starlinglab / integrity-deploy Goto Github PK

      - CONFIG=/app-config/signing.yaml
      - WEB_CONCURRENCY=1

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/nginx-selfsigned.key -out /etc/ssl/certs/nginx-selfsigned.crt

        server {

  listen 0.0.0.0:443 ssl http2;
  listen [::]:443 ssl http2;

  server_name authsign.starlinglab.org;



  ##########
  # Source for SSL configuration:
  # https://ssl-config.mozilla.org/#server=nginx&version=1.18.0&config=intermediate&openssl=1.1.1n&guideline=5.6
  # Copied from there and changed to have real file paths
  ##########

  ssl_certificate     /etc/ssl/certs/nginx-selfsigned.crt;
  ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
  ssl_session_timeout 1d;
  ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
  ssl_session_tickets off;

  ssl_dhparam /etc/ssl/dhparam.pem;

  # intermediate configuration
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
  ssl_prefer_server_ciphers off;

  # HSTS (ngx_http_headers_module is required) (63072000 seconds)
  add_header Strict-Transport-Security "max-age=63072000" always;

  # OCSP stapling
  ssl_stapling on;
  ssl_stapling_verify on;

  # verify chain of trust of OCSP response using Root CA and Intermediate certs
  ssl_trusted_certificate /etc/letsencrypt/live/star.browsertrix.prod.starlinglab.org/fullchain.pem;

  resolver 1.1.1.1;

  ##########
  # End of copied SSL configuration
  ##########


  add_header X-Content-Type-Options nosniff;
  add_header X-Frame-Options DENY;
  keepalive_timeout 60;

  location / {

  }
}