stevenringo · March 1, 2016 21:10 · Jul 22, 2015 · Jul 22, 2015 · Jul 22, 2015 · Jul 22, 2015
diff --git a/nginx.conf b/nginx.conf
@@ -12,7 +12,7 @@ ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 
 # SSL/TLS session caching/resumption
 ssl_session_cache shared:SSL:20m;
-ssl_session_timeout 5m;
+ssl_session_timeout 1d;
 
 # Cipher list checks out well on the Qualys test
 ssl_prefer_server_ciphers on;

diff --git a/nginx.conf b/nginx.conf
@@ -8,7 +8,7 @@ ssl_certificate_key /var/app/deploy/www.thisisatest.com.key;
 ssl_certificate /var/app/deploy/www.thisisatest.com.chained.crt;
 
 # Ideally we'd have only TLSv1.2, but that compromises client support significantly
-ssl_protocols TLSv1.1 TLSv1.2;
+ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 
 # SSL/TLS session caching/resumption
 ssl_session_cache shared:SSL:20m;

diff --git a/nginx.conf b/nginx.conf
@@ -8,7 +8,7 @@ ssl_certificate_key /var/app/deploy/www.thisisatest.com.key;
 ssl_certificate /var/app/deploy/www.thisisatest.com.chained.crt;
 
 # Ideally we'd have only TLSv1.2, but that compromises client support significantly
-ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+ssl_protocols TLSv1.1 TLSv1.2;
 
 # SSL/TLS session caching/resumption
 ssl_session_cache shared:SSL:20m;
@@ -26,6 +26,7 @@ ssl_stapling on;
 ssl_stapling_verify on;
 # This contains the root and intermediate certificates from the CA.
 ssl_trusted_certificate /var/app/deploy/ca-certs.pem;
+resolver 8.8.4.4 8.8.8.8;
 
 # HTTP bare domain redirect.
 server {

diff --git a/nginx.conf b/nginx.conf
@@ -44,6 +44,7 @@ server {
   server_name thisisatest.com;
   listen 443 ssl;
   return 301 $scheme://www.$server_name$request_uri;
+  add_header Strict-Transport-Security 'max-age=31536000; includeSubdomains';
 }
 
 server {
@@ -64,6 +65,9 @@ server {
   # SSL/TLS Public Key Pinning (HPKP)
   add_header Public-Key-Pins 'pin-sha256="lduqX5oR7l7lHvsyLuIVac5iqZmXOLnxWA3osdAhz64="; max-age=5184000; includeSubdomains';
 
+  add_header X-Frame-Options DENY;
+  add_header X-Content-Type-Options nosniff;
+
   # Rails page caching setup (and other statics).
   location / {
     try_files /cache$uri.html $uri.html $uri @app;

diff --git a/nginx.conf b/nginx.conf
@@ -16,7 +16,7 @@ ssl_session_timeout 5m;
 
 # Cipher list checks out well on the Qualys test
 ssl_prefer_server_ciphers on;
-ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:kEDH+AESGCM:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:AES:!AES128:CAMELLIA:!CAMELLIA128:!aNULL:!PSK:!aECDH';
+ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
 
 # This should be a 4096 bit DH key generated with: 'openssl dhparams -out dhparams.pem 4096'
 ssl_dhparam /var/app/deploy/dhparams.pem;

diff --git a/nginx.conf b/nginx.conf
@@ -24,7 +24,7 @@ ssl_dhparam /var/app/deploy/dhparams.pem;
 # SSL/TLS OCSP stapling
 ssl_stapling on;
 ssl_stapling_verify on;
-# This is the root and intermediate certificates from the CA.
+# This contains the root and intermediate certificates from the CA.
 ssl_trusted_certificate /var/app/deploy/ca-certs.pem;
 
 # HTTP bare domain redirect.

diff --git a/nginx.conf b/nginx.conf
@@ -7,7 +7,7 @@ upstream app_server {
 ssl_certificate_key /var/app/deploy/www.thisisatest.com.key;
 ssl_certificate /var/app/deploy/www.thisisatest.com.chained.crt;
 
-# Ideally we'd have TLSv1.2 and above, but that compromises client support significantly
+# Ideally we'd have only TLSv1.2, but that compromises client support significantly
 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 
 # SSL/TLS session caching/resumption

diff --git a/nginx.conf b/nginx.conf
@@ -7,7 +7,7 @@ upstream app_server {
 ssl_certificate_key /var/app/deploy/www.thisisatest.com.key;
 ssl_certificate /var/app/deploy/www.thisisatest.com.chained.crt;
 
-# Ideally we'd have TLSv1.2 and above, but that compromises client support
+# Ideally we'd have TLSv1.2 and above, but that compromises client support significantly
 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 
 # SSL/TLS session caching/resumption
@@ -24,6 +24,7 @@ ssl_dhparam /var/app/deploy/dhparams.pem;
 # SSL/TLS OCSP stapling
 ssl_stapling on;
 ssl_stapling_verify on;
+# This is the root and intermediate certificates from the CA.
 ssl_trusted_certificate /var/app/deploy/ca-certs.pem;
 
 # HTTP bare domain redirect.

diff --git a/nginx.conf b/nginx.conf
@@ -30,19 +30,19 @@ ssl_trusted_certificate /var/app/deploy/ca-certs.pem;
 server {
   server_name thisisatest.com;
   listen 80;
-  return 301 https://www.thisisatest.com$request_uri;
+  return 301 https://www.$server_name$request_uri;
 }
 # HTTP www redirect.
 server {
   server_name www.thisisatest.com;
   listen 80;
-  return 301 https://www.thisisatest.com$request_uri;
+  return 301 https://$server_name$request_uri;
 }
 # HTTPS bare domain redirect.
 server {
   server_name thisisatest.com;
   listen 443 ssl;
-  return 301 $scheme://www.thisisatest.com$request_uri;
+  return 301 $scheme://www.$server_name$request_uri;
 }
 
 server {

diff --git a/nginx.conf b/nginx.conf
@@ -0,0 +1,79 @@
+# Thin serving Rails.
+upstream app_server {
+  server 127.0.0.1:3050 fail_timeout=0;
+}
+
+# SSL/TLS certificates - the key should be 4096 bit generated with: 'openssl genrsa -des3 -out server.key 4096'
+ssl_certificate_key /var/app/deploy/www.thisisatest.com.key;
+ssl_certificate /var/app/deploy/www.thisisatest.com.chained.crt;
+
+# Ideally we'd have TLSv1.2 and above, but that compromises client support
+ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+
+# SSL/TLS session caching/resumption
+ssl_session_cache shared:SSL:20m;
+ssl_session_timeout 5m;
+
+# Cipher list checks out well on the Qualys test
+ssl_prefer_server_ciphers on;
+ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:kEDH+AESGCM:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:AES:!AES128:CAMELLIA:!CAMELLIA128:!aNULL:!PSK:!aECDH';
+
+# This should be a 4096 bit DH key generated with: 'openssl dhparams -out dhparams.pem 4096'
+ssl_dhparam /var/app/deploy/dhparams.pem;
+
+# SSL/TLS OCSP stapling
+ssl_stapling on;
+ssl_stapling_verify on;
+ssl_trusted_certificate /var/app/deploy/ca-certs.pem;
+
+# HTTP bare domain redirect.
+server {
+  server_name thisisatest.com;
+  listen 80;
+  return 301 https://www.thisisatest.com$request_uri;
+}
+# HTTP www redirect.
+server {
+  server_name www.thisisatest.com;
+  listen 80;
+  return 301 https://www.thisisatest.com$request_uri;
+}
+# HTTPS bare domain redirect.
+server {
+  server_name thisisatest.com;
+  listen 443 ssl;
+  return 301 $scheme://www.thisisatest.com$request_uri;
+}
+
+server {
+  server_name www.thisisatest.com;
+
+  listen 443 ssl default_server deferred;
+
+  client_max_body_size 4G;
+  keepalive_timeout 40;
+
+  root /var/app/public;
+
+  error_page 500 502 503 504 /500.html;
+
+  # SSL/TLS Strict Transport Security (HSTS)
+  add_header Strict-Transport-Security 'max-age=31536000; includeSubdomains';
+
+  # SSL/TLS Public Key Pinning (HPKP)
+  add_header Public-Key-Pins 'pin-sha256="lduqX5oR7l7lHvsyLuIVac5iqZmXOLnxWA3osdAhz64="; max-age=5184000; includeSubdomains';
+
+  # Rails page caching setup (and other statics).
+  location / {
+    try_files /cache$uri.html $uri.html $uri @app;
+  }
+
+  # Serve from Rails.
+  location @app {
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header Host $http_host;
+    proxy_redirect off;
+
+    proxy_pass http://app_server;
+  }
+}