docker compose stuff.

config/nginx/rstat.net-SSL.conf

@@ -0,0 +1,65 @@
+server {
+  listen 443 ssl;
+  listen [::]:443 ssl;
+
+  server_name its.pkhamre.com;
+  server_tokens off;
+
+  http2 on;
+
+  ssl_certificate /etc/nginx/ssl/live/its.pkhamre.com/fullchain.pem;
+  ssl_certificate_key /etc/nginx/ssl/live/its.pkhamre.com/privkey.pem;
+
+  # HSTS (ngx_http_headers_module is required) (63072000 seconds)
+  add_header Strict-Transport-Security "max-age=63072000" always;
+
+  location / {
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header Host $http_host;
+
+    proxy_pass http://varnish:80;
+    proxy_redirect off;
+  }
+
+  location /files/ {
+    root /usr/share/nginx/its.pkhamre.com/;
+    autoindex on;
+    autoindex_exact_size off;
+    autoindex_format html;
+    autoindex_localtime on;
+  }
+
+  location /privacy/ {
+    root /usr/share/nginx/its.pkhamre.com/;
+  }
+
+  location /p/ {
+    root /usr/share/nginx/its.pkhamre.com/;
+  }
+}
+
+# intermediate configuration
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_ecdh_curve X25519:prime256v1:secp384r1;
+ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
+ssl_prefer_server_ciphers off;
+
+# see also ssl_session_ticket_key alternative to stateful session cache
+ssl_session_timeout 1d;
+ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
+
+# curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
+ssl_dhparam /etc/nginx/ssl/dhparam.pem;
+
+# OCSP stapling
+ssl_stapling on;
+ssl_stapling_verify on;
+
+# verify chain of trust of OCSP response using Root CA and Intermediate certs
+ssl_trusted_certificate /etc/nginx/ssl/live/its.pkhamre.com/chain.pem;
+
+# replace with the IP address of your resolver;
+# async 'resolver' is important for proper operation of OCSP stapling
+resolver 67.207.67.2;