From e75fdedc7267b4918dbf4ebe10e66f2ac90ab313 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Sun, 17 May 2020 16:21:37 +0200 Subject: Webmail: Compress static resources. We leave dynamic pages (those passed to PHP-FPM) alone for now: compressing them would make us vulnerable to BREACH attacks. This will be revisited once Roundcube 1.5 is released: 1.5 adds support for the same-site cookie attribute which once set to 'Strict' makes it immune to BREACH attacks: https://github.com/roundcube/roundcubemail/pull/6772 https://www.sjoerdlangkemper.nl/2016/11/07/current-state-of-breach-attack/#same-site-cookies --- roles/webmail/files/etc/nginx/sites-available/roundcube | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) (limited to 'roles') diff --git a/roles/webmail/files/etc/nginx/sites-available/roundcube b/roles/webmail/files/etc/nginx/sites-available/roundcube index 9763b31..2863fad 100644 --- a/roles/webmail/files/etc/nginx/sites-available/roundcube +++ b/roles/webmail/files/etc/nginx/sites-available/roundcube @@ -35,11 +35,15 @@ server { ssl_certificate_key ssl/mail.fripost.org.key; include snippets/mail.fripost.org.hpkp-hdr; + gzip on; + gzip_vary on; + gzip_min_length 256; + gzip_types application/font-woff application/font-woff2 application/javascript application/json application/xml image/svg+xml image/x-icon text/css text/plain text/vcard; + location = /favicon.ico { root /usr/share/roundcube/skins/default/images; log_not_found off; access_log off; - expires max; } location = /robots.txt { @@ -54,13 +58,17 @@ server { client_max_body_size 64m; location = / { index index.php; } location = /index.php { + # TODO enable gzip for Roundcube >=1.5: it's immune to BREACH attacks once + # $config['session_samesite'] is set to 'Strict', see + # https://github.com/roundcube/roundcubemail/pull/6772 + # https://www.sjoerdlangkemper.nl/2016/11/07/current-state-of-breach-attack/#same-site-cookies + gzip off; include snippets/fastcgi-php-ssl.conf; fastcgi_pass unix:/var/run/php/php7.3-fpm@roundcube.sock; } location ~ "^/(?:plugins|program/js|program/resources|skins)(?:/[[:alnum:]][[:alnum:]\-\._]*)+\.(?:css|eot|gif|html|ico|jpg|js|pdf|png|svg|tiff?|ttf|woff2?)$" { try_files $uri =404; - expires 30d; } location / { internal; } } -- cgit v1.2.3