From f6d3dac3b7b125f825c4a67d8f5dfeb22cd5dcc2 Mon Sep 17 00:00:00 2001
From: Bryan Newbold <bnewbold@archive.org>
Date: Wed, 22 Jun 2022 12:30:03 -0700
Subject: nginx: updated SSL config

---
 roles/nginx/HOWTO_new_site.txt | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/roles/nginx/HOWTO_new_site.txt b/roles/nginx/HOWTO_new_site.txt
index 1834e93..777665b 100644
--- a/roles/nginx/HOWTO_new_site.txt
+++ b/roles/nginx/HOWTO_new_site.txt
@@ -21,6 +21,11 @@ For a reverse proxied website:
         listen [::]:80;
         server_name <example.com>;
 
+        location = /favicon.ico {
+            access_log off;
+            log_not_found off;
+        }
+
         location /theme_static/ {
             alias /some/static/files/dir/theme_static/;
         }
@@ -35,19 +40,32 @@ For a reverse proxied website:
 
 For SSL stuff, add this to the body:
 
-     listen 443 ssl spdy;
-     listen [::]:443 ssl spdy;
+     listen 443 ssl http2;
+     listen [::]:443 ssl http2;
 
      ssl_certificate /etc/letsencrypt/live/<cert-name>/fullchain.pem;
      ssl_certificate_key /etc/letsencrypt/live/<cert-name>/privkey.pem;
    
      add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'";
+     #add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'";
      add_header X-Frame-Options "SAMEORIGIN";       # 'always' if nginx > 1.7.5
      add_header X-Content-Type-Options "nosniff";   # 'always' if nginx > 1.7.5
      add_header X-Xss-Protection "1";
      # Enable STS with one year period (breaks http; optional)
      #add_header Strict-Transport-Security "max-age=31557600; includeSubDomains";
 
+
+    if ($scheme = http) {
+        return 301 https://$server_name$request_uri;
+    }
+
+    # Let's Encrypt SSL Certs
+    location /.well-known/acme-challenge/ {
+        root /var/www/letsencrypt;
+        autoindex off;
+    }
+
+
 If your site is going to have inline Javascript (pretty common), you might need
 to swith the Content-Security-Policy line to:
 
-- 
cgit v1.2.3