From 45f5fa68396f82519066bbc4abe31ce6de3863be Mon Sep 17 00:00:00 2001 From: Andrea Dell'Amico Date: Mon, 3 Oct 2016 16:48:23 +0200 Subject: [PATCH] library/roles/nginx: Add a ssl snippet. --- nginx/defaults/main.yml | 1 + nginx/templates/letsencrypt-proxy.conf.j2 | 4 ++-- nginx/templates/nginx-proxy-params.conf.j2 | 9 +++++---- nginx/templates/nginx-ssl-server.conf.j2 | 14 ++++++++++++++ 4 files changed, 22 insertions(+), 6 deletions(-) create mode 100644 nginx/templates/nginx-ssl-server.conf.j2 diff --git a/nginx/defaults/main.yml b/nginx/defaults/main.yml index 3964abb3..44231dad 100644 --- a/nginx/defaults/main.yml +++ b/nginx/defaults/main.yml @@ -14,6 +14,7 @@ nginx_conf_snippets: - nginx-browser-cache.conf - letsencrypt-proxy.conf - nginx-proxy-params.conf + - nginx-server-ssl.conf nginx_workers: 4 nginx_worker_connections: 1024 diff --git a/nginx/templates/letsencrypt-proxy.conf.j2 b/nginx/templates/letsencrypt-proxy.conf.j2 index 8cd468a1..d385cf19 100644 --- a/nginx/templates/letsencrypt-proxy.conf.j2 +++ b/nginx/templates/letsencrypt-proxy.conf.j2 @@ -1,7 +1,7 @@ # Include this one inside a "server" directive listening on port 80, this way: -# include /etc/nginx/snippets/letsencrypt-proxy.conf +# include /etc/nginx/snippets/letsencrypt-proxy.conf; location ^~ /.well-known/acme-challenge { - proxy_pass http://127.0.0.1:{{ letsencrypt_acme_standalone_port}}/.well-known/acme-challenge; + proxy_pass http://127.0.0.1:{{ letsencrypt_acme_standalone_port | default('4402') }}/.well-known/acme-challenge; access_log /var/log/nginx/letsencrypt_acmetool_access.log; error_log /var/log/nginx/letsencrypt_acmetool_error.log; } diff --git a/nginx/templates/nginx-proxy-params.conf.j2 b/nginx/templates/nginx-proxy-params.conf.j2 index 860aa037..68ffc909 100644 --- a/nginx/templates/nginx-proxy-params.conf.j2 +++ b/nginx/templates/nginx-proxy-params.conf.j2 @@ -1,16 +1,17 @@ # Proxy stuff +# include /etc/nginx/snippets/nginx-proxy-params.conf; +proxy_http_version 1.1; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; +proxy_set_header X-Forwarded-Host $remote_addr; +proxy_set_header X-Forwarded-Server $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; +proxy_buffering {{ nginx_proxy_buffering }}; proxy_buffer_size {{ nginx_proxy_buffer_size }}; proxy_buffers {{ nginx_proxy_buffers }}; proxy_busy_buffers_size {{ nginx_proxy_busy_buffers_size }}; -proxy_set_header X-Forwarded-Host $remote_addr; -proxy_set_header X-Forwarded-Server $host; -proxy_http_version 1.1; proxy_redirect {{ nginx_proxy_redirect }}; -proxy_buffering {{ nginx_proxy_buffering }}; proxy_connect_timeout {{ nginx_proxy_connect_timeout }}; proxy_read_timeout {{ nginx_proxy_read_timeout }}; proxy_send_timeout {{ nginx_proxy_send_timeout }}; diff --git a/nginx/templates/nginx-ssl-server.conf.j2 b/nginx/templates/nginx-ssl-server.conf.j2 new file mode 100644 index 00000000..90a70fa7 --- /dev/null +++ b/nginx/templates/nginx-ssl-server.conf.j2 @@ -0,0 +1,14 @@ +{% if letsencrypt_acme_install %} +ssl_certificate {{ letsencrypt_acme_certs_dir }}/fullchain; +ssl_certificate_key {{ letsencrypt_acme_certs_dir }}/privkey; +{% endif %} +ssl_session_cache shared:SSL:10m; +ssl_session_timeout 10m; +ssl_protocols TLSv1 TLSv1.1 TLSv1.2; +ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"; +ssl_prefer_server_ciphers on; +{% if ansible_distribution_version | version_compare('14.04', '>=') %} +ssl_stapling on; +ssl_stapling_verify on; +add_header Strict-Transport-Security max-age=15768000; +{% endif %}