78 lines
2.9 KiB
Django/Jinja
78 lines
2.9 KiB
Django/Jinja
#jinja2: lstrip_blocks: True
|
|
# {{ ansible_managed }}
|
|
|
|
# generated 2024-03-26, Mozilla Guideline v5.7, nginx 1.22.1, OpenSSL 3.0.11, modern configuration
|
|
# https://ssl-config.mozilla.org/#server=nginx&version=1.22.1&config=modern&openssl=3.0.11&guideline=5.7
|
|
|
|
server {
|
|
listen 443 ssl http2;
|
|
listen [::]:443 ssl http2;
|
|
server_name {{ item.value.domains | join(' ') }};
|
|
|
|
ssl_certificate {{ tls_cert_path }}/{{ item.value.certificate }}.fullchain;
|
|
ssl_certificate_key {{ tls_cert_path }}/{{ item.value.certificate }}.key;
|
|
# verify chain of trust of OCSP response using Root CA and Intermediate certs
|
|
ssl_trusted_certificate {{ tls_cert_path }}/{{ item.value.certificate }}.ca;
|
|
|
|
ssl_session_timeout 1d;
|
|
ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
|
|
ssl_session_tickets off;
|
|
|
|
# modern configuration
|
|
ssl_protocols TLSv1.3;
|
|
ssl_prefer_server_ciphers off;
|
|
|
|
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
|
|
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
|
|
|
|
# OCSP stapling
|
|
ssl_stapling on;
|
|
ssl_stapling_verify on;
|
|
|
|
# replace with the IP address of your resolver
|
|
resolver 127.0.0.1;
|
|
|
|
# Logs
|
|
access_log /var/log/nginx/{{ item.key }}_access.log;
|
|
error_log /var/log/nginx/{{ item.key }}_error.log warn;
|
|
|
|
{% if item.value.sec_headers is not defined or item.value.sec_headers %}
|
|
# Additional security headers
|
|
# https://developer.mozilla.org/en-US/docs/Web/HTTP
|
|
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html
|
|
add_header X-Frame-Options "SAMEORIGIN";
|
|
add_header X-Content-Type-Options "nosniff";
|
|
add_header Referrer-Policy "no-referrer";
|
|
add_header X-XSS-Protection "0";
|
|
{% endif %}
|
|
{% if item.value.no_index is not defined or item.value.no_index %}
|
|
# If you don't want to get indexed
|
|
add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive, noimageindex";
|
|
{% endif %}
|
|
{% if item.value.enable_csp is defined and item.value.enable_csp %}
|
|
add_header Content-Security-Policy "default-src 'self' {{ item.value.certificate }} *.{{ item.value.certificate }};";
|
|
{% endif %}
|
|
|
|
{% for item in item.value.locations %}
|
|
{% if item.comments is defined %}
|
|
{% for comment in item.comments %}
|
|
{{ comment }}
|
|
{% endfor %}
|
|
{% endif %}
|
|
location {% if item.location_name is defined %}{{ item.location_name }}{% else %}/{% endif %} {
|
|
{% if item.protocol is defined %}
|
|
proxy_pass {{ item.protocol }}://{{ item.ip }}:{{ item.port }}{% if item.path is defined %}/{{ item.path }}{% endif %};
|
|
include proxy_params;
|
|
{% endif %}
|
|
{% if item.websocket is defined and item.websocket %}
|
|
include ws_params;
|
|
{% endif %}
|
|
{% if item.extra_settings is defined %}
|
|
{% for extra_setting in item.extra_settings %}
|
|
{{ extra_setting }}
|
|
{% endfor %}
|
|
{% endif %}
|
|
}
|
|
|
|
{% endfor %}
|
|
}
|