summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJohannes Löthberg <johannes@kyriasis.com>2019-05-30 17:23:21 +0200
committerJohannes Löthberg <johannes@kyriasis.com>2019-05-30 17:23:21 +0200
commit7b59e81328ec5b88cee2c385fee6c0e5b1617fdc (patch)
treef489dbbf62ee0a15c25d1676dfbe28e8d809abba
parent75a5880d96818cae3bed945267e62c1d3927f2c1 (diff)
downloadpillar-7b59e81328ec5b88cee2c385fee6c0e5b1617fdc.tar.xz
Add nginx snippet with security headers
Signed-off-by: Johannes Löthberg <johannes@kyriasis.com>
-rw-r--r--nginx/base.sls18
1 files changed, 18 insertions, 0 deletions
diff --git a/nginx/base.sls b/nginx/base.sls
index 587ac71..1bb15bc 100644
--- a/nginx/base.sls
+++ b/nginx/base.sls
@@ -28,6 +28,24 @@ nginx:
- /etc/nginx/conf.d/*.conf
- /etc/nginx/sites-enabled/*
+ snippets:
+ security_headers:
+ # https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
+ - add_header: 'Strict-Transport-Security "max-age=31536000"'
+
+ # Tell browsers not to render the page inside a frame, and avoid clickjacking.
+ - add_header: X-Frame-Options SAMEORIGIN
+
+ # Tell browsers to not try to auto-detect the Content-Type.
+ - add_header: X-Content-Type-Options nosniff
+
+ # Enable the Cross-site scripting filter in most recent browsers.
+ # Normally enabled by default, but enable it anyway if user has disabled it.
+ - add_header: 'X-XSS-Protection "1; mode=block"'
+
+ - add_header: Referrer-Policy: same-origin
+ - add_header: "Feature-Policy: geolocation 'none'; midi 'none'; notifications 'none'; push 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; vibrate 'none'; fullscreen 'none'; payment"
+
servers:
managed_opts:
require_in: