Harden nginx defaults
This commit is contained in:
		
							parent
							
								
									2da00f3ad5
								
							
						
					
					
						commit
						fe4a34a9e3
					
				|  | @ -20,6 +20,7 @@ | |||
|   services.nginx.virtualHosts."p.v0.io" = { | ||||
|     forceSSL = true; | ||||
|     enableACME = true; | ||||
|     root = "/srv/www/p.v0.io"; | ||||
|     extraConfig = '' | ||||
|       client_max_body_size 128M; | ||||
|     ''; | ||||
|  |  | |||
|  | @ -26,6 +26,7 @@ | |||
|   services.nginx.virtualHosts."git.v0.io" = { | ||||
|     forceSSL = true; | ||||
|     enableACME = true; | ||||
|     root = "/srv/www/git.v0.io"; | ||||
|     locations."/".proxyPass = "http://127.0.0.1:3000"; | ||||
|   }; | ||||
| } | ||||
|  |  | |||
|  | @ -21,6 +21,15 @@ in { | |||
|       recommendedOptimisation = true; | ||||
|       recommendedProxySettings = true; | ||||
|       recommendedTlsSettings = true; | ||||
| 
 | ||||
|       # Reduce the permitted size of client requests, to reduce the likelihood | ||||
|       # of buffer overflow attacks. This can be tweaked on a per-vhost basis, as | ||||
|       # needed. | ||||
|       commonHttpConfig = '' | ||||
|         client_body_buffer_size  4k;       # default: 8k | ||||
|         client_max_body_size 1k;           # default: 1m | ||||
|         large_client_header_buffers 2 4k;  # default: 4 8k | ||||
|       ''; | ||||
|     }; | ||||
|   }; | ||||
| } | ||||
|  |  | |||
		Loading…
	
		Reference in a new issue