mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-09-19 11:39:08 +02:00
Kristian KlausenandSven-Hendrik Haase
998f44fd6b
https://github.com/mozilla/ssl-config-generator/pull/252 https://github.com/mozilla/ssl-config-generator/pull/284
32 lines
1.3 KiB
Plaintext
32 lines
1.3 KiB
Plaintext
# generated 2025-10-12, Mozilla Guideline v5.7, nginx 1.27.3, OpenSSL 3.4.0, intermediate config
|
|
# https://ssl-config.mozilla.org/#server=nginx&version=1.27.3&config=intermediate&openssl=3.4.0&guideline=5.7
|
|
ssl_ecdh_curve X25519:prime256v1:secp384r1;
|
|
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
|
|
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_prefer_server_ciphers off;
|
|
ssl_dhparam /etc/ssl/dhparams.pem;
|
|
|
|
ssl_session_timeout 1d;
|
|
ssl_session_cache shared:{{ item.server }}:10m;
|
|
{% if item.server == 'http' %}
|
|
|
|
# See headers.conf for the HSTS add_header line.
|
|
map $scheme $hsts_header {
|
|
https "max-age=31536000; includeSubdomains; preload";
|
|
}
|
|
{% if nginx_enable_http3 %}
|
|
|
|
# Chrome, Firefox and curl only use the header from secure origins.
|
|
# https://issues.chromium.org/issues/40471032
|
|
# https://bugzilla.mozilla.org/show_bug.cgi?id=1730935
|
|
# https://everything.curl.dev/libcurl-http/alt-svc.html
|
|
# See headers.conf for the Alt-Svc add_header line.
|
|
map $scheme $alt_svc_header {
|
|
# Keep a low max-age for HTTP/3 while testing.
|
|
# Bump to 2592000 when we are done testing.
|
|
https 'h3=":443"; ma=3600';
|
|
}
|
|
{% endif %}
|
|
{% endif %}
|