@@ -46,45 +46,45 @@ http {
4646 proxy_cache_path /var/cache/nginx/cached levels=2:2
4747 keys_zone=global:64m inactive=60m max_size=1G ;
4848
49- server {
50- listen 1.2.3.4:80 ;
51- return 301 https://$host$request_uri ;
52- }
53- server {
54- listen 1.2.3.4:443 default ssl ;
55- ssl_certificate /etc/nginx/example.com.crt;
56- ssl_certificate_key /etc/nginx/example.com.key;
57- ssl_prefer_server_ciphers on;
58- ssl_session_cache shared:SSL:10m ;
59- ssl_session_timeout 10m ;
49+ server {
50+ listen 1.2.3.4:80 ;
51+ return 301 https://$host$request_uri ;
52+ }
6053
61- # Only strong ciphers in PFS mode
62- ssl_ciphers ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA;
63- ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
54+ server {
55+ listen 1.2.3.4:443 default ssl ;
56+ ssl_certificate /etc/nginx/example.com.crt;
57+ ssl_certificate_key /etc/nginx/example.com.key;
58+ ssl_prefer_server_ciphers on;
59+ ssl_session_cache shared:SSL:10m ;
60+ ssl_session_timeout 10m ;
6461
65- # For ssl client certificates, edit ssl_client_certificate
66- # (specifies a file containing permissable CAs) and uncomment the
67- # following:
68- #ssl_verify_client optional;
69- #ssl_client_certificate /etc/ssl/ca.crt
62+ # Only strong ciphers in PFS mode
63+ ssl_ciphers ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA;
64+ ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
7065
71- server_name example.com;
72- location / {
73- # Uncomment to route requests through Tor.
74- # proxy_pass http://127.0.0.1:8118;
75- # proxy_set_header Host $server_id.onion;
76- # proxy_read_timeout 2000;
77-
78- if ( $host ~ * ( .*) .example.com) {
79- set $server_id $1 ;
80- }
81- # 31536000 == 1 year
82- add_header Strict-Transport-Security "max-age=31536000; includeSubdomains" ;
83- add_header X-Frame-Options DENY;
84- proxy_cache global;
85- proxy_cache_valid any 1h ;
86- proxy_cache_use_stale updating;
66+ # For ssl client certificates, edit ssl_client_certificate
67+ # (specifies a file containing permissable CAs) and uncomment the
68+ # following:
69+ #ssl_verify_client optional;
70+ #ssl_client_certificate /etc/ssl/ca.crt
8771
72+ server_name example.com;
73+ location / {
74+ # Uncomment to route requests through Tor.
75+ # proxy_pass http://127.0.0.1:8118;
76+ # proxy_set_header Host $server_id.onion;
77+ # proxy_read_timeout 2000;
78+
79+ if ( $host ~ * ( .*) .example.com) {
80+ set $server_id $1 ;
81+ }
82+ # 31536000 == 1 year
83+ add_header Strict-Transport-Security "max-age=31536000; includeSubdomains" ;
84+ add_header X-Frame-Options DENY;
85+ proxy_cache global;
86+ proxy_cache_valid any 1h ;
87+ proxy_cache_use_stale updating;
88+ }
8889 }
8990}
90- }
0 commit comments