Hi, If you go to http://example.com, you now need two redirects, maybe each redirect could be directed to the final destination? # Redirect http://example.com port 80 to https://www.example.com port 443 server { listen 80; access_log off; error_log off; server_name example.com; return 301 https://www. example.com /$request_uri; } On Saturday, July 15, 2023 3:21 PM, David Mehler <dave.mehler@gmail.com> wrote > > Hello, > > Can I get a sanity check on this config? I'm running Debian 12, Nginx > 1.24.0, and PHP 8.2. > > My goal is to have all non-www traffic redirected to the equivalent > www, then all that redirected to https, basically no https no www no > work. I'd also appreciate an assessment of my ssl ciphers, running > protocols 1.2 and 1.3 only and want to ensure I've got the best > security setup. > > Thanks. > Dave. > > # > # example.com virtual host configuration > # > # enforce HTTPS > # Redirect www.example.com port 80 to www.example.com port 443 > server { > listen 80; > server_name www.example.com; > access_log off; > error_log off; > return 301 https://$host$request_uri; > } > > # Redirect https://example.com port 80 to https://example.com port 443 > server { > listen 80; > access_log off; > error_log off; > server_name example.com; > return 301 https://$server_name$request_uri; > } > > ### redirect https example.com to https www.example.com > server { > listen 443 ssl http2; > server_name example.com; > ssl_certificate /etc/ssl/example.com/example.com.fullchain.crt; > ssl_certificate_key /etc/ssl/example.com/example.com.key; > return 301 https://www.example.com$request_uri; > } > > # The www.example.com https virtual host > server { > listen 443 ssl http2; > > server_name www.example.com; > > access_log /var/log/nginx/www.example.com_access.log; > error_log /var/log/nginx/www.example.com_error.log; > > # TLS/SSL CONFIG > # RSA certificates (dual config) > ssl_certificate /etc/ssl/example.com/example.com.fullchain.crt; > ssl_certificate_key /etc/ssl/example.com/example.com.key; > > # ECC/ECDSA certificates (dual config) > ssl_certificate /etc/ssl/example.com/example.com.fullchain.crt.ecc; > ssl_certificate_key /etc/ssl/example.com/example.com.key.ecc; > > # A little bit of optimization > #ssl_session_timeout 1d; > #ssl_session_cache shared:GoofyPizzaSSL:50m; > #ssl_session_tickets off; > #ssl_dhparam /etc/ssl/example.com/dhparams.pem; > > # TLS version 1.2 and 1.3 only > #ssl_protocols TLSv1.2 TLSv1.3; > #ssl_ciphers > 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-E > CDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AE > S128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA > 384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES > 128-SHA256'; > #ssl_ciphers > 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-E > CDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AE > S256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SH > A256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA- > AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE- > RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECD > HE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-A > ES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA- > DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA > 384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!D > SS'; > #ssl_ciphers EECDH+AESGCM:EDH+AESGCM; > #ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1; > #ssl_prefer_server_ciphers on; > > # HSTS (ngx_http_headers_module is required) > # > ***************************************************************** > ******** > # WARNING - Wrong headers can create problems. Read docs otherwise > # all 3rd party scripts/ads won't load and in some case > # browser won't work. Read docs @ https://developer.mozilla.org > # > ***************************************************************** > ******** > #add_header Strict-Transport-Security "max-age=63072000" always; > #add_header X-Content-Type-Options "nosniff" always; > #add_header X-Frame-Options "SAMEORIGIN" always; > #add_header X-Xss-Protection "1; mode=block" always; > #add_header Referrer-Policy strict-origin-when-cross-origin always; > #add_header Feature-policy "accelerometer 'none'; camera 'none'; > geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone > 'none'; payment 'none'; usb 'none'" always; > # > ***************************************************************** > ********************************** > # WARNING: The HTTP Content-Security-Policy response header allows > sysadmin/developers > # to control resources the user agent is allowed to load for a given page. > # Wrong config can create problems for third party scripts/ad > networks. Hence read the following url: > # > https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security- > Policy > # > ***************************************************************** > *********************************** > #add_header content-security-policy "default-src > https://www.example.com:443" always; > #ssl_stapling on; > #ssl_stapling_verify on; > # Replace with the IP address of your resolver > #resolver 1.1.1.1; > #ssl_buffer_size 8k; > > root /var/www/example.com; > > index index.php index.html index.nginx-debian.html; > > location / { > try_files $uri $uri/ /index.php?$query_string; > } > > # Directives to send expires headers and turn off 404 error logging. > #location ~* > ^.+\.(css|js|ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|rss|atom|jpg|jpeg|gif|pn > g|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ > { > #access_log off; log_not_found off; expires max; > #} > > # Pass PHP Scripts To FastCGI Server > location ~ \.php$ { > fastcgi_split_path_info ^(.+\.php)(/.+)$; > fastcgi_pass unix:/run/php/php8.2-fpm.sock; #depends on PHP versions > fastcgi_index index.php; > fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; > include fastcgi_params; > } > > # Password-protected directory with autoindex > #location /quickdir/ { > #auth_basic "Quickdir Access"; > #auth_basic_user_file /var/www/quickdir/htpasswd; > #root /var/www/quickdir/; > #autoindex on; > #} > }
Attachment:
openpgp-digital-signature.asc
Description: PGP signature