security/hakurei.app
security/hakurei.app
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

move nginx https setup into a snippet

Browse Source
This commit is contained in:
Daniel Micay 2020-04-01 10:28:10 -04:00
parent ba080193c8
commit 3e4ee0cb28
2 changed files with 15 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
nginx/server.conf
View File

@ -1,7 +1,6 @@
server { server {
listen 80; listen 80;
listen [::]:80; listen [::]:80;
server_name www.grapheneos.org grapheneos.org; server_name www.grapheneos.org grapheneos.org;
root /var/empty; root /var/empty;
@ -10,40 +9,18 @@ server {
} }
server { server {
listen 443 ssl http2; include /etc/nginx/snippets/https.conf;
listen [::]:443 ssl http2;
server_name www.grapheneos.org; server_name www.grapheneos.org;
ssl_certificate /etc/letsencrypt/live/grapheneos.org/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/grapheneos.org/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
ssl_trusted_certificate /etc/letsencrypt/live/grapheneos.org/chain.pem;
ssl_stapling on;
ssl_stapling_verify on;
root /var/empty; root /var/empty;
return 301 https://grapheneos.org$request_uri; return 301 https://grapheneos.org$request_uri;
} }
server { server {
listen 443 ssl http2; include /etc/nginx/snippets/https.conf;
listen [::]:443 ssl http2;
server_name grapheneos.org; server_name grapheneos.org;
ssl_certificate /etc/letsencrypt/live/grapheneos.org/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/grapheneos.org/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
ssl_trusted_certificate /etc/letsencrypt/live/grapheneos.org/chain.pem;
ssl_stapling on;
ssl_stapling_verify on;
root /var/www/html; root /var/www/html;
charset utf-8; charset utf-8;
@ -112,7 +89,6 @@ server {
server { server {
listen 80; listen 80;
listen [::]:80; listen [::]:80;
server_name connectivitycheck.grapheneos.org; server_name connectivitycheck.grapheneos.org;
root /var/empty; root /var/empty;
@ -121,20 +97,9 @@ server {
} }
server { server {
listen 443 ssl http2; include /etc/nginx/snippets/https.conf;
listen [::]:443 ssl http2;
server_name connectivitycheck.grapheneos.org; server_name connectivitycheck.grapheneos.org;
ssl_certificate /etc/letsencrypt/live/grapheneos.org/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/grapheneos.org/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
ssl_trusted_certificate /etc/letsencrypt/live/grapheneos.org/chain.pem;
ssl_stapling on;
ssl_stapling_verify on;
root /var/empty; root /var/empty;
include /etc/nginx/snippets/security-headers.conf; include /etc/nginx/snippets/security-headers.conf;
@ -147,7 +112,6 @@ server {
server { server {
listen 80; listen 80;
listen [::]:80; listen [::]:80;
server_name mta-sts.grapheneos.org; server_name mta-sts.grapheneos.org;
root /var/empty; root /var/empty;
@ -156,20 +120,9 @@ server {
} }
server { server {
listen 443 ssl http2; include /etc/nginx/snippets/https.conf;
listen [::]:443 ssl http2;
server_name mta-sts.grapheneos.org; server_name mta-sts.grapheneos.org;
ssl_certificate /etc/letsencrypt/live/grapheneos.org/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/grapheneos.org/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
ssl_trusted_certificate /etc/letsencrypt/live/grapheneos.org/chain.pem;
ssl_stapling on;
ssl_stapling_verify on;
root /var/www/mta-sts; root /var/www/mta-sts;
include /etc/nginx/snippets/security-headers.conf; include /etc/nginx/snippets/security-headers.conf;

11
nginx/snippets/https.conf Normal file
View File

@ -0,0 +1,11 @@
listen 443 ssl http2;
listen [::]:443 ssl http2;
ssl_certificate /etc/letsencrypt/live/grapheneos.org/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/grapheneos.org/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
ssl_trusted_certificate /etc/letsencrypt/live/grapheneos.org/chain.pem;
ssl_stapling on;
ssl_stapling_verify on;