Skip to content

Instantly share code, notes, and snippets.

@sanogotech

sanogotech/nginx conf

Forked from ErrorProne/nginx conf
Created October 12, 2020 07:14
Show Gist options
  • Save sanogotech/abaca5d4037034926a9b8c14aa8d76a8 to your computer and use it in GitHub Desktop.
Save sanogotech/abaca5d4037034926a9b8c14aa8d76a8 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @ErrorProne ErrorProne created this gist Aug 30, 2016.
    34 changes: 34 additions & 0 deletions nginx conf
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,34 @@
    ## SSL Settings

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
    ssl_ecdh_curve secp384r1;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;
    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
    ssl_dhparam /etc/ssl/certs/dhparam.pem;

    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;

    # Block pages from loading when they detect reflected XSS attacks
    add_header X-XSS-Protection "1; mode=block";

    ## Proxy settings

    proxy_redirect off;
    proxy_http_version 1.1;

    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # Force cookie rewrite with HttpOnly and secure flag
    proxy_cookie_path / "/; secure; HttpOnly";