modsecurity-crs-docker/nginx/templates/conf.d/default.conf.template at 63e57d36fb5c80334a8beae47a9fc8bf41beae50 · coreruleset/modsecurity-crs-docker · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
# Nginx configuration for both HTTP and SSL

server_tokens ${SERVER_TOKENS};

map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

server {
    listen ${PORT} default_server;

    server_name ${SERVER_NAME};
    set $always_redirect ${NGINX_ALWAYS_TLS_REDIRECT};

    port_in_redirect off;

    PROXY_SSL_CONFIG

    location / {
        client_max_body_size 0;

        if ($always_redirect = on) {
            return 301 https://$host$request_uri;
        }

        include includes/cors.conf;
        include includes/proxy_backend.conf;

        index index.html index.htm;
        root /usr/share/nginx/html;
    }

    include includes/location_common.conf;

}

server {
    listen ${SSL_PORT} ssl;

    server_name ${SERVER_NAME};

    port_in_redirect off;

    ssl_certificate ${SSL_CERT_FILE};
    ssl_certificate_key ${SSL_CERT_KEY_FILE};
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    ssl_session_tickets off;

    ssl_dhparam /etc/ssl/certs/dhparam-${SSL_DH_BITS}.pem;

    ssl_protocols ${SSL_PROTOCOLS};
    ssl_ciphers ${SSL_CIPHERS};
    ssl_prefer_server_ciphers ${SSL_PREFER_CIPHERS};

    ssl_stapling ${SSL_OCSP_STAPLING};
    ssl_stapling_verify ${SSL_OCSP_STAPLING};

    ssl_verify_client ${SSL_VERIFY};
    ssl_verify_depth ${SSL_VERIFY_DEPTH};

    PROXY_SSL_CONFIG

    location / {
        client_max_body_size 0;

        include includes/cors.conf;
        include includes/proxy_backend.conf;

        index index.html index.htm;
        root /usr/share/nginx/html;
    }

    include includes/location_common.conf;
}