|
| 1 | +#user nginx; |
| 2 | +worker_processes 2; |
| 3 | +worker_rlimit_nofile 2048; |
| 4 | +pid /var/run/nginx.pid; |
| 5 | +daemon off; |
| 6 | +load_module /usr/lib/nginx/modules/ngx_http_headers_more_filter_module.so; |
| 7 | + |
| 8 | + |
| 9 | +events { |
| 10 | + worker_connections 1024; |
| 11 | +} |
| 12 | + |
| 13 | +http { |
| 14 | + include mime.types; |
| 15 | + default_type application/octet-stream; |
| 16 | + |
| 17 | + sendfile on; |
| 18 | + tcp_nopush off; |
| 19 | + keepalive_timeout 60 50; |
| 20 | + gzip on; |
| 21 | + gzip_types text/plain text/css application/xml application/javascript application/json image/jpg image/jpeg image/png image/gif image/svg+xml font/woff2 woff2; |
| 22 | + |
| 23 | + # Timeouts definition |
| 24 | + client_body_timeout 10; |
| 25 | + client_header_timeout 10; |
| 26 | + send_timeout 10; |
| 27 | + # Set buffer size limits |
| 28 | + client_body_buffer_size 1k; |
| 29 | + client_header_buffer_size 1k; |
| 30 | + client_max_body_size 20k; |
| 31 | + large_client_header_buffers 2 20k; |
| 32 | + # Limit connections |
| 33 | + limit_conn addr 20; |
| 34 | + limit_conn_status 429; |
| 35 | + limit_conn_zone $binary_remote_addr zone=addr:5m; |
| 36 | + # Disable sending server info and versions |
| 37 | + server_tokens off; |
| 38 | + more_clear_headers Server; |
| 39 | + more_clear_headers X-Powered-By; |
| 40 | + # Prevent clickJacking attack |
| 41 | + add_header X-Frame-Options SAMEORIGIN; |
| 42 | + # Disable content-type sniffing |
| 43 | + add_header X-Content-Type-Options nosniff; |
| 44 | + # Enable XSS filter |
| 45 | + add_header X-XSS-Protection "1; mode=block"; |
| 46 | + |
| 47 | + # Enables nginx to check multiple set_real_ip_from lines |
| 48 | + real_ip_recursive on; |
| 49 | + |
| 50 | + real_ip_header X-Forwarded-For; |
| 51 | + |
| 52 | + # Exclude all private IPv4 space from client source calculation when |
| 53 | + # processing the X-Forewarded-For header |
| 54 | + set_real_ip_from 10.0.0.0/8; |
| 55 | + set_real_ip_from 100.64.0.0/10; |
| 56 | + set_real_ip_from 172.16.0.0/12; |
| 57 | + set_real_ip_from 192.168.0.0/16; |
| 58 | + # TODO - IPv6 CIDR for VPCs will require autoconfiguration |
| 59 | + |
| 60 | + # Add CloudFront source address ranges to trusted CIDR range for real ip computation |
| 61 | + include /etc/nginx/cloudfront-ips.conf; |
| 62 | + |
| 63 | + # logging |
| 64 | + access_log /dev/stdout; |
| 65 | + error_log /dev/stdout info; |
| 66 | + |
| 67 | + # Specify a key=value format useful for machine parsing |
| 68 | + log_format kv escape=json |
| 69 | + '{' |
| 70 | + '"time": "$time_local", ' |
| 71 | + '"hostname": "$host", ' |
| 72 | + '"dest_port": "$server_port", ' |
| 73 | + '"dest_ip": "$server_addr", ' |
| 74 | + '"src": "$remote_addr", ' |
| 75 | + '"src_ip": "$realip_remote_addr", ' |
| 76 | + '"user": "$remote_user", ' |
| 77 | + '"protocol": "$server_protocol", ' |
| 78 | + '"http_method": "$request_method", ' |
| 79 | + '"status": "$status", ' |
| 80 | + '"bytes_out": "$body_bytes_sent", ' |
| 81 | + '"bytes_in": "$request_length", ' |
| 82 | + '"http_referer": "$http_referer", ' |
| 83 | + '"http_user_agent": "$http_user_agent", ' |
| 84 | + '"nginx_version": "$nginx_version", ' |
| 85 | + '"http_cloudfront_viewer_address": "$http_cloudfront_viewer_address", ' |
| 86 | + '"http_cloudfront_viewer_http_version": "$http_cloudfront_viewer_http_version", ' |
| 87 | + '"http_cloudfront_viewer_tls": "$http_cloudfront_viewer_tls", ' |
| 88 | + '"http_cloudfront_viewer_country": "$http_cloudfront_viewer_country", ' |
| 89 | + '"http_cloudfront_viewer_country_region": "$http_cloudfront_viewer_country_region", ' |
| 90 | + '"http_x_forwarded_for": "$http_x_forwarded_for", ' |
| 91 | + '"http_x_amzn_trace_id": "$http_x_amzn_trace_id", ' |
| 92 | + '"response_time": "$upstream_response_time", ' |
| 93 | + '"request_time": "$request_time", ' |
| 94 | + '"request": "$request", ' |
| 95 | + '"tls_protocol": "$ssl_protocol", ' |
| 96 | + '"tls_cipher": "$ssl_cipher", ' |
| 97 | + '"uri_path": "$uri", ' |
| 98 | + '"uri_query": "$query_string",' |
| 99 | + '"log_filename": "nginx_access.log"' |
| 100 | + '}'; |
| 101 | + |
| 102 | + # Get $status_reason variable, a human readable version of $status |
| 103 | + include status-map.conf; |
| 104 | + |
| 105 | + # Set HSTS header only if not already set by app. Some clients get unhappy if |
| 106 | + # you set multiple Strict-Transport-Security headers. |
| 107 | + # https://serverfault.com/a/598106 |
| 108 | + map $upstream_http_strict_transport_security $sts_value { |
| 109 | + '' "max-age=31536000; preload"; |
| 110 | + } |
| 111 | + |
| 112 | + # Always add a HSTS header - This is still inside the http block, so will not |
| 113 | + # conflict with headers set in nginx.conf |
| 114 | + add_header Strict-Transport-Security $sts_value always; |
| 115 | + |
| 116 | + server { |
| 117 | + listen 8443 ssl; |
| 118 | + server_name _; |
| 119 | + access_log /dev/stdout kv; |
| 120 | + |
| 121 | + ssl_certificate /keys/tls.crt; |
| 122 | + ssl_certificate_key /keys/tls.key; |
| 123 | + ssl_client_certificate /etc/nginx/ficam_bundle.pem; |
| 124 | + ssl_verify_client optional_no_ca; # on; |
| 125 | + ssl_verify_depth 10; |
| 126 | + |
| 127 | + ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:!ECDHE-RSA-AES256-SHA384:!ECDHE-RSA-AES256-SHA:!DHE-RSA-AES256-SHA256:!DHE-RSA-AES256-SHA'; |
| 128 | + ssl_dhparam /etc/ssl/certs/dhparam.pem; |
| 129 | + ssl_prefer_server_ciphers on; |
| 130 | + ssl_protocols TLSv1.2; |
| 131 | + ssl_session_cache shared:SSL:10m; |
| 132 | + ssl_session_timeout 5m; |
| 133 | + ssl_stapling on; |
| 134 | + ssl_stapling_verify on; |
| 135 | + proxy_buffer_size 32k; |
| 136 | + proxy_buffers 8 32k; |
| 137 | + proxy_busy_buffers_size 64k; |
| 138 | + |
| 139 | + location ~* \.(html|txt|ico|png|json)$ { |
| 140 | + root "/srv"; |
| 141 | + try_files $uri @backend; |
| 142 | + } |
| 143 | + |
| 144 | + location / { |
| 145 | + proxy_pass https://0.0.0.0:3000; |
| 146 | + |
| 147 | + proxy_set_header X-Real-Host $host; |
| 148 | + proxy_set_header X-Real-Ip $remote_addr; |
| 149 | + proxy_set_header X-Real-Proto https; |
| 150 | + proxy_set_header X-Client-Verify $ssl_client_verify; |
| 151 | + proxy_set_header X-Client-S-Dn $ssl_client_s_dn; |
| 152 | + proxy_set_header X-Client-I-Dn $ssl_client_i_dn; |
| 153 | + proxy_set_header X-Client-Serial $ssl_client_serial; |
| 154 | + proxy_set_header X-Client-Fingerprint $ssl_client_fingerprint; |
| 155 | + proxy_set_header X-Client-Cert $ssl_client_escaped_cert; |
| 156 | + } |
| 157 | + |
| 158 | + location @backend { |
| 159 | + proxy_pass https://0.0.0.0:3000; |
| 160 | + |
| 161 | + proxy_set_header X-Real-Host $host; |
| 162 | + proxy_set_header X-Real-Ip $remote_addr; |
| 163 | + proxy_set_header X-Real-Proto https; |
| 164 | + proxy_set_header X-Client-Verify $ssl_client_verify; |
| 165 | + proxy_set_header X-Client-S-Dn $ssl_client_s_dn; |
| 166 | + proxy_set_header X-Client-I-Dn $ssl_client_i_dn; |
| 167 | + proxy_set_header X-Client-Serial $ssl_client_serial; |
| 168 | + proxy_set_header X-Client-Fingerprint $ssl_client_fingerprint; |
| 169 | + proxy_set_header X-Client-Cert $ssl_client_escaped_cert; |
| 170 | + } |
| 171 | + } |
| 172 | +} |
0 commit comments