83 lines
2.5 KiB
Plaintext
83 lines
2.5 KiB
Plaintext
#
|
|
# ssl on;
|
|
#
|
|
# files
|
|
#
|
|
ssl_certificate /etc/nginx/certs/example.com/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/example.com/privkey.pem;
|
|
ssl_trusted_certificate /etc/nginx/certs/example.com/chain.pem;
|
|
ssl_dhparam /etc/nginx/certs/example.com/dhparam.pem;
|
|
#
|
|
# ssl params
|
|
#
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_prefer_server_ciphers on;
|
|
ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256";
|
|
ssl_ecdh_curve prime256v1:secp384r1:secp521r1:X25519;
|
|
ssl_early_data on;
|
|
#
|
|
# ssl session cache
|
|
#
|
|
ssl_session_cache shared:SSL:10m;
|
|
ssl_session_timeout 10m;
|
|
ssl_session_tickets on;
|
|
#
|
|
# ocsp
|
|
#
|
|
ssl_stapling off;
|
|
ssl_stapling_verify off;
|
|
resolver 8.8.8.8 8.8.4.4 valid=300s;
|
|
resolver_timeout 10s;
|
|
#
|
|
# csp
|
|
#
|
|
# add_header Content-Security-Policy-Report-Only "";
|
|
# add_header X-Content-Security-Policy-Report-Only "";
|
|
# add_header X-WebKit-CSP-Report-Only "";
|
|
#
|
|
# headers
|
|
#
|
|
# add_header Public-Key-Pins 'pin-sha256=""; pin-sha256=""; pin-sha256=""; pin-sha256=""; pin-sha256=""; pin-sha256=""; max-age=31536000;';
|
|
# add_header Frame-Options SAMEORIGIN;
|
|
# add_header X-Frame-Options SAMEORIGIN;
|
|
# add_header X-Content-Type-Options nosniff;
|
|
# add_header X-XSS-Protection "1; mode=block";
|
|
add_header Strict-Transport-Security "max-age=15552000;"; # 180 days
|
|
#
|
|
# other
|
|
#
|
|
ssl_buffer_size 4k;
|
|
keepalive_timeout 70;
|
|
keepalive_requests 150;
|
|
#
|
|
# http2
|
|
# https://nginx.org/ru/docs/http/ngx_http_v2_module.html
|
|
#
|
|
http2 on;
|
|
http2_body_preread_size 64k;
|
|
http2_chunk_size 8k;
|
|
# http2_idle_timeout 3m; -> keepalive_timeout use, obsolete 1.19.7
|
|
# http2_max_concurrent_pushes 10; -> obsolete 1.25.1
|
|
http2_max_concurrent_streams 128;
|
|
# http2_max_field_size 4k; -> large_client_header_buffers use, obsolete 1.19.7
|
|
# http2_max_header_size 16k; -> large_client_header_buffers use, obsolete 1.19.7
|
|
# http2_max_requests 1000; -> keepalive_requests use, obsolete 1.19.7
|
|
# http2_push off; -> obsolete 1.25.1
|
|
# http2_push_preload off; -> obsolete 1.25.1
|
|
# http2_recv_buffer_size 256k; -> only on http available
|
|
# http2_recv_timeout 30s; -> client_header_timeout use, obsolete 1.19.7
|
|
#
|
|
# http3
|
|
# https://nginx.org/ru/docs/http/ngx_http_v3_module.html
|
|
#
|
|
# http3 on;
|
|
# http3_hq off;
|
|
# http3_max_concurrent_streams 128;
|
|
# http3_stream_buffer_size 64k;
|
|
# quic_active_connection_id_limit 2;
|
|
# quic_bpf off;
|
|
# quic_gso off;
|
|
# quic_host_key file;
|
|
# quic_retry off;
|
|
#
|