infra/ansible-role-nginx
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'master' of ssh://git-ssh.notandy.de:2222/ansible-roles/nginx

Browse source
This commit is contained in:
nd 2019-04-27 21:47:37 +02:00
commit 0e8c531d0b
No known key found for this signature in database
GPG key ID: 21B5CD4DEE3670E9
6 changed files with 19 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

5
templates/ssl_files.j2
View file

@ -1,7 +1,10 @@
{% if nginx.serverpki %}
# certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
ssl_certificate /etc/ssl/{{ inventory_hostname }}.crt;
ssl_certificate_key /etc/ssl/private/{{ inventory_hostname }}.key;
## verify chain of trust of OCSP response using Root CA and Intermediate certs
{% endif %}
# verify chain of trust of OCSP response using Root CA and Intermediate certs
ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
# Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits

7
templates/vhost.j2
View file

@ -18,7 +18,7 @@ server {
{% endif %}
{% for header in vhost.add_headers|default([]) %}
add_header {{ header }} {{ vhost.add_headers[header] }};
add_header {{ header }} "{{ vhost.add_headers[header] }}";
{% endfor %}
{% for c in vhost.custom|default([]) %}
@ -38,6 +38,11 @@ server {
proxy_set_header X-Forwarded-Ssl $https;
proxy_set_header X-Url-Scheme $scheme;
# Websockets
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
# hide downstream headers for security reasons
proxy_hide_header X-Powered-By;
proxy_hide_header Server;