summaryrefslogtreecommitdiff
path: root/public/fs
diff options
context:
space:
mode:
Diffstat (limited to 'public/fs')
l---------public/fs/etc/nginx/certs.d/culturestrings.org1
-rw-r--r--public/fs/etc/nginx/conf.d/ssl_params17
-rw-r--r--public/fs/etc/nginx/nginx.conf59
3 files changed, 77 insertions, 0 deletions
diff --git a/public/fs/etc/nginx/certs.d/culturestrings.org b/public/fs/etc/nginx/certs.d/culturestrings.org
new file mode 120000
index 0000000..f5b4d30
--- /dev/null
+++ b/public/fs/etc/nginx/certs.d/culturestrings.org
@@ -0,0 +1 @@
+/home/webroot/midipix.org \ No newline at end of file
diff --git a/public/fs/etc/nginx/conf.d/ssl_params b/public/fs/etc/nginx/conf.d/ssl_params
new file mode 100644
index 0000000..9af9de4
--- /dev/null
+++ b/public/fs/etc/nginx/conf.d/ssl_params
@@ -0,0 +1,17 @@
+ssl_trusted_certificate /home/webroot/letsencrypt/ssl/chain.pem;
+
+ssl_stapling on;
+ssl_stapling_verify on;
+ssl_prefer_server_ciphers on;
+
+ssl_ciphers TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-CHACHA20-POLY1305-OLD:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:!aNULL:!eNULL:!EXPORT:!EDH:!CAMELLIA:!3DES:!DES:!MD5:!PSK:!RC4:!RSA;
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_ecdh_curve X25519:secp384r1;
+
+ssl_session_cache shared:SSL:1m;
+ssl_session_timeout 5m;
+
+add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
+add_header X-Frame-Options DENY;
+add_header X-Content-Type-Options nosniff;
+add_header X-XSS-Protection "1; mode=block";
diff --git a/public/fs/etc/nginx/nginx.conf b/public/fs/etc/nginx/nginx.conf
new file mode 100644
index 0000000..9b92ab4
--- /dev/null
+++ b/public/fs/etc/nginx/nginx.conf
@@ -0,0 +1,59 @@
+worker_processes 1;
+
+load_module lib64/nginx/modules/ngx_http_fancyindex_module.so;
+
+events {
+ worker_connections 1024;
+ use epoll;
+}
+
+
+http {
+ include mime.types;
+ default_type application/octet-stream;
+
+ sendfile on;
+ tcp_nopush on;
+
+ keepalive_timeout 65;
+
+ include conf.d/*.conf;
+
+ server {
+ listen [::]:80 default_server ipv6only=off reuseport;
+ server_name localhost;
+
+ location / {
+ root /srv/www/htdocs/;
+ index index.html index.htm;
+ }
+
+ error_page 500 502 503 504 /50x.html;
+
+ location = /50x.html {
+ root /srv/www/htdocs/;
+ }
+ }
+
+ server {
+ listen [::]:443 default_server ssl http2 ipv6only=off reuseport;
+ server_name localhost;
+
+ ssl_certificate /etc/nginx/certs.d/culturestrings.org/ssl/fullchain.pem;
+ ssl_certificate_key /etc/nginx/certs.d/culturestrings.org/ssl/privkey.pem;
+
+ location / {
+ root /srv/www/htdocs/;
+ index index.html index.htm;
+ }
+
+ error_page 500 502 503 504 /50x.html;
+ location = /50x.html {
+ root /srv/www/htdocs/;
+ }
+
+ }
+
+ include conf.d/ssl_params;
+ include vhosts.d/*.conf;
+}