Skip to content

Instantly share code, notes, and snippets.

@mholt

mholt/Caddyfile

Forked from phred/Caddyfile
Created March 28, 2016 18:45
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save mholt/f06e456b85fa282f3373 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save mholt/f06e456b85fa282f3373 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @phred phred created this gist Mar 28, 2016.
    10 changes: 10 additions & 0 deletions Caddyfile
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,10 @@
    fff.red {
    header / {
    Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Content-Security-Policy "default-src https:*"
    Public-Key-Pins "pin-sha256=\"ckOIjdimiwD3mfMmkmCh7uiJCBtXvoqoBoKKB1K5UIM=\"; pin-sha256=\"QiTyymM4e635OgWkx9d7nq5xvEuqmgV7HiDjIIGyymo=\"; max-age=2592000"
    X-Frame-Options SAMEORIGIN
    X-XSS-Protection "1; mode=block"
    X-Content-Type-Options nosniff
    }
    }
    6 changes: 6 additions & 0 deletions notes.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,6 @@

    Securityheaders.io will guide you through smart values for these. My CSP should be tighter for sure.

    Public Key Pinning was the only tricky bit, see this article for details: <https://scotthelme.co.uk/hpkp-http-public-key-pinning/>

    Caddy certs & keys are stored in e.g. `~/.caddy/letsencrypt/sites/fff.red/`.