61 lines
2.1 KiB
YAML
61 lines
2.1 KiB
YAML
run:
|
|
- exec:
|
|
cmd:
|
|
- "mkdir -p /shared/ssl/"
|
|
- replace:
|
|
filename: "/etc/nginx/conf.d/discourse.conf"
|
|
from: /listen 80;\s+listen \[::\]:80;/m
|
|
to: |
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
SSL_TEMPLATE_SSL_BLOCK
|
|
- replace:
|
|
filename: "/etc/nginx/conf.d/discourse.conf"
|
|
from: /listen 80;/m
|
|
to: |
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
# ITS: Stuff for yxorp TLS-SNI support
|
|
listen 444 ssl proxy_protocol;
|
|
listen [::]:444 ssl proxy_protocol;
|
|
set_real_ip_from 2a01:4f8:10b:331f:0:ff:fe00:5;
|
|
real_ip_header proxy_protocol;
|
|
SSL_TEMPLATE_SSL_BLOCK
|
|
- replace:
|
|
filename: "/etc/nginx/conf.d/discourse.conf"
|
|
from: /server.+{/
|
|
to: |
|
|
server {
|
|
listen 80;
|
|
return 301 https://$$ENV_DISCOURSE_HOSTNAME$request_uri;
|
|
}
|
|
server {
|
|
- replace:
|
|
hook: ssl
|
|
filename: "/etc/nginx/conf.d/discourse.conf"
|
|
from: /SSL_TEMPLATE_SSL_BLOCK/
|
|
to: |
|
|
http2 on;
|
|
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
|
ssl_prefer_server_ciphers off;
|
|
|
|
ssl_certificate /shared/ssl/ssl.crt;
|
|
ssl_certificate_key /shared/ssl/ssl.key;
|
|
|
|
ssl_session_tickets off;
|
|
ssl_session_timeout 1d;
|
|
ssl_session_cache shared:SSL:1m;
|
|
|
|
add_header Strict-Transport-Security 'max-age=31536000'; # remember the certificate for a year and automatically connect to HTTPS for this domain
|
|
|
|
if ($http_host != $$ENV_DISCOURSE_HOSTNAME) {
|
|
rewrite (.*) https://$$ENV_DISCOURSE_HOSTNAME$1 permanent;
|
|
}
|
|
- replace:
|
|
filename: "/etc/nginx/conf.d/discourse.conf"
|
|
from: "location @discourse {"
|
|
to: |
|
|
location @discourse {
|
|
add_header Strict-Transport-Security 'max-age=31536000'; # remember the certificate for a year and automatically connect to HTTPS for this domain
|