diff options
| author | Guilhem Moulin <guilhem@fripost.org> | 2020-05-17 16:21:37 +0200 |
|---|---|---|
| committer | Guilhem Moulin <guilhem@fripost.org> | 2020-05-17 18:30:03 +0200 |
| commit | e75fdedc7267b4918dbf4ebe10e66f2ac90ab313 (patch) | |
| tree | 2940169d453844ed688d3e0d47ee9ec49a675908 /roles/webmail/files/etc/nginx/sites-available/roundcube | |
| parent | a4e1c724be8729854c38c452a7bc248a3ee16f39 (diff) | |
Webmail: Compress static resources.
We leave dynamic pages (those passed to PHP-FPM) alone for now:
compressing them would make us vulnerable to BREACH attacks. This will
be revisited once Roundcube 1.5 is released: 1.5 adds support for the
same-site cookie attribute which once set to 'Strict' makes it immune to
BREACH attacks:
https://github.com/roundcube/roundcubemail/pull/6772
https://www.sjoerdlangkemper.nl/2016/11/07/current-state-of-breach-attack/#same-site-cookies
Diffstat (limited to 'roles/webmail/files/etc/nginx/sites-available/roundcube')
| -rw-r--r-- | roles/webmail/files/etc/nginx/sites-available/roundcube | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/roles/webmail/files/etc/nginx/sites-available/roundcube b/roles/webmail/files/etc/nginx/sites-available/roundcube index 9763b31..2863fad 100644 --- a/roles/webmail/files/etc/nginx/sites-available/roundcube +++ b/roles/webmail/files/etc/nginx/sites-available/roundcube @@ -35,11 +35,15 @@ server { ssl_certificate_key ssl/mail.fripost.org.key; include snippets/mail.fripost.org.hpkp-hdr; + gzip on; + gzip_vary on; + gzip_min_length 256; + gzip_types application/font-woff application/font-woff2 application/javascript application/json application/xml image/svg+xml image/x-icon text/css text/plain text/vcard; + location = /favicon.ico { root /usr/share/roundcube/skins/default/images; log_not_found off; access_log off; - expires max; } location = /robots.txt { @@ -54,13 +58,17 @@ server { client_max_body_size 64m; location = / { index index.php; } location = /index.php { + # TODO enable gzip for Roundcube >=1.5: it's immune to BREACH attacks once + # $config['session_samesite'] is set to 'Strict', see + # https://github.com/roundcube/roundcubemail/pull/6772 + # https://www.sjoerdlangkemper.nl/2016/11/07/current-state-of-breach-attack/#same-site-cookies + gzip off; include snippets/fastcgi-php-ssl.conf; fastcgi_pass unix:/var/run/php/php7.3-fpm@roundcube.sock; } location ~ "^/(?:plugins|program/js|program/resources|skins)(?:/[[:alnum:]][[:alnum:]\-\._]*)+\.(?:css|eot|gif|html|ico|jpg|js|pdf|png|svg|tiff?|ttf|woff2?)$" { try_files $uri =404; - expires 30d; } location / { internal; } } |