From 1b731e2643f84862138993b75dc6172ef237c87c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= <08.essays.update@icloud.com> Date: Wed, 7 Dec 2022 13:56:12 +0100 Subject: [PATCH 1/2] Add future-proof Nginx configuration - support IPv6 - 80 to 443 redirect - TLS generation - better SSL sessions - longer HSTS (2 years) - OCSP stapling --- docs/example.nginx.conf | 48 ++++++++++++++++++++++++++++++++--------- 1 file changed, 38 insertions(+), 10 deletions(-) diff --git a/docs/example.nginx.conf b/docs/example.nginx.conf index 761216d5f..a9b723c39 100644 --- a/docs/example.nginx.conf +++ b/docs/example.nginx.conf @@ -4,8 +4,27 @@ # installation (http server by the Nodejs process). If you are using CryptPad # in production and require professional support please contact sales@cryptpad.fr +server { + listen 80; + listen [::]:80; + server_name rage.love; + + access_log /dev/null; + error_log /dev/null emerg; + + # Let's Encrypt webroot + include letsencrypt-webroot; + + # Redirect all HTTP requests to HTTPS with a 301 Moved Permanently response. + return 301 https://$host$request_uri; +} + server { listen 443 ssl http2; + listen [::]:443 ssl http2; + + # Let's Encrypt webroot + include letsencrypt-webroot; # CryptPad serves static assets over these two domains. # `main_domain` is what users will enter in their address bar. @@ -46,26 +65,35 @@ server { # IMPORTANT: this config is intended to serve assets for at least two domains # (your main domain and your sandbox domain). As such, you'll need to generate a single SSL certificate # that includes both domains in order for things to work as expected. - ssl_certificate /home/cryptpad/.acme.sh/your-main-domain.com/fullchain.cer; - ssl_certificate_key /home/cryptpad/.acme.sh/your-main-domain.com/your-main-domain.com.key; - ssl_trusted_certificate /home/cryptpad/.acme.sh/your-main-domain.com/ca.cer; + ssl_certificate /etc/ssl/lets-encrypt/your-main-domain.com/cert; + ssl_certificate_key /etc/ssl/lets-encrypt/your-main-domain.com/key; # diffie-hellman parameters are used to negotiate keys for your session # generate strong parameters using the following command ssl_dhparam /etc/nginx/dhparam.pem; # openssl dhparam -out /etc/nginx/dhparam.pem 4096 # Speeds things up a little bit when resuming a session - ssl_session_timeout 5m; - ssl_session_cache shared:SSL:5m; + ssl_session_timeout 1d; + ssl_session_cache shared:MozSSL:10m; + ssl_session_tickets off; - # You'll need nginx 1.13.0 or better to support TLSv1.3 ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + ssl_prefer_server_ciphers off; - # https://cipherli.st/ - ssl_ciphers EECDH+AESGCM:EDH+AESGCM; - ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0 + # HSTS (ngx_http_headers_module is required) (63072000 seconds) + add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always; + + # OCSP stapling + ssl_stapling on; + ssl_stapling_verify on; + + # verify chain of trust of OCSP response using Root CA and Intermediate certs + ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt; + + # replace with the IP address of your resolver + resolver 8.8.8.8 8.8.4.4 1.1.1.1 1.0.0.1 9.9.9.9 149.112.112.112 208.67.222.222 208.67.220.220; - add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header X-XSS-Protection "1; mode=block"; add_header X-Content-Type-Options nosniff; add_header Access-Control-Allow-Origin "${allowed_origins}"; From 37ccaddbbe7bd8ea57827d09519a27e0a547e6fa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= <08.essays.update@icloud.com> Date: Wed, 7 Dec 2022 14:04:00 +0100 Subject: [PATCH 2/2] 2nd thought on HTTP/80, not needed in the end --- docs/example.nginx.conf | 15 --------------- 1 file changed, 15 deletions(-) diff --git a/docs/example.nginx.conf b/docs/example.nginx.conf index a9b723c39..16a26872c 100644 --- a/docs/example.nginx.conf +++ b/docs/example.nginx.conf @@ -4,21 +4,6 @@ # installation (http server by the Nodejs process). If you are using CryptPad # in production and require professional support please contact sales@cryptpad.fr -server { - listen 80; - listen [::]:80; - server_name rage.love; - - access_log /dev/null; - error_log /dev/null emerg; - - # Let's Encrypt webroot - include letsencrypt-webroot; - - # Redirect all HTTP requests to HTTPS with a 301 Moved Permanently response. - return 301 https://$host$request_uri; -} - server { listen 443 ssl http2; listen [::]:443 ssl http2;