7 Commits (e03e7ac290f1458e105acc1bcfd7c0a3b04826ff)

Author	SHA1	Message	Date
Peter Dave Hello	a2afcac7d9	Make sure nginx always send HSTS header (#16633) ... By default, it'll only send those headers when the response code is one of the following: - 200, 201, 204, 206, 301, 302, 303, 304, 307 & 308 As all the traffics should be https, the http protocol only exists to do 301 redirect, and always send the HSTS header is almost one of the best practices, we should set nginx to do so. Reference: - https://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header - https://ssl-config.mozilla.org/	2021-08-20 10:54:11 +01:00
Peter Dave Hello	e03dc3956f	Disable nginx ssl_session_tickets for better security (#16632) ... It's default turned on, but it's better to turn it off for security reason. Reference: - https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_tickets - https://github.com/mozilla/server-side-tls/issues/135	2021-08-20 08:15:07 +01:00
Cecylia Bocovich	38bc4b9562	Set X-Forwarded-Proto to request scheme (#15310) (#15498) ... This fixes a bug that prevents logins to mastodon onion services. The nginx directive assumed all requests were made over https, causing a domain mismatch for onion services that have https redirects disabled. The fix more correctly sets X-Forwarded-Proto to the actual scheme used in the request.	2021-01-05 22:25:07 +01:00
Shlee	514cd874a7	Update nginx.conf (#13066)	2020-03-08 16:04:25 +01:00
ichi_i	49f57b5534	Add TLS v1.3 support (#11603) ... Maintain TLS v1.2 compatibility (might want to drop this later) and add support for TLS v1.3	2019-08-30 07:42:50 +02:00
Eugen Rochko	b7379da6cc	Cache error 410 responses in recommended nginx configuration (#10425)	2019-03-30 03:14:31 +01:00
Eugen Rochko	6465972caf	Add nginx and systemd templates (#8770) ... So they can be copied during installation instead of looking them up in the documentation Make default sidekiq configuration use weighted queues Remove deprecated docs directory	2018-09-24 16:46:05 +02:00