From ef430522256013665205cdda05636846cc622251 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Tue, 12 Jul 2016 03:10:33 +0200 Subject: nginx: Don't hard-code the HPKP headers. Instead, lookup the pubkeys and compute the digests on the fly. But never modify the actual header snippet to avoid locking our users out. --- roles/wiki/files/etc/nginx/sites-available/website | 6 +++--- roles/wiki/files/etc/nginx/sites-available/wiki | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) (limited to 'roles/wiki/files') diff --git a/roles/wiki/files/etc/nginx/sites-available/website b/roles/wiki/files/etc/nginx/sites-available/website index 10e127c..e79ff1f 100644 --- a/roles/wiki/files/etc/nginx/sites-available/website +++ b/roles/wiki/files/etc/nginx/sites-available/website @@ -31,9 +31,9 @@ server { "default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self'; font-src 'self'; upgrade-insecure-requests; block-all-mixed-content; reflected-xss block; referrer no-referrer-when-downgrade; frame-ancestors 'none'; form-action https://www.paypal.com/; base-uri fripost.org www.fripost.org"; include snippets/ssl.conf; - ssl_certificate /etc/nginx/ssl/www.fripost.org.pem; - ssl_certificate_key /etc/nginx/ssl/www.fripost.org.key; - add_header Public-Key-Pins 'pin-sha256="fQ+gau72iwOf6rmXvY7/QemB+kYhixPCY/A/EIr3ats="; pin-sha256="MYhOgCyUOp8NRGxa1LZc57g0wREA3kV8C+4SsrDajt8="; max-age=15778800'; + ssl_certificate ssl/www.fripost.org.pem; + ssl_certificate_key ssl/www.fripost.org.key; + include snippets/fripost.org.hpkp-hdr; location / { try_files $uri $uri/ =404; diff --git a/roles/wiki/files/etc/nginx/sites-available/wiki b/roles/wiki/files/etc/nginx/sites-available/wiki index 39cd653..d2e13a5 100644 --- a/roles/wiki/files/etc/nginx/sites-available/wiki +++ b/roles/wiki/files/etc/nginx/sites-available/wiki @@ -30,9 +30,9 @@ server { "default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self'; font-src 'self'; upgrade-insecure-requests; block-all-mixed-content; reflected-xss block; referrer no-referrer-when-downgrade; frame-ancestors 'none'; form-action 'self'; base-uri wiki.fripost.org"; include snippets/ssl.conf; - ssl_certificate /etc/nginx/ssl/www.fripost.org.pem; - ssl_certificate_key /etc/nginx/ssl/www.fripost.org.key; - add_header Public-Key-Pins 'pin-sha256="fQ+gau72iwOf6rmXvY7/QemB+kYhixPCY/A/EIr3ats="; pin-sha256="MYhOgCyUOp8NRGxa1LZc57g0wREA3kV8C+4SsrDajt8="; max-age=15778800'; + ssl_certificate ssl/www.fripost.org.pem; + ssl_certificate_key ssl/www.fripost.org.key; + include snippets/fripost.org.hpkp-hdr; location / { location ~ ^/website(/.*)?$ { return 302 $scheme://fripost.org$1; } -- cgit v1.2.3