shione: nginx: follow mozilla ssl recommendation

1 files changed, 13 insertions, 0 deletions

diff --git a/config/shione/nginx/files/etc/nginx/sites-available/shione.net b/config/shione/nginx/files/etc/nginx/sites-available/shione.net
index 361089f..28f7afe 100644
--- a/config/shione/nginx/files/etc/nginx/sites-available/shione.net
+++ b/config/shione/nginx/files/etc/nginx/sites-available/shione.net
@@ -25,6 +25,7 @@ server {
 
         # SSL configuration
         #
+        # Partially generated by https://ssl-config.mozilla.org/.
         listen 443 ssl default_server;
         listen [::]:443 ssl default_server;
         #
@@ -44,6 +45,18 @@ server {
         ssl_certificate_key /etc/letsencrypt/live/shione.net/privkey.pem;
         include /etc/letsencrypt/options-ssl-nginx.conf;
 
+        # OCSP stapling
+        ssl_stapling on;
+        ssl_stapling_verify on;
+
+        # HSTS (ngx_http_headers_module is required) (63072000 seconds)
+        #
+        # See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security.
+        add_header Strict-Transport-Security "max-age=63072000" always;
+
+        # Prevent spam.
+        add_header X-Robots-Tag "noai, noimageai" always;
+
         server_name shione.net www.shione.net;
 
         location ~* \.(htaccess|htpasswd) {