From 871c175b8aa421f96285bdda915b724ec9163543 Mon Sep 17 00:00:00 2001 From: "Collin M. Barrett" Date: Sat, 23 Jan 2021 16:04:27 -0600 Subject: [PATCH] =?UTF-8?q?fix(reverse-proxy):=20=F0=9F=90=9B=20mv=20Stric?= =?UTF-8?q?t-Transport-Security=20to=20location?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- reverse-proxy/loc-includes/ssl.conf | 3 +++ reverse-proxy/svr-includes/ssl.conf | 3 +-- 2 files changed, 4 insertions(+), 2 deletions(-) create mode 100644 reverse-proxy/loc-includes/ssl.conf diff --git a/reverse-proxy/loc-includes/ssl.conf b/reverse-proxy/loc-includes/ssl.conf new file mode 100644 index 000000000..193e9a158 --- /dev/null +++ b/reverse-proxy/loc-includes/ssl.conf @@ -0,0 +1,3 @@ +# https://ssl-config.mozilla.org/#server=nginx&config=intermediate&ocsp=false + +add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; \ No newline at end of file diff --git a/reverse-proxy/svr-includes/ssl.conf b/reverse-proxy/svr-includes/ssl.conf index e36eacd41..ccc340578 100644 --- a/reverse-proxy/svr-includes/ssl.conf +++ b/reverse-proxy/svr-includes/ssl.conf @@ -10,9 +10,8 @@ ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; ssl_prefer_server_ciphers off; -add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; # https://support.cloudflare.com/hc/en-us/articles/204899617-Authenticated-Origin-Pulls ssl_client_certificate /etc/nginx/cert/cloudflare.crt; -ssl_verify_client on; +ssl_verify_client on; \ No newline at end of file