Merge branch 'improve-server-config-examples' into 'develop'
Improve server config examples See merge request pleroma/pleroma!307
This commit is contained in:
kaniini
commit
b0ec4f33e6
|
|
@ -22,6 +22,7 @@ social.domain.tld {
|
|||
Referrer-Policy "same-origin"
|
||||
Strict-Transport-Security "max-age=31536000; includeSubDomains;"
|
||||
Expect-CT "enforce, max-age=2592000"
|
||||
Content-Security-Policy "default-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; img-src 'self' data: https:; media-src 'self' https:; style-src 'self' 'unsafe-inline'; font-src 'self'; script-src 'self'; connect-src 'self' wss://social.domain.tld; upgrade-insecure-requests;"
|
||||
}
|
||||
|
||||
# If you do not want remote frontends to be able to access your Pleroma backend server, remove these lines.
|
||||
|
|
|
|||
|
|
@ -1,26 +1,56 @@
|
|||
#Example configuration for when Apache httpd and Pleroma are on the same host.
|
||||
#Needed modules: headers proxy proxy_http proxy_wstunnel rewrite ssl
|
||||
#This assumes a Debian style Apache config. Put this in /etc/apache2/sites-available
|
||||
#Install your TLS certificate, possibly using Let's Encrypt.
|
||||
#Replace 'pleroma.example.com' with your instance's domain wherever it appears
|
||||
|
||||
ServerName pleroma.example.com
|
||||
ServerTokens Prod
|
||||
|
||||
ErrorLog ${APACHE_LOG_DIR}/error.log
|
||||
CustomLog ${APACHE_LOG_DIR}/access.log combined
|
||||
|
||||
<VirtualHost *:80>
|
||||
#Example configuration for when Apache httpd and Pleroma are on the same host.
|
||||
#Needed modules: proxy proxy_http proxy_wstunnel rewrite
|
||||
#This assumes a Debian style Apache config. Put this in /etc/apache2/sites-available
|
||||
#Doesn't include SSL, just run certbot and let it take care of that.
|
||||
|
||||
|
||||
#Change this:
|
||||
ServerName pleroma.example.com
|
||||
|
||||
Redirect permanent / https://pleroma.example.com
|
||||
</VirtualHost>
|
||||
|
||||
<VirtualHost *:443>
|
||||
SSLEngine on
|
||||
SSLCertificateFile /etc/letsencrypt/live/pleroma.example.com/cert.pem
|
||||
SSLCertificateKeyFile /etc/letsencrypt/live/pleroma.example.com/privkey.pem
|
||||
SSLCertificateChainFile /etc/letsencrypt/live/pleroma.example.com/fullchain.pem
|
||||
|
||||
# Mozilla modern configuration, tweak to your needs
|
||||
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
|
||||
SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
|
||||
SSLHonorCipherOrder on
|
||||
SSLCompression off
|
||||
SSLSessionTickets off
|
||||
|
||||
Header always set X-Xss-Protection "1; mode=block"
|
||||
Header always set X-Frame-Options "DENY"
|
||||
Header always set X-Content-Type-Options "nosniff"
|
||||
Header always set Referrer-Policy same-origin
|
||||
Header always set Content-Security-Policy "default-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; img-src 'self' data: https:; media-src 'self' https:; style-src 'self' 'unsafe-inline'; font-src 'self'; script-src 'self'; connect-src 'self' wss://pleroma.example.tld; upgrade-insecure-requests;"
|
||||
|
||||
# Uncomment this only after you get HTTPS working.
|
||||
# Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
|
||||
|
||||
RewriteEngine On
|
||||
RewriteCond %{HTTP:Connection} Upgrade [NC]
|
||||
RewriteCond %{HTTP:Upgrade} websocket [NC]
|
||||
RewriteRule /(.*) ws://localhost:4000/$1 [P,L]
|
||||
|
||||
|
||||
ProxyRequests off
|
||||
ProxyPass / http://localhost:4000/
|
||||
ProxyPassReverse / http://localhost:4000/
|
||||
|
||||
#Change this too:
|
||||
|
||||
RequestHeader set Host "pleroma.example.com"
|
||||
ProxyPreserveHost On
|
||||
|
||||
ErrorLog ${APACHE_LOG_DIR}/error.log
|
||||
CustomLog ${APACHE_LOG_DIR}/access.log combined
|
||||
</VirtualHost>
|
||||
|
||||
# OCSP Stapling, only in httpd 2.3.3 and later
|
||||
SSLUseStapling on
|
||||
SSLStaplingResponderTimeout 5
|
||||
SSLStaplingReturnResponderErrors off
|
||||
SSLStaplingCache shmcb:/var/run/ocsp(128000)
|
||||
|
|
@ -71,16 +71,16 @@ server {
|
|||
}
|
||||
# stop removing lines here.
|
||||
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
add_header X-Permitted-Cross-Domain-Policies none;
|
||||
add_header X-Frame-Options DENY;
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header Referrer-Policy same-origin;
|
||||
add_header X-Download-Options noopen;
|
||||
add_header Content-Security-Policy "default-src 'none'; base-uri 'self'; form-action 'self'; img-src 'self' data: https:; media-src 'self' https:; style-src 'self' 'unsafe-inline'; font-src 'self'; script-src 'self'; connect-src 'self' wss://example.tld; upgrade-insecure-requests;";
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
add_header X-Permitted-Cross-Domain-Policies "none" always;
|
||||
add_header X-Frame-Options "DENY" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header Referrer-Policy "same-origin" always;
|
||||
add_header X-Download-Options "noopen" always;
|
||||
add_header Content-Security-Policy "default-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; img-src 'self' data: https:; media-src 'self' https:; style-src 'self' 'unsafe-inline'; font-src 'self'; script-src 'self'; connect-src 'self' wss://example.tld; upgrade-insecure-requests;" always;
|
||||
|
||||
# Uncomment this only after you get HTTPS working.
|
||||
# add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
|
||||
# add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
|
|
|
|||
|
|
@ -119,3 +119,13 @@ sub vcl_pipe {
|
|||
set bereq.http.connection = req.http.connection;
|
||||
}
|
||||
}
|
||||
|
||||
sub vcl_deliver {
|
||||
set resp.http.X-Frame-Options = "DENY";
|
||||
set resp.http.X-XSS-Protection = "1; mode=block";
|
||||
set resp.http.X-Content-Type-Options = "nosniff";
|
||||
set resp.http.Referrer-Policy = "same-origin";
|
||||
set resp.http.Content-Security-Policy = "default-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; img-src 'self' data: https:; media-src 'self' https:; style-src 'self' 'unsafe-inline'; font-src 'self'; script-src 'self'; connect-src 'self' wss://" + req.http.host + "; upgrade-insecure-requests;";
|
||||
# Uncomment this only after you get HTTPS working.
|
||||
# set resp.http.Strict-Transport-Security= "max-age=31536000; includeSubDomains";
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in New Issue