Merge branch 'release/1.0.28'

Author: Andrew Welch

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Nginx-Craft Changelog
 
+## 1.0.28 - 2020.08.20
+### Changed
+* Set `server_tokens` to `off`
+* Changed the `dhparam` setting to `/etc/nginx/dhparams.pem` to mirror the Forge default
+ 
 ## 1.0.27 - 2020.06.23
 ### Changed
 * Explicitly set `DOCUMENT_ROOT`

README.md

@@ -51,7 +51,7 @@ This Nginx configuration comes in two parts:
 ## Using Nginx-Craft
 
 1. Obtain an SSL certificate for your domain via [LetsEncrypt.com](https://letsencrypt.org/) (or via other certificate authorities).  LetsEncrypt.com is free, and it's automated.  You will need a basic server up and running that responds to port 80 to do this, [LetsEnecrypt/Nginx tutorial](https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-16-04)
-2. Create a `dhparam.pem` via `sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048`
+2. Create a `dhparam.pem` via `sudo openssl dhparam -out /etc/nginx/dhparams.pem 2048`
 3. Download your Issuer certificate via `mkdir /etc/nginx/ssl; sudo wget -O /etc/nginx/ssl/lets-encrypt-x3-cross-signed.pem "https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem"`
 4. Upload the entire `nginx-partials` folder to `/etc/nginx/`
 5. Rename the `somedomain.com.conf` file to `yourdomain.com.conf`

forge-example/NginxConfiguration.conf

@@ -1,4 +1,4 @@
-# FORGE CONFIG (DOT NOT REMOVE!)
+# FORGE CONFIG (DO NOT REMOVE!)
 include forge-conf/SOMEDOMAIN.com/before/*;
 
 # Bots to ban via user agent
@@ -14,6 +14,7 @@ server {
 
     # General virtual host settings
     server_name SOMEDOMAIN.com;
+    server_tokens off;
     root /home/forge/SOMEDOMAIN.com/public;
     index index.html index.htm index.php;
     charset utf-8;
@@ -59,16 +60,14 @@ server {
     #error_log syslog:server=unix:/dev/log,facility=local7,tag=nginx,severity=error;
 
     # FORGE SSL (DO NOT REMOVE!)
-    # ssl_certificate;
-    # ssl_certificate_key;
     ssl_certificate /etc/nginx/ssl/SOMEDOMAIN.com/XXXXXX/server.crt;
     ssl_certificate_key /etc/nginx/ssl/SOMEDOMAIN.com/XXXXXX/server.key;
 
     # SSL/TLS configuration, with TLSv1.0 disabled because it is insecure; note that IE 8, 9 & 10 support
     # TLSv1.1, but it's not enabled by default clients using those browsers will not be able to connect
     ssl_protocols TLSv1.2 TLSv1.1;
     ssl_prefer_server_ciphers on;
-    ssl_dhparam /etc/ssl/certs/dhparam.pem;
+    ssl_dhparam /etc/nginx/dhparams.pem;
     ssl_ciphers 'ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5';
     ssl_buffer_size 4k;
     ssl_session_timeout 4h;
@@ -77,7 +76,7 @@ server {
     ssl_stapling_verify on;
     ssl_trusted_certificate /etc/nginx/ssl/lets-encrypt-x3-cross-signed.pem;
 
-    # FORGE CONFIG (DOT NOT REMOVE!)
+    # FORGE CONFIG (DO NOT REMOVE!)
     include forge-conf/SOMEDOMAIN.com/server/*;
 
     # Load configuration files from nginx-partials
@@ -156,5 +155,5 @@ server {
     }
 }
 
-# FORGE CONFIG (DOT NOT REMOVE!)
+# FORGE CONFIG (DO NOT REMOVE!)
 include forge-conf/SOMEDOMAIN.com/after/*;

sites-available/basic_localdev.com.conf

@@ -16,6 +16,7 @@ server {
 
     # General virtual host settings
     server_name SOMEDOMAIN.com;
+    server_tokens off;
     root "/var/www/SOMEDOMAIN/public";
     index index.html index.htm index.php;
     charset utf-8;

sites-available/somedomain.com.conf

@@ -17,6 +17,7 @@ server {
     listen 80;
     listen [::]:80;
     server_name .SOMEDOMAIN.com;
+    server_tokens off;
     return 301 https://SOMEDOMAIN.com$request_uri;
 }
 
@@ -26,6 +27,7 @@ server {
     listen 443 ssl http2;
     listen [::]:443 ssl http2;
     server_name *.SOMEDOMAIN.com;
+    server_tokens off;
     ssl_certificate /etc/letsencrypt/live/SOMEDOMAIN.com/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/SOMEDOMAIN.com/privkey.pem;
     return 301 https://SOMEDOMAIN.com$request_uri;
@@ -39,6 +41,7 @@ server {
 
     # General virtual host settings
     server_name SOMEDOMAIN.com;
+    server_tokens off;
     root "/var/www/SOMEDOMAIN/public";
     index index.html index.htm index.php;
     charset utf-8;
@@ -163,7 +166,7 @@ server {
     ssl_certificate_key /etc/letsencrypt/live/SOMEDOMAIN.com/privkey.pem;
     ssl_protocols TLSv1.2 TLSv1.1;
     ssl_prefer_server_ciphers on;
-    ssl_dhparam /etc/ssl/certs/dhparam.pem;
+    ssl_dhparam /etc/nginx/dhparams.pem;
     ssl_ciphers 'ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5';
     ssl_buffer_size 4k;
     ssl_session_timeout 4h;