[CiCADA] chi.meson.one

chi.meson.one · 3.0 KiB · Text Raw

# /etc/nginx/sites-enabled/chi.meson.one
#
# Static HTML5 site — chi.meson.one
# Requires: /etc/nginx/conf.d/log-maps.conf ($loggable, log_format static)
server {
    listen      80      default_server;
    listen      [::]:80 default_server;
    server_name chi.meson.one;
    server_tokens off;
    access_log  off;
    return 301  https://$host$request_uri;
}
server {
    # HTTP/2 over TCP
    listen 443          ssl default_server;
    listen [::]:443     ssl default_server;
    # HTTP/3 over QUIC/UDP
    listen 443          quic ;
    listen [::]:443     quic ;
    http2 on;
    http3 on;
    add_header Alt-Svc 'h3=":443"; ma=86400' always;
    server_name chi.meson.one;
    server_tokens off;
    root        /var/www/chi.meson.one;
    index       index.html;
    access_log  /var/log/nginx/chi.meson.one.log      json buffer=32k flush=5m if=$loggable;
    error_log   /var/log/nginx/_error_chi.meson.one.log warn;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_certificate         /etc/letsencrypt/live/chi.meson.one/fullchain.pem;
    ssl_certificate_key     /etc/letsencrypt/live/chi.meson.one/privkey.pem;
    ssl_dhparam             /etc/letsencrypt/dh/chi.pem;
    # Security headers
    add_header Strict-Transport-Security    "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Content-Type-Options       "nosniff"       always;
    add_header X-Frame-Options              "SAMEORIGIN"    always;
    add_header X-XSS-Protection             "1; mode=block" always;
    add_header Referrer-Policy              "no-referrer-when-downgrade" always;
    add_header Permissions-Policy           "interest-cohort=()" always;
    # Gzip
    gzip            on;
    gzip_vary       on;
    gzip_static     on;
    gzip_comp_level 4;
    gzip_min_length 1000;
    gzip_types
        text/plain text/css text/xml text/javascript
        application/json application/javascript application/xml
        image/svg+xml;
    error_page 404 /404.html;
    error_page 401 /401.html;
    # Static files
    location / {
        try_files $uri $uri/ =404;
    }
    # Long-lived cache for versioned assets.
    # Repeats security headers — child add_header replaces parent's entirely.
    location ~* \.(ico|css|js|gif|jpe?g|png|webp|svg|woff2?|ttf|eot)$ {
        expires 1y;
        add_header Cache-Control                "public, immutable";
        add_header Strict-Transport-Security    "max-age=63072000; includeSubDomains; preload" always;
        add_header X-Content-Type-Options       "nosniff"       always;
        add_header X-Frame-Options              "SAMEORIGIN"    always;
        add_header X-XSS-Protection             "1; mode=block" always;
        add_header Referrer-Policy              "no-referrer-when-downgrade" always;
        add_header Permissions-Policy           "interest-cohort=()" always;
        access_log      off;
        log_not_found   off;
    }
    # Block hidden files
    location ~ /\. {
        deny all;
        access_log    off;
        log_not_found off;
    }
}

1	# /etc/nginx/sites-enabled/chi.meson.one
2	#
3	# Static HTML5 site — chi.meson.one
4	# Requires: /etc/nginx/conf.d/log-maps.conf ($loggable, log_format static)
5	server {
6	listen 80 default_server;
7	listen [::]:80 default_server;
8	server_name chi.meson.one;
9	server_tokens off;
10	access_log off;
11	return 301 https://$host$request_uri;
12	}
13	server {
14	# HTTP/2 over TCP
15	listen 443 ssl default_server;
16	listen [::]:443 ssl default_server;
17	# HTTP/3 over QUIC/UDP
18	listen 443 quic ;
19	listen [::]:443 quic ;
20	http2 on;
21	http3 on;
22	add_header Alt-Svc 'h3=":443"; ma=86400' always;
23	server_name chi.meson.one;
24	server_tokens off;
25	root /var/www/chi.meson.one;
26	index index.html;
27	access_log /var/log/nginx/chi.meson.one.log json buffer=32k flush=5m if=$loggable;
28	error_log /var/log/nginx/_error_chi.meson.one.log warn;
29	include /etc/letsencrypt/options-ssl-nginx.conf;
30	ssl_certificate /etc/letsencrypt/live/chi.meson.one/fullchain.pem;
31	ssl_certificate_key /etc/letsencrypt/live/chi.meson.one/privkey.pem;
32	ssl_dhparam /etc/letsencrypt/dh/chi.pem;
33	# Security headers
34	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
35	add_header X-Content-Type-Options "nosniff" always;
36	add_header X-Frame-Options "SAMEORIGIN" always;
37	add_header X-XSS-Protection "1; mode=block" always;
38	add_header Referrer-Policy "no-referrer-when-downgrade" always;
39	add_header Permissions-Policy "interest-cohort=()" always;
40	# Gzip
41	gzip on;
42	gzip_vary on;
43	gzip_static on;
44	gzip_comp_level 4;
45	gzip_min_length 1000;
46	gzip_types
47	text/plain text/css text/xml text/javascript
48	application/json application/javascript application/xml
49	image/svg+xml;
50	error_page 404 /404.html;
51	error_page 401 /401.html;
52	# Static files
53	location / {
54	try_files $uri $uri/ =404;
55	}
56	# Long-lived cache for versioned assets.
57	# Repeats security headers — child add_header replaces parent's entirely.
58	location ~* \.(ico\|css\|js\|gif\|jpe?g\|png\|webp\|svg\|woff2?\|ttf\|eot)$ {
59	expires 1y;
60	add_header Cache-Control "public, immutable";
61	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
62	add_header X-Content-Type-Options "nosniff" always;
63	add_header X-Frame-Options "SAMEORIGIN" always;
64	add_header X-XSS-Protection "1; mode=block" always;
65	add_header Referrer-Policy "no-referrer-when-downgrade" always;
66	add_header Permissions-Policy "interest-cohort=()" always;
67	access_log off;
68	log_not_found off;
69	}
70	# Block hidden files
71	location ~ /\. {
72	deny all;
73	access_log off;
74	log_not_found off;
75	}
76	}