Set HTTP security headers.

See https://securityheaders.io .

3 files changed, 6 insertions, 0 deletions

diff --git a/roles/common-web/files/etc/nginx/sites-available/default b/roles/common-web/files/etc/nginx/sites-available/default
index 6df1615..6cbea18 100644
--- a/roles/common-web/files/etc/nginx/sites-available/default
+++ b/roles/common-web/files/etc/nginx/sites-available/default
@@ -1,11 +1,12 @@
 server {
     listen      80 default_server;
     listen [::]:80 default_server;
 
     access_log /var/log/nginx/access.log;
     error_log /var/log/nginx/error.log info;
 
     # serve ACME challenges on all virtual hosts
     # /!\ need to be served individually for each explicit virtual host as well!
     include snippets/acme-challenge.conf;
+    include snippets/headers.conf;
 }
diff --git a/roles/common-web/files/etc/nginx/snippets/headers.conf b/roles/common-web/files/etc/nginx/snippets/headers.conf
new file mode 100644
index 0000000..60e5ace
--- /dev/null
+++ b/roles/common-web/files/etc/nginx/snippets/headers.conf
@@ -0,0 +1,4 @@
+# https://securityheaders.io/
+add_header X-Frame-Options "SAMEORIGIN";
+add_header X-Content-Type-Options nosniff;
+add_header X-XSS-Protection "1; mode=block";
diff --git a/roles/common-web/tasks/main.yml b/roles/common-web/tasks/main.yml
index fb6bb2d..02b7134 100644
--- a/roles/common-web/tasks/main.yml
+++ b/roles/common-web/tasks/main.yml
@@ -2,40 +2,41 @@
   apt: pkg=nginx
 
 - name: Limit Nginx logging
   lineinfile: "dest=/etc/logrotate.d/nginx create=yes
                regexp='^\\s*rotate\\s'
                line='\trotate 1'"
   tags:
     - logrotate
 
 - name: Copy fastcgi parameters, acme-challenge and SSL configuration snippets
   copy: src=etc/nginx/snippets/{{ item }}
         dest=/etc/nginx/snippets/{{ item }}
         owner=root group=root
         mode=0644
   register: r1
   with_items:
     - fastcgi.conf
     - fastcgi-php.conf
     - fastcgi-php-ssl.conf
     - ssl.conf
+    - headers.conf
     - acme-challenge.conf
   notify:
     - Restart Nginx
 
 - name: Copy /etc/nginx/sites-available/default
   copy: src=etc/nginx/sites-available/default
         dest=/etc/nginx/sites-available/default
         owner=root group=root
         mode=0644
   register: r2
   notify:
     - Restart Nginx
 
 - name: Create /etc/nginx/sites-enabled/default
   file: src=../sites-available/default
         dest=/etc/nginx/sites-enabled/default
         owner=root group=root
         state=link force=yes
   register: r3
   notify: