SSL improvements (default ciphers & caching), server_tokens option, and proxy_set_headers for vhosts

[buro9]

This is a backwards compatible set of changes.

Changed the default ciphers for SSL to be more secure (the ones in use were vulnerable to the BEAST attack)
Added SSL caching to speed up SSL requests
Add server_tokens to the global config so this can be turned on|off between dev and prod
Add proxy_set_header to vhost as different vhosts may require different headers and the global setting is not ideal
Minor space formatting so that the generated files are fractionally more readable

[jfryman]

❤️ Thanks for the code!

[buro9]

Woah, I changed a few defaults in later commits that you probably do not want to have as default.

Probably my fault, I thought the pull request was just for the first commit rather than the latter ones. The code is fine, it's just the defaults should be more cautious than what I'm using (to spare you support headaches).

To fix, in params.pp you would want:
$nx_multi_accept = off
$nx_events_use = false
$nx_server_tokens = on
$nx_spdy = off
$nx_ssl_stapling = off

Those are the safe defaults.

Reasons:

• SPDY and OCSP stapling both require Nginx 1.4.
• Using epoll for events requires a Linux with a 2.7+ kernel, which should be everyone, but who knows.
• Server tokens is defaulted as on, so this default shouldn't be different... it's just a switch for people.
• Multi accept could flood the backend, and so only those who know their applications can handle that should turn it on.

My apologies for the trouble.

The rest is good though. Defaults should just be cautious.

[jfryman]

No worries. Thanks for the heads up. I've gone ahead and modified master to have some sane defaults. 👍

[nlsrchtr]

I would like to enable spdy, but can't find a way to set nx_spdy = on, because I can't pass the value into the nginx-class. Could you give me any hint how I can enable it?

[jfryman]

@nlsrchtr Right now, the only way to do this is to set the bit in $nginx::params to true. If you'd like to take a shot at it, Pull Requests are gladly accepted. Otherwise, I'll stick this in the backlog to iterate on when I get some cycles.