about summary refs log tree commit diff
diff options
context:
space:
mode:
authorJason Snell <jason@newrelic.com>2017-04-04 18:43:21 -0700
committerJason Snell <jason@newrelic.com>2017-04-04 18:43:21 -0700
commitfa7b74cf51e2b5c7c60aaf3ec529ba2292450d7b (patch)
tree4801a83cca302677779af4321f91c678fa88ef6a
parentccb6a658fd1a2e596c95d5b8e7a39f72a5f5b14b (diff)
SSL best practices for nginx
-rw-r--r--docs/Running-Mastodon/Production-guide.md12
1 files changed, 12 insertions, 0 deletions
diff --git a/docs/Running-Mastodon/Production-guide.md b/docs/Running-Mastodon/Production-guide.md
index b1f7bd35b..d539ddf64 100644
--- a/docs/Running-Mastodon/Production-guide.md
+++ b/docs/Running-Mastodon/Production-guide.md
@@ -12,9 +12,21 @@ map $http_upgrade $connection_upgrade {
 }
 
 server {
+  listen 80;
+  listen [::]:80;
+  server_name example.com;
+  return 301 https://$host$request_uri;
+}
+
+server {
   listen 443 ssl;
   server_name example.com;
 
+  ssl_protocols TLSv1.2;
+  ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
+  ssl_prefer_server_ciphers on;
+  ssl_session_cache shared:SSL:10m;
+
   ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
   ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;