diff options
Diffstat (limited to 'guix/etc/nginx/conf.d/talerssl')
| -rw-r--r-- | guix/etc/nginx/conf.d/talerssl | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/guix/etc/nginx/conf.d/talerssl b/guix/etc/nginx/conf.d/talerssl new file mode 100644 index 0000000..3c33de6 --- /dev/null +++ b/guix/etc/nginx/conf.d/talerssl @@ -0,0 +1,14 @@ +ssl_certificate /etc/letsencrypt/live/taler.net/fullchain.pem; +ssl_certificate_key /etc/letsencrypt/live/taler.net/privkey.pem; +ssl_prefer_server_ciphers on; +ssl_session_cache shared:SSL:10m; +ssl_dhparam /etc/ssl/certs/dhparam.pem; +ssl_protocols TLSv1.2 TLSv1.1 TLSv1; +ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH'; + +add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; +add_header X-XSS-Protection "1; mode=block"; +add_header X-Frame-Options "SAMEORIGIN"; +add_header X-Content-Type-Options "nosniff"; +add_header Content-Security-Policy "default-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss://buildbot.taler.net"; +add_header Referrer-Policy "same-origin"; |