|
| 1 | +server { |
| 2 | + listen 80; |
| 3 | + listen [::]:80; |
| 4 | + |
| 5 | + server_name example.com; |
| 6 | + return 301 https://$server_name$request_uri; |
| 7 | +} |
| 8 | + |
| 9 | +server { |
| 10 | + listen 443 ssl http2; |
| 11 | + listen [::]:443 ssl http2; |
| 12 | + server_name example.com; |
| 13 | + server_tokens off; |
| 14 | + |
| 15 | + add_header X-Frame-Options "SAMEORIGIN"; |
| 16 | + add_header X-XSS-Protection "1; mode=block"; |
| 17 | + add_header X-Content-Type-Options "nosniff"; |
| 18 | + add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; |
| 19 | + add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; font-src 'self'; object-src 'none'"; |
| 20 | + add_header Referrer-Policy "origin-when-cross-origin"; |
| 21 | + add_header Expect-CT "enforce, max-age=604800"; |
| 22 | + |
| 23 | + charset utf-8; |
| 24 | + |
| 25 | + ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; |
| 26 | + ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; |
| 27 | + ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem; |
| 28 | + |
| 29 | + ssl_prefer_server_ciphers on; |
| 30 | + ssl_session_timeout 5m; |
| 31 | + ssl_protocols TLSv1.2 TLSv1.3; |
| 32 | + ssl_stapling on; |
| 33 | + ssl_stapling_verify on; |
| 34 | + ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"; |
| 35 | + ssl_ecdh_curve secp384r1; |
| 36 | + ssl_session_cache shared:SSL:20m; |
| 37 | + ssl_session_tickets off; |
| 38 | + ssl_dhparam /etc/ssl/dhparam.pem; |
| 39 | + |
| 40 | + location = /robots.txt { |
| 41 | + add_header Content-Type text/plain; |
| 42 | + return 200 "User-agent: *\nDisallow: /\n"; |
| 43 | + } |
| 44 | + |
| 45 | + location /rspamd { |
| 46 | + proxy_pass http://anonaddy:11334; |
| 47 | + |
| 48 | + proxy_set_header Host $host; |
| 49 | + proxy_set_header X-Real-IP $remote_addr; |
| 50 | + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; |
| 51 | + proxy_set_header X-Forwarded-Proto $scheme; |
| 52 | + } |
| 53 | + |
| 54 | + location / { |
| 55 | + proxy_pass http://anonaddy:8000; |
| 56 | + |
| 57 | + proxy_redirect off; |
| 58 | + proxy_set_header Host $host; |
| 59 | + proxy_set_header X-Real-IP $remote_addr; |
| 60 | + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; |
| 61 | + proxy_set_header X-Forwarded-Proto $scheme; |
| 62 | + proxy_read_timeout 90s; |
| 63 | + } |
| 64 | +} |
0 commit comments