variable matrix_nginx_proxy_hsts_preload_enable added
This commit is contained in:
parent
5b4fdf9b87
commit
40fe6bd5c1
|
@ -279,6 +279,17 @@ matrix_nginx_proxy_proxy_domain_additional_server_configuration_blocks: []
|
||||||
# Of course, a better solution is to just stop using browsers (like Chrome), which participate in such tracking practices.
|
# Of course, a better solution is to just stop using browsers (like Chrome), which participate in such tracking practices.
|
||||||
matrix_nginx_proxy_floc_optout_enabled: true
|
matrix_nginx_proxy_floc_optout_enabled: true
|
||||||
|
|
||||||
|
# HSTS Preloading Enable
|
||||||
|
#
|
||||||
|
# In its strongest and recommended form, the [HSTS policy](https://www.chromium.org/hsts) includes all subdomains, and
|
||||||
|
# indicates a willingness to be “preloaded” into browsers:
|
||||||
|
# `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`
|
||||||
|
# For more information visit:
|
||||||
|
# - https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
|
||||||
|
# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
|
||||||
|
# - https://hstspreload.org/#opt-in
|
||||||
|
matrix_nginx_proxy_hsts_preload_enable: false
|
||||||
|
|
||||||
# Specifies the SSL configuration that should be used for the SSL protocols and ciphers
|
# Specifies the SSL configuration that should be used for the SSL protocols and ciphers
|
||||||
# This is based on the Mozilla Server Side TLS Recommended configurations.
|
# This is based on the Mozilla Server Side TLS Recommended configurations.
|
||||||
#
|
#
|
||||||
|
|
|
@ -3,7 +3,11 @@
|
||||||
{% macro render_vhost_directives() %}
|
{% macro render_vhost_directives() %}
|
||||||
gzip on;
|
gzip on;
|
||||||
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
|
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
|
||||||
|
{% if matrix_nginx_proxy_hsts_preload_enable %}
|
||||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
||||||
|
{% else %}
|
||||||
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||||
|
{% endif %}
|
||||||
add_header X-XSS-Protection "1; mode=block";;
|
add_header X-XSS-Protection "1; mode=block";;
|
||||||
add_header X-Content-Type-Options nosniff;
|
add_header X-Content-Type-Options nosniff;
|
||||||
|
|
||||||
|
|
|
@ -4,7 +4,11 @@
|
||||||
gzip on;
|
gzip on;
|
||||||
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
|
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
|
||||||
|
|
||||||
|
{% if matrix_nginx_proxy_hsts_preload_enable %}
|
||||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
||||||
|
{% else %}
|
||||||
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||||
|
{% endif %}
|
||||||
add_header X-Content-Type-Options nosniff;
|
add_header X-Content-Type-Options nosniff;
|
||||||
add_header X-XSS-Protection "1; mode=block";
|
add_header X-XSS-Protection "1; mode=block";
|
||||||
add_header X-Frame-Options SAMEORIGIN;
|
add_header X-Frame-Options SAMEORIGIN;
|
||||||
|
|
|
@ -3,7 +3,11 @@
|
||||||
{% macro render_vhost_directives() %}
|
{% macro render_vhost_directives() %}
|
||||||
gzip on;
|
gzip on;
|
||||||
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
|
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
|
||||||
|
{% if matrix_nginx_proxy_hsts_preload_enable %}
|
||||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
||||||
|
{% else %}
|
||||||
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||||
|
{% endif %}
|
||||||
add_header X-XSS-Protection "1; mode=block";
|
add_header X-XSS-Protection "1; mode=block";
|
||||||
add_header X-Content-Type-Options nosniff;
|
add_header X-Content-Type-Options nosniff;
|
||||||
{% if matrix_nginx_proxy_floc_optout_enabled %}
|
{% if matrix_nginx_proxy_floc_optout_enabled %}
|
||||||
|
|
|
@ -4,7 +4,11 @@
|
||||||
gzip on;
|
gzip on;
|
||||||
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
|
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
|
||||||
|
|
||||||
|
{% if matrix_nginx_proxy_hsts_preload_enable %}
|
||||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
||||||
|
{% else %}
|
||||||
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||||
|
{% endif %}
|
||||||
# duplicate X-Content-Type-Options & X-Frame-Options header
|
# duplicate X-Content-Type-Options & X-Frame-Options header
|
||||||
# Enabled by grafana by default
|
# Enabled by grafana by default
|
||||||
# add_header X-Content-Type-Options nosniff;
|
# add_header X-Content-Type-Options nosniff;
|
||||||
|
|
|
@ -3,7 +3,11 @@
|
||||||
{% macro render_vhost_directives() %}
|
{% macro render_vhost_directives() %}
|
||||||
gzip on;
|
gzip on;
|
||||||
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
|
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
|
||||||
|
{% if matrix_nginx_proxy_hsts_preload_enable %}
|
||||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
||||||
|
{% else %}
|
||||||
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||||
|
{% endif %}
|
||||||
add_header X-XSS-Protection "1; mode=block";
|
add_header X-XSS-Protection "1; mode=block";
|
||||||
add_header X-Content-Type-Options nosniff;
|
add_header X-Content-Type-Options nosniff;
|
||||||
{% if matrix_nginx_proxy_floc_optout_enabled %}
|
{% if matrix_nginx_proxy_floc_optout_enabled %}
|
||||||
|
|
|
@ -3,7 +3,11 @@
|
||||||
{% macro render_vhost_directives() %}
|
{% macro render_vhost_directives() %}
|
||||||
gzip on;
|
gzip on;
|
||||||
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
|
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
|
||||||
|
{% if matrix_nginx_proxy_hsts_preload_enable %}
|
||||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
||||||
|
{% else %}
|
||||||
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||||
|
{% endif %}
|
||||||
add_header X-XSS-Protection "1; mode=block";
|
add_header X-XSS-Protection "1; mode=block";
|
||||||
add_header X-Content-Type-Options nosniff;
|
add_header X-Content-Type-Options nosniff;
|
||||||
add_header X-Frame-Options DENY;
|
add_header X-Frame-Options DENY;
|
||||||
|
|
Loading…
Reference in a new issue