summaryrefslogtreecommitdiffstats
path: root/nginx
diff options
context:
space:
mode:
Diffstat (limited to 'nginx')
-rw-r--r--nginx/base.sls18
1 files changed, 18 insertions, 0 deletions
diff --git a/nginx/base.sls b/nginx/base.sls
index 587ac71..1bb15bc 100644
--- a/nginx/base.sls
+++ b/nginx/base.sls
@@ -28,6 +28,24 @@ nginx:
- /etc/nginx/conf.d/*.conf
- /etc/nginx/sites-enabled/*
+ snippets:
+ security_headers:
+ # https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
+ - add_header: 'Strict-Transport-Security "max-age=31536000"'
+
+ # Tell browsers not to render the page inside a frame, and avoid clickjacking.
+ - add_header: X-Frame-Options SAMEORIGIN
+
+ # Tell browsers to not try to auto-detect the Content-Type.
+ - add_header: X-Content-Type-Options nosniff
+
+ # Enable the Cross-site scripting filter in most recent browsers.
+ # Normally enabled by default, but enable it anyway if user has disabled it.
+ - add_header: 'X-XSS-Protection "1; mode=block"'
+
+ - add_header: Referrer-Policy: same-origin
+ - add_header: "Feature-Policy: geolocation 'none'; midi 'none'; notifications 'none'; push 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; vibrate 'none'; fullscreen 'none'; payment"
+
servers:
managed_opts:
require_in: