we need this to be true
auto: false
- contact:
+ contact:
- mailto:devi@terminaldweller.com
ca_url: https://acme-v02.api.letsencrypt.org/directory
diff --git a/terminaldweller.com/rss-bridge/nginx.conf b/terminaldweller.com/rss-bridge/nginx.conf
new file mode 100644
index 0000000..b80883b
--- /dev/null
+++ b/terminaldweller.com/rss-bridge/nginx.conf
@@ -0,0 +1,40 @@
+events {
+ worker_connections 1024;
+}
+http {
+ include /etc/nginx/mime.types;
+ server_tokens off;
+ limit_req_zone $binary_remote_addr zone=one:10m rate=30r/m;
+ server {
+ listen 443 ssl;
+ keepalive_timeout 60;
+ charset utf-8;
+ ssl_certificate /certs/fullchain1.pem;
+ ssl_certificate_key /certs/privkey1.pem;
+ ssl_ciphers HIGH:!aNULL:!MD5:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+ ssl_protocols TLSv1.2 TLSv1.3;
+ ssl_session_cache shared:SSL:50m;
+ ssl_session_timeout 1d;
+ ssl_session_tickets off;
+ ssl_prefer_server_ciphers on;
+ # sendfile on;
+ tcp_nopush on;
+ add_header X-Content-Type-Options "nosniff" always;
+ add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+ add_header Content-Security-Policy "default-src 'self';";
+ add_header X-Frame-Options SAMEORIGIN always;
+ add_header X-XSS-Protection "1; mode=block" always;
+ # add_header Permissions-Policy "geolocation=(self),midi=(self),sync-xhr=(self),microphone=(self),camera=(self),magnetometer=(self),gyroscope=(self),fullscreen=(self),payment=(self),usb=(self)";
+ add_header Referrer-Policy "no-referrer";
+ fastcgi_hide_header X-Powered-By;
+ # resolver 9.9.9.9 208.67.222.222;
+ # ssl_stapling on;
+ # ssl_stapling_verify on;
+ ssl_trusted_certificate /certs/cert1.pem;
+
+ error_page 401 403 404 /404.html;
+ location / {
+ proxy_pass http://rssbridge:80;
+ }
+ }
+}
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-19 16:11:47 +0000