KumiSystems/Chatwoot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

chore: Improve Nginx settings for speed and security (#5144)

Browse source 
* fix: Fixes #5138

* Move to helper function

* Improve Nginx settings

* chore: set ssl_prefer_server_ciphers to off
ssl_prefer_server_ciphers should be set to  `off` in a modern context.

ref: https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=modern&openssl=1.1.1k&guideline=5.6

Co-authored-by: Vishnu Narayanan <vishnu@chatwoot.com>
This commit is contained in:
David Kubeš 2022-10-03 14:13:50 +02:00 committed by GitHub
parent 705d06ac3c
commit 9ea43a2678
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 35 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

36
deployment/nginx_chatwoot.conf
View file

@ -1,3 +1,14 @@
upstream backend {
zone upstreams 64K;
server 127.0.0.1:3000;
keepalive 32;
}
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server { server {
listen 80; listen 80;
listen [::]:80; listen [::]:80;
@ -6,12 +17,12 @@ server {
access_log /var/log/nginx/chatwoot_access_80.log; access_log /var/log/nginx/chatwoot_access_80.log;
error_log /var/log/nginx/chatwoot_error_80.log; error_log /var/log/nginx/chatwoot_error_80.log;
return 301 https://chatwoot.domain.com/; return 301 https://chatwoot.domain.com$request_uri;
} }
server { server {
listen 443 ssl http2; listen 443 ssl http2 reuseport;
listen [::]:443 ssl http2; listen [::]:443 ssl http2 reuseport;
server_name chatwoot.domain.com www.chatwoot.domain.com; server_name chatwoot.domain.com www.chatwoot.domain.com;
underscores_in_headers on; underscores_in_headers on;
@ -20,28 +31,33 @@ server {
error_log /var/log/nginx/chatwoot_error_443.log; error_log /var/log/nginx/chatwoot_error_443.log;
location / { location / {
proxy_pass http://backend;
proxy_redirect off;
proxy_pass_header Authorization; proxy_pass_header Authorization;
proxy_pass http://127.0.0.1:3000;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host; proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Ssl on; # Optional proxy_set_header X-Forwarded-Ssl on; # Optional
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Connection ""; proxy_set_header Upgrade $http_upgrade;
proxy_buffering off; proxy_set_header Connection $connection_upgrade;
client_max_body_size 0; client_max_body_size 0;
proxy_read_timeout 36000s; proxy_read_timeout 36000s;
proxy_redirect off;
} }
ssl_certificate /etc/letsencrypt/live/chatwoot.domain.com/fullchain.pem; # managed by Certbot ssl_certificate /etc/letsencrypt/live/chatwoot.domain.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/chatwoot.domain.com/privkey.pem; # managed by Certbot ssl_certificate_key /etc/letsencrypt/live/chatwoot.domain.com/privkey.pem; # managed by Certbot
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
ssl_protocols TLSv1.2 TLSv1.3; ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off; ssl_prefer_server_ciphers off;
ssl_dhparam /etc/ssl/dhparam; ssl_dhparam /etc/ssl/dhparam;
ssl_early_data on;
ssl_buffer_size 4k;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
} }