Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- server {
- ssl_certificate /etc/nginx/ssl/domain.pem;
- ssl_certificate_key /etc/nginx/ssl/domain.key;
- ssl_dhparam /etc/nginx/ssl/dhparam.pem;
- ssl_session_cache shared:SSL:10m;
- ssl_session_timeout 5m;
- keepalive_timeout 70;
- ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
- ssl_prefer_server_ciphers on;
- ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DES";
- resolver 8.8.8.8 [2001:4860:4860::8888];
- ssl_stapling on;
- ssl_trusted_certificate /etc/nginx/ssl/ca.pem;
- listen 443 deferred spdy ssl;
- listen [::]:443 deferred spdy ssl ipv6only=on;
- server_name domain.net;
- root /www/public;
- index index.html;
- add_header Strict-Transport-Security max-age=31536000 always;
- add_header X-Frame-Options DENY;
- add_header Public-Key-Pins 'pin-sha256="base64+info1="; max-age=31536000' always;
- add_header X-Content-Type-Options nosniff;
- add_header X-XSS-Protection "1; mode=block";
- location ~ /{favicon.ico|favicon.png|robots.txt}$ {
- access_log off;
- log_not_found off;
- expires 1y;
- add_header Cache-Control public,max-age=259200;
- }
- location ~* \.(jpg|jpeg|png|gif|ico|css|js|mp3)$ {
- expires 30d;
- add_header Cache-Control public,max-age=259200;
- }
- }
- server {
- listen 80 deferred;
- listen [::]:80 ipv6only=on;
- server_name domain.net;
- if ($scheme = http) {
- return 301 https://$server_name$request_uri;
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement