Add nginx snippet with security headers

Signed-off-by: Johannes Löthberg <johannes@kyriasis.com>

1 files changed, 18 insertions, 0 deletions

diff --git a/nginx/base.sls b/nginx/base.sls
index 587ac71..1bb15bc 100644
--- a/nginx/base.sls
+++ b/nginx/base.sls
@@ -28,6 +28,24 @@ nginx:
           - /etc/nginx/conf.d/*.conf
           - /etc/nginx/sites-enabled/*
 
+  snippets:
+    security_headers:
+      # https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
+      - add_header: 'Strict-Transport-Security "max-age=31536000"'
+
+      # Tell browsers not to render the page inside a frame, and avoid clickjacking.
+      - add_header: X-Frame-Options SAMEORIGIN
+
+      # Tell browsers to not try to auto-detect the Content-Type.
+      - add_header: X-Content-Type-Options nosniff
+
+      # Enable the Cross-site scripting filter in most recent browsers.
+      # Normally enabled by default, but enable it anyway if user has disabled it.
+      - add_header: 'X-XSS-Protection "1; mode=block"'
+
+      - add_header: Referrer-Policy: same-origin
+      - add_header: "Feature-Policy: geolocation 'none'; midi 'none'; notifications 'none'; push 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; vibrate 'none'; fullscreen 'none'; payment"
+
   servers:
     managed_opts:
       require_in: