Permalink
Find file Copy path
46 lines (40 sloc) 1.52 KB
run:
- exec:
cmd:
# Generate strong Diffie-Hellman parameters
- "mkdir -p /shared/ssl/"
- replace:
filename: "/etc/nginx/conf.d/discourse.conf"
from: /server.+{/
to: |
server {
listen 80;
return 301 https://$$ENV_DISCOURSE_HOSTNAME$request_uri;
}
server {
- replace:
hook: ssl
filename: "/etc/nginx/conf.d/discourse.conf"
from: /listen 80;\s+gzip on;/m
to: |
listen 443 ssl http2;
ssl_protocols TLSv1.2;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA;
ssl_prefer_server_ciphers on;
ssl_ecdh_curve secp384r1:prime256v1;
ssl_certificate /shared/ssl/ssl.crt;
ssl_certificate_key /shared/ssl/ssl.key;
ssl_session_tickets off;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:1m;
gzip on;
add_header Strict-Transport-Security 'max-age=31536000'; # remember the certificate for a year and automatically connect to HTTPS for this domain
if ($http_host != $$ENV_DISCOURSE_HOSTNAME) {
rewrite (.*) https://$$ENV_DISCOURSE_HOSTNAME$1 permanent;
}
- replace:
filename: "/etc/nginx/conf.d/discourse.conf"
from: "location @discourse {"
to: |
location @discourse {
add_header Strict-Transport-Security 'max-age=31536000'; # remember the certificate for a year and automatically connect to HTTPS for this domain