From 674f40d027ece13daa78ef2a7d69c79f4198368a Mon Sep 17 00:00:00 2001 From: terminaldweller Date: Fri, 2 Dec 2022 21:22:42 +0330 Subject: update --- terminaldweller.com/browsh/nginx.conf | 40 +++++++++++++++++++++++++++++++ terminaldweller.com/cargo/nginx.conf | 11 +++++++-- terminaldweller.com/cgit/cgit.conf | 11 ++++++++- terminaldweller.com/ejabberd/ejabberd.yml | 5 ++-- terminaldweller.com/rss-bridge/nginx.conf | 40 +++++++++++++++++++++++++++++++ 5 files changed, 102 insertions(+), 5 deletions(-) create mode 100644 terminaldweller.com/browsh/nginx.conf create mode 100644 terminaldweller.com/rss-bridge/nginx.conf (limited to 'terminaldweller.com') diff --git a/terminaldweller.com/browsh/nginx.conf b/terminaldweller.com/browsh/nginx.conf new file mode 100644 index 0000000..eb40f31 --- /dev/null +++ b/terminaldweller.com/browsh/nginx.conf @@ -0,0 +1,40 @@ +events { + worker_connections 1024; +} +http { + include /etc/nginx/mime.types; + server_tokens off; + limit_req_zone $binary_remote_addr zone=one:10m rate=30r/m; + server { + listen 443 ssl http2; + keepalive_timeout 60; + charset utf-8; + ssl_ciphers HIGH:!aNULL:!MD5:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + ssl_certificate /certs/fullchain1.pem; + ssl_certificate_key /certs/privkey1.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_session_cache shared:SSL:50m; + ssl_session_timeout 1d; + ssl_session_tickets off; + ssl_prefer_server_ciphers on; + sendfile on; + tcp_nopush on; + # add_header X-Content-Type-Options "nosniff" always; + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + # add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' unpkg.com cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' unpkg.com cdnjs.cloudflare.com; connect-src *;"; + # add_header X-Frame-Options SAMEORIGIN always; + # add_header X-XSS-Protection "1; mode=block" always; + # add_header Permissions-Policy "geolocation=(self),midi=(self),sync-xhr=(self),microphone=(self),camera=(self),magnetometer=(self),gyroscope=(self),fullscreen=(self),payment=(self),usb=(self)"; + # add_header Referrer-Policy "no-referrer"; + fastcgi_hide_header X-Powered-By; + resolver 9.9.9.9 208.67.222.222; + ssl_stapling on; + ssl_stapling_verify on; + ssl_trusted_certificate /certs/cert1.pem; + + error_page 401 403 404 /404.html; + location / { + proxy_pass http://browsh:4333; + } + } +} diff --git a/terminaldweller.com/cargo/nginx.conf b/terminaldweller.com/cargo/nginx.conf index eafeeee..bec87f2 100644 --- a/terminaldweller.com/cargo/nginx.conf +++ b/terminaldweller.com/cargo/nginx.conf @@ -5,10 +5,17 @@ http { server { listen 8080 ssl http2; keepalive_timeout 70; - ssl_certificate /certs/cert1.pem; + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + ssl_ciphers HIGH:!aNULL:!MD5:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + ssl_prefer_server_ciphers on; + ssl_certificate /certs/fullchain1.pem; ssl_certificate_key /certs/privkey1.pem; ssl_protocols TLSv1.2 TLSv1.3; - ssl_ciphers HIGH:!aNULL:!MD5; + add_header Content-Security-Policy "default-src 'self';"; + add_header X-Frame-Options SAMEORIGIN always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; + add_header Referrer-Policy "no-referrer"; sendfile on; tcp_nopush on; diff --git a/terminaldweller.com/cgit/cgit.conf b/terminaldweller.com/cgit/cgit.conf index e180158..82a9877 100644 --- a/terminaldweller.com/cgit/cgit.conf +++ b/terminaldweller.com/cgit/cgit.conf @@ -1,10 +1,19 @@ -server.modules += ( "mod_cgi", "mod_rewrite", "mod_openssl" ) +server.modules += ( "mod_cgi", "mod_rewrite", "mod_openssl", "mod_setenv" ) $SERVER["socket"] == ":443" { ssl.engine = "enable" ssl.pemfile = "/etc/certs/fullchain1.pem" ssl.privkey = "/etc/certs/privkey1.pem" + setenv.add-response-header = ( + "Strict-Transport-Security"=>"max-age=63072000; includeSubdomains", + "X-Frame-Options"=>"DENY", + "X-XSS-Protection"=>"1; mode=block", + "X-Content-Type-Options" => "nosniff", + "Content-Security-Policy" => "script-src 'self'; object-src 'self'", + "X-Permitted-Cross-Domain-Policies" => "none", + "Referrer-Policy" => "no-referrer") + server.name = "git.terminaldweller.com" server.document-root = "/usr/share/webapps/cgit/" diff --git a/terminaldweller.com/ejabberd/ejabberd.yml b/terminaldweller.com/ejabberd/ejabberd.yml index 228ac6d..815d702 100644 --- a/terminaldweller.com/ejabberd/ejabberd.yml +++ b/terminaldweller.com/ejabberd/ejabberd.yml @@ -1,7 +1,7 @@ hosts: - jabber.terminaldweller.com -auth_method: internal +auth_method: internal auth_password_format: scram # pragma: allowlist secret # anonymous_protocol: both allow_multiple_connections: true @@ -16,6 +16,7 @@ define_macro: - "no_sslv3" - "no_tlsv1" - "no_tlsv1_1" + - "no_tlsv1_2" - "cipher_server_preference" - "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:RSA-PSK-AES256-GCM-SHA384:DHE-PSK-AES256-GCM-SHA384:RSA-PSK-CHACHA20-POLY1305:DHE-PSK-CHACHA20-POLY1305:ECDHE-PSK-CHACHA20-POLY1305:AES256-GCM-SHA384:PSK-AES256-GCM-SHA384:PSK-CHACHA20-POLY1305:RSA-PSK-AES128-GCM-SHA256:DHE-PSK-AES128-GCM-SHA256:AES128-GCM-SHA256:PSK-AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:ECDHE-PSK-AES256-CBC-SHA384:ECDHE-PSK-AES256-CBC-SHA:SRP-RSA-AES-256-CBC-SHA:SRP-AES-256-CBC-SHA:RSA-PSK-AES256-CBC-SHA384:DHE-PSK-AES256-CBC-SHA384:RSA-PSK-AES256-CBC-SHA:DHE-PSK-AES256-CBC-SHA:AES256-SHA:PSK-AES256-CBC-SHA384:PSK-AES256-CBC-SHA:ECDHE-PSK-AES128-CBC-SHA256:ECDHE-PSK-AES128-CBC-SHA:SRP-RSA-AES-128-CBC-SHA:SRP-AES-128-CBC-SHA:RSA-PSK-AES128-CBC-SHA256:DHE-PSK-AES128-CBC-SHA256:RSA-PSK-AES128-CBC-SHA:DHE-PSK-AES128-CBC-SHA:AES128-SHA:PSK-AES128-CBC-SHA256:PSK-AES128-CBC-SHA" - "no_compression" @@ -200,7 +201,7 @@ max_fsm_queue: 10000 acme: # for auto ACME requests, we need this to be true auto: false - contact: + contact: - mailto:devi@terminaldweller.com ca_url: https://acme-v02.api.letsencrypt.org/directory diff --git a/terminaldweller.com/rss-bridge/nginx.conf b/terminaldweller.com/rss-bridge/nginx.conf new file mode 100644 index 0000000..b80883b --- /dev/null +++ b/terminaldweller.com/rss-bridge/nginx.conf @@ -0,0 +1,40 @@ +events { + worker_connections 1024; +} +http { + include /etc/nginx/mime.types; + server_tokens off; + limit_req_zone $binary_remote_addr zone=one:10m rate=30r/m; + server { + listen 443 ssl; + keepalive_timeout 60; + charset utf-8; + ssl_certificate /certs/fullchain1.pem; + ssl_certificate_key /certs/privkey1.pem; + ssl_ciphers HIGH:!aNULL:!MD5:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_session_cache shared:SSL:50m; + ssl_session_timeout 1d; + ssl_session_tickets off; + ssl_prefer_server_ciphers on; + # sendfile on; + tcp_nopush on; + add_header X-Content-Type-Options "nosniff" always; + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + add_header Content-Security-Policy "default-src 'self';"; + add_header X-Frame-Options SAMEORIGIN always; + add_header X-XSS-Protection "1; mode=block" always; + # add_header Permissions-Policy "geolocation=(self),midi=(self),sync-xhr=(self),microphone=(self),camera=(self),magnetometer=(self),gyroscope=(self),fullscreen=(self),payment=(self),usb=(self)"; + add_header Referrer-Policy "no-referrer"; + fastcgi_hide_header X-Powered-By; + # resolver 9.9.9.9 208.67.222.222; + # ssl_stapling on; + # ssl_stapling_verify on; + ssl_trusted_certificate /certs/cert1.pem; + + error_page 401 403 404 /404.html; + location / { + proxy_pass http://rssbridge:80; + } + } +} -- cgit v1.2.3