nginx_site.conf.erb
4.33 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
# Generated by Chef
#
<% ## -%>
<% ## Initial directives -%>
<% ## -%>
<% @init_statements.each do |ins| -%>
<%= ins %>
<% end -%>
<% ## -%>
<% ## List upstreams -%>
<% ## Example @upstreams element: -%>
<% ## { -%>
<% ## :name => 'string', -%>
<% ## :servers => [ -%>
<% ## '127.0.0.1:9000', -%>
<% ## '/var/run/php-fpm.sock' -%>
<% ## ] -%>
<% ## } -%>
<% ## -%>
<% @upstreams.each do |us| -%>
<% us_servers = us[:servers].inject([]) do |acc, serv| -%>
<% acc << ( serv[0] == '/' ? "unix:#{serv}" : serv ) -%>
<% acc -%>
<% end -%>
upstream <%= us[:name] %> {
<% us_servers.each do |serv| -%>
server <%= serv %>;
<% end -%>
}
<% end -%>
<% ## -%>
<% ## Server block for default nameless server -%>
<% ## -%>
<% if @catch_all -%>
server {
listen 80 default_server;
server_name _;
return 444;
}
<% end -%>
<% ## -%>
<% ## Main server block -%>
<% ## -%>
<% servers = @aliases.inject([@server_name]) do |acc, elem| -%>
<% acc << elem -%>
<% end -%>
<% servers.uniq! -%>
<% if @ssl -%>
<% if @catch_all -%>
server {
listen 443 default_server;
server_name _;
return 444;
}
<% end -%>
server {
listen 80;
server_name <%= servers.join(' ') %>;
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl;
ssl_certificate <%= @path_crt %>;
ssl_certificate_key <%= @path_key %>;
<% unless @ssl[:self_signed] -%>
<% if @ssl[:cipher_suite] == 'modern' -%>
# Modern cipher suite:
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK;
<% else -%>
# Medium compatibility cipher suite (compatible with IE7 WinXP):
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA;
<% end -%>
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_session_cache shared:SSL:10m;
ssl_dhparam <%= @path_dhparam %>;
<% end -%>
<% hage = @ssl[:hsts_max_age] || '15758000' -%>
<% hsub = @ssl.has_key?(:hsts_subdomains) ? @ssl[:hsts_subdomains] : true -%>
<% hsts = "max-age=#{hage};" -%>
<% hsts << 'includeSubDomains;' if hsub -%>
add_header Strict-Transport-Security "<%= hsts %>";
<% else -%>
server {
listen 80;
<% end -%>
<% @add_headers.each do |header, value| -%>
add_header <%= header %> <%= value %>;
<% end -%>
# Add CSP headers here:
# [https://www.owasp.org/index.php/Content_Security_Policy]
# [http://www.html5rocks.com/en/tutorials/security/content-security-policy/]
#
#add_header Content-Security-Policy "default-src 'self'";
#add_header X-Content-Security-Policy "default-src 'self'";
server_name <%= servers.join(' ') %>;
<% if @doc_root -%>
root <%= @doc_root %>;
<% end -%>
<% if @index -%>
index <%= @index %>;
<% end -%>
<% if @auth -%>
auth_basic "<%= @auth[:msg] %>";
auth_basic_user_file <%= @path_pass %>;
<% end -%>
access_log <%= @log_dir %>/<%= @server_name %>.access.log<% if @access_log_options %> <%= @access_log_options %><% end %>;
error_log <%= @log_dir %>/<%= @server_name %>.error.log;
<% @server_statements_1.each do |s1| -%>
<%= sm %>
<% end -%>
<% @includes.each do |inc| -%>
include <%= inc %>;
<% end -%>
<% @server_statements_2.each do |s2| -%>
<%= s2 %>
<% end -%>
}