10 files changed, 106 insertions, 69 deletions
diff --git a/roles/common-web/files/etc/nginx/fastcgi/php b/roles/common-web/files/etc/nginx/fastcgi/php
deleted file mode 100644
index 1ba3937..0000000
--- a/roles/common-web/files/etc/nginx/fastcgi/php
+++ /dev/null
@@ -1,10 +0,0 @@
-# cf. http://wiki.nginx.org/Pitfalls#Passing_Uncontrolled_Requests_to_PHP
-try_files $uri $uri/ =404;
-
-include 		fastcgi/params;
-# required if PHP was built with --enable-force-cgi-redirect
-fastcgi_param	REDIRECT_STATUS	200;
-
-fastcgi_intercept_errors 	on;
-fastcgi_read_timeout 		14400; 
-fastcgi_pass				unix:/var/run/php5-fpm.sock;
diff --git a/roles/common-web/files/etc/nginx/fastcgi/php-ssl b/roles/common-web/files/etc/nginx/fastcgi/php-ssl
deleted file mode 100644
index b2a419c..0000000
--- a/roles/common-web/files/etc/nginx/fastcgi/php-ssl
+++ /dev/null
@@ -1,8 +0,0 @@
-# PHP only.
-# Credits to http://claylo.com/post/7617674014/ssl-php-fpm-and-nginx
-
-fastcgi_param HTTPS					on;
-fastcgi_param SSL_PROTOCOL			$ssl_protocol;
-fastcgi_param SSL_CIPHER			$ssl_cipher;
-fastcgi_param SSL_SESSION_ID		$ssl_session_id;
-fastcgi_param SSL_CLIENT_VERIFY		$ssl_client_verify;
diff --git a/roles/common-web/files/etc/nginx/sites-available/default b/roles/common-web/files/etc/nginx/sites-available/default
new file mode 100644
index 0000000..cae8fc0
--- /dev/null
+++ b/roles/common-web/files/etc/nginx/sites-available/default
@@ -0,0 +1,12 @@
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+
+    access_log /var/log/nginx/access.log;
+    error_log /var/log/nginx/error.log info;
+
+    # serve ACME challenges on all virtual hosts
+    # /!\ need to be served individually for each explicit virtual host as well!
+    include /etc/lacme/nginx.conf;
+    include snippets/headers.conf;
+}
diff --git a/roles/common-web/files/etc/nginx/snippets/fastcgi-php-ssl.conf b/roles/common-web/files/etc/nginx/snippets/fastcgi-php-ssl.conf
new file mode 100644
index 0000000..aa82ca6
--- /dev/null
+++ b/roles/common-web/files/etc/nginx/snippets/fastcgi-php-ssl.conf
@@ -0,0 +1,10 @@
+# PHP only.
+# Credits to http://claylo.com/post/7617674014/ssl-php-fpm-and-nginx
+
+include snippets/fastcgi-php.conf;
+
+fastcgi_param HTTPS             on;
+fastcgi_param SSL_PROTOCOL      $ssl_protocol;
+fastcgi_param SSL_CIPHER        $ssl_cipher;
+fastcgi_param SSL_SESSION_ID    $ssl_session_id;
+fastcgi_param SSL_CLIENT_VERIFY $ssl_client_verify;
diff --git a/roles/common-web/files/etc/nginx/snippets/fastcgi-php.conf b/roles/common-web/files/etc/nginx/snippets/fastcgi-php.conf
new file mode 100644
index 0000000..f82bc5d
--- /dev/null
+++ b/roles/common-web/files/etc/nginx/snippets/fastcgi-php.conf
@@ -0,0 +1,13 @@
+# regex to split $uri to $fastcgi_script_name and $fastcgi_path
+fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+
+# Check that the PHP script exists before passing it
+try_files $fastcgi_script_name =404;
+
+# Bypass the fact that try_files resets $fastcgi_path_info
+# see: http://trac.nginx.org/nginx/ticket/321
+set $path_info $fastcgi_path_info;
+fastcgi_param PATH_INFO $path_info;
+
+fastcgi_index index.php;
+include       snippets/fastcgi.conf;
diff --git a/roles/common-web/files/etc/nginx/fastcgi/params b/roles/common-web/files/etc/nginx/snippets/fastcgi.conf
index 80132ec..9a0a029 100644
--- a/roles/common-web/files/etc/nginx/fastcgi/params
+++ b/roles/common-web/files/etc/nginx/snippets/fastcgi.conf
@@ -1,23 +1,25 @@
+fastcgi_param   SCRIPT_FILENAME     $document_root$fastcgi_script_name;
 fastcgi_param   QUERY_STRING        $query_string;
 fastcgi_param   REQUEST_METHOD      $request_method;
 fastcgi_param   CONTENT_TYPE        $content_type;
 fastcgi_param   CONTENT_LENGTH      $content_length;
 
-fastcgi_param   SCRIPT_FILENAME     $document_root$fastcgi_script_name;
 fastcgi_param   SCRIPT_NAME         $fastcgi_script_name;
-fastcgi_param   PATH_INFO           $fastcgi_path_info;
 fastcgi_param   REQUEST_URI         $request_uri;
 fastcgi_param   DOCUMENT_URI        $document_uri;
 fastcgi_param   DOCUMENT_ROOT       $document_root;
 fastcgi_param   SERVER_PROTOCOL     $server_protocol;
+fastcgi_param   REQUEST_SCHEME      $scheme;
+fastcgi_param   HTTPS               $https if_not_empty;
 
 fastcgi_param   GATEWAY_INTERFACE   CGI/1.1;
 fastcgi_param   SERVER_SOFTWARE     nginx/$nginx_version;
 
 fastcgi_param   REMOTE_ADDR         $remote_addr;
 fastcgi_param   REMOTE_PORT         $remote_port;
 fastcgi_param   SERVER_ADDR         $server_addr;
 fastcgi_param   SERVER_PORT         $server_port;
 fastcgi_param   SERVER_NAME         $server_name;
 
-fastcgi_param   HTTPS               $https;
+# PHP only, required if PHP was built with --enable-force-cgi-redirect
+fastcgi_param   REDIRECT_STATUS     200;
diff --git a/roles/common-web/files/etc/nginx/snippets/headers.conf b/roles/common-web/files/etc/nginx/snippets/headers.conf
new file mode 100644
index 0000000..798a151
--- /dev/null
+++ b/roles/common-web/files/etc/nginx/snippets/headers.conf
@@ -0,0 +1,5 @@
+# https://securityheaders.io/
+add_header Referrer-Policy no-referrer;
+add_header X-Frame-Options "SAMEORIGIN";
+add_header X-Content-Type-Options nosniff;
+add_header X-XSS-Protection "1; mode=block";
diff --git a/roles/common-web/files/etc/nginx/snippets/ssl.conf b/roles/common-web/files/etc/nginx/snippets/ssl.conf
new file mode 100644
index 0000000..0284b0a
--- /dev/null
+++ b/roles/common-web/files/etc/nginx/snippets/ssl.conf
@@ -0,0 +1,26 @@
+# https://wiki.mozilla.org/Security/Server_Side_TLS
+# https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=nginx-1.14.2&openssl=1.1.1c&hsts=yes&profile=intermediate
+
+ssl on;
+
+ssl_session_timeout 1d;
+ssl_session_cache shared:SSL:50m;
+ssl_session_tickets off;
+
+# Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
+ssl_dhparam /etc/ssl/dhparams.pem;
+
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
+ssl_prefer_server_ciphers off;
+
+# HSTS (ngx_http_headers_module is required) (31557600 seconds = 1 year)
+add_header Strict-Transport-Security "max-age=31557600; includeSubDomains" always;
+
+# OCSP Stapling: fetch OCSP records from URL in ssl_certificate and cache them
+# https://github.com/jsha/ocsp-stapling-examples/blob/master/nginx.conf
+ssl_stapling on;
+ssl_stapling_verify on;
+
+# verify chain of trust of OCSP response using Root CA and Intermediate certs
+ssl_trusted_certificate /usr/share/lacme/ca-certificates.crt;
diff --git a/roles/common-web/files/etc/nginx/ssl/config b/roles/common-web/files/etc/nginx/ssl/config
deleted file mode 100644
index 26a64f4..0000000
--- a/roles/common-web/files/etc/nginx/ssl/config
+++ /dev/null
@@ -1,20 +0,0 @@
-ssl on;
-
-# See http://nginx.org/en/docs/http/configuring_https_servers.html#optimization
-keepalive_timeout           75 75;
-ssl_session_timeout         5m;
-ssl_session_cache           shared:SSL:5m;
-
-# XXX: Ideally we want to get rid of TLSv1, to be immune to the BEAST
-# attack. Sadly as of 2013 many clients don't support TLSv1.2, though.
-# The alternative would be to reject BEAST-vulnerable ciphers from TLSv1
-# in favor of RC4, but that's not satisfactory either since RC4 has
-# other weaknesses.
-ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
-ssl_ciphers                 HIGH:!SSLv2:!aNULL:!eNULL:!3DES:!MD5:@STRENGTH;
-ssl_dhparam                 /etc/ssl/private/dhparams.pem;
-ssl_prefer_server_ciphers   on;
-
-# Strict Transport Security header for enhanced security. See
-# http://www.chromium.org/sts.
-add_header Strict-Transport-Security "max-age=15552000";
diff --git a/roles/common-web/tasks/main.yml b/roles/common-web/tasks/main.yml
index d2b2acd..f059bfc 100644
--- a/roles/common-web/tasks/main.yml
+++ b/roles/common-web/tasks/main.yml
@@ -1,61 +1,68 @@
 - name: Install Nginx
-  apt: pkg=nginx
+  apt: pkg=nginx-light
 
 - name: Limit Nginx logging
   lineinfile: "dest=/etc/logrotate.d/nginx create=yes
                regexp='^\\s*rotate\\s'
-               line='\trotate 1'"
+               line='\trotate 7'"
   tags:
     - logrotate
 
-- name: Delete /etc/nginx/sites-{available,enabled}/default
-  file: path=/etc/nginx/sites-{{ item }}/default state=absent
-  with_items:
-    - enabled
-    - available
-
-- name: Create directory /etc/nginx/{fastcgi,ssl}
-  file: path=/etc/nginx/{{ item }}
-        state=directory
-        owner=root group=root
-        mode=0755
-  with_items:
-    - fastcgi
-    - ssl
-
-- name: Copy fastcgi parameters
-  copy: src=etc/nginx/fastcgi/{{ item }}
-        dest=/etc/nginx/fastcgi/{{ item }}
+- name: Copy fastcgi parameters and SSL configuration snippets
+  copy: src=etc/nginx/snippets/{{ item }}
+        dest=/etc/nginx/snippets/{{ item }}
         owner=root group=root
         mode=0644
   register: r1
   with_items:
-    - params
-    - php
-    - php-ssl
+    - fastcgi.conf
+    - fastcgi-php.conf
+    - fastcgi-php-ssl.conf
+    - ssl.conf
+    - headers.conf
   notify:
     - Restart Nginx
 
-- name: Copy SSL configuration
-  copy: src=etc/nginx/ssl/config
-        dest=/etc/nginx/ssl/config
+- name: Copy /etc/nginx/sites-available/default
+  copy: src=etc/nginx/sites-available/default
+        dest=/etc/nginx/sites-available/default
         owner=root group=root
         mode=0644
   register: r2
   notify:
     - Restart Nginx
 
+- name: Create /etc/nginx/sites-enabled/default
+  file: src=../sites-available/default
+        dest=/etc/nginx/sites-enabled/default
+        owner=root group=root
+        state=link force=yes
+  register: r3
+  notify:
+    - Restart Nginx
+
 - name: Add .asc to text/plain MIME types
   lineinfile: dest=/etc/nginx/mime.types
               regexp='^(\s*text/plain\s+)'
               backrefs=yes
               line='\1txt asc;'
-  register: r3
+  register: r4
+  notify:
+    - Restart Nginx
+
+# WARN Bullseye: nginx >=1.15.1 uses font/woff and font/woff2 (cf. https://trac.nginx.org/nginx/ticket/1243)
+# however Bootstrap(?) appears to query resources with "Accept: application/font-woff" resp. application/font-woff2.
+# Unfortunately it also uses "Accept-Encoding: identity" so the resource isn't compressed...
+- name: Fix MIME type for woff
+  lineinfile: dest=/etc/nginx/mime.types
+              insertafter='^\s*\S+\s\s+woff;'
+              line='    application/font-woff2                woff2;'
+  register: r5
   notify:
     - Restart Nginx
 
 - name: Start Nginx
   service: name=nginx state=started
-  when: not (r1.changed or r2.changed or r3.changed)
+  when: not (r1.changed or r2.changed or r3.changed or r4.changed or r5.changed)
 
 - meta: flush_handlers