blob: cd0bf2f39155e05a94623ef9779441aedc6a5e35 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
|
nginx:
source:
opts: {}
service:
enable: True
opts: {}
server:
config:
events:
worker_connections: 1024
http:
sendfile: 'on'
aio: 'on'
directio: 4m
keepalive_timeout: 65
gzip: 'on'
gzip_proxied: 'any'
gzip_types: '*'
gzip_vary: 'on'
charset: utf-8
charset_types: text/xml text/plain application/javascript application/rss+xml
server_tokens: 'off'
etag: 'on'
ssi: 'on'
include:
- /etc/nginx/mime.types
- /etc/nginx/conf.d/*.conf
- /etc/nginx/sites-enabled/*
snippets:
security_headers:
# https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
- add_header: 'Strict-Transport-Security "max-age=31536000"'
# Tell browsers not to render the page inside a frame, and avoid clickjacking.
- add_header: X-Frame-Options SAMEORIGIN
# Tell browsers to not try to auto-detect the Content-Type.
- add_header: X-Content-Type-Options nosniff
# Enable the Cross-site scripting filter in most recent browsers.
# Normally enabled by default, but enable it anyway if user has disabled it.
- add_header: 'X-XSS-Protection "1; mode=block"'
- add_header: 'Referrer-Policy: same-origin'
- add_header: "Feature-Policy: geolocation 'none'; midi 'none'; notifications 'none'; push 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; vibrate 'none'; fullscreen 'none'; payment"
servers:
managed_opts:
require_in:
- file: nginx_server_available_dir
symlink_opts:
require_in:
- file: nginx_server_enabled_dir
dir_opts:
clean: 'on'
# vim: ft=yaml et:
|