Repository: h5bp/server-configs-nginx
Branch: main
Commit: 545e9cfa86fe
Files: 49
Total size: 106.7 KB
Directory structure:
gitextract_6tgcy6ja/
├── .editorconfig
├── .gitattributes
├── .github/
│ ├── CODEOWNERS
│ ├── CODE_OF_CONDUCT.md
│ ├── CONTRIBUTING.md
│ ├── FUNDING.yml
│ ├── dependabot.yml
│ └── workflows/
│ ├── auto-merge.yml
│ ├── lint.yml
│ └── server.yml
├── .gitignore
├── CHANGELOG.md
├── LICENSE.txt
├── README.md
├── conf.d/
│ ├── .default.conf
│ ├── no-ssl.default.conf
│ └── templates/
│ ├── example.com.conf
│ └── no-ssl.example.com.conf
├── h5bp/
│ ├── basic.conf
│ ├── cross-origin/
│ │ ├── requests.conf
│ │ └── resource_timing.conf
│ ├── errors/
│ │ └── custom_errors.conf
│ ├── location/
│ │ ├── security_file_access.conf
│ │ ├── web_performance_filename-based_cache_busting.conf
│ │ └── web_performance_svgz-compression.conf
│ ├── media_types/
│ │ ├── character_encodings.conf
│ │ └── media_types.conf
│ ├── security/
│ │ ├── content-security-policy.conf
│ │ ├── cross-origin-policy.conf
│ │ ├── permissions-policy.conf
│ │ ├── referrer-policy.conf
│ │ ├── server_software_information.conf
│ │ ├── strict-transport-security.conf
│ │ ├── x-content-type-options.conf
│ │ └── x-frame-options.conf
│ ├── tls/
│ │ ├── certificate_files.conf
│ │ ├── ocsp_stapling.conf
│ │ ├── policy_balanced.conf
│ │ ├── policy_strict.conf
│ │ └── ssl_engine.conf
│ └── web_performance/
│ ├── cache-control.conf
│ ├── cache-file-descriptors.conf
│ ├── cache_expiration.conf
│ ├── compression.conf
│ ├── content_transformation.conf
│ ├── pre-compressed_content_brotli.conf
│ └── pre-compressed_content_gzip.conf
├── mime.types
└── nginx.conf
================================================
FILE CONTENTS
================================================
================================================
FILE: .editorconfig
================================================
# For more information about the properties used in
# this file, please see the EditorConfig documentation:
# https://editorconfig.org/
root = true
[*]
charset = utf-8
end_of_line = lf
indent_size = 2
indent_style = space
insert_final_newline = true
trim_trailing_whitespace = true
[*.md]
# Markdown uses the trailing whitespaces
# https://daringfireball.net/projects/markdown/syntax#block
trim_trailing_whitespace = false
================================================
FILE: .gitattributes
================================================
# Automatically normalize line endings for all text-based files
# https://git-scm.com/docs/gitattributes#_end_of_line_conversion
* text=auto
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# Make GitHub's language statistics treat the `*.conf` files as
# Nginx configuration files
#
# https://github.com/github/linguist/blob/master/README.md
*.conf linguist-language=Nginx
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
/.git* export-ignore
/test export-ignore
================================================
FILE: .github/CODEOWNERS
================================================
# https://help.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners
* @h5bp/server-configs-nginx
================================================
FILE: .github/CODE_OF_CONDUCT.md
================================================
Please read [Code of Conduct for H5BP](https://github.com/h5bp/html5-boilerplate/blob/master/.github/CODE_OF_CONDUCT.md)
================================================
FILE: .github/CONTRIBUTING.md
================================================
# Contributing to Nginx Server Configs
♥ [Nginx Server Configs](https://github.com/h5bp/server-configs-nginx) and
want to get involved? Thanks! We're actively looking for folks interested in
helping out and there are plenty of ways you can help!
Please take a moment to review this document in order to make the contribution
process easy and effective for everyone involved.
Following these guidelines helps to communicate that you respect the time of
the developers managing and developing this open-source project. In return,
they should reciprocate that respect in addressing your issue or assessing
patches and features.
## Using the issue tracker
The [issue tracker](https://github.com/h5bp/server-configs-nginx/issues) is
the preferred channel for [bug reports](#bugs), [features requests](#features)
and [submitting pull requests](#pull-requests), but please respect the following
restrictions:
* Please **do not** use the issue tracker for personal support requests (use
[Stack Overflow](https://stackoverflow.com) or IRC).
* Please **do not** derail or troll issues. Keep the discussion on topic and
respect the opinions of others.
<a name="bugs"></a>
## Bug reports
A bug is a _demonstrable problem_ that is caused by the code in the repository.
Good bug reports are extremely helpful - thank you!
Guidelines for bug reports:
1. **Use the GitHub issue search** — check if the issue has already been
reported.
2. **Check if the issue has been fixed** — try to reproduce it using the
latest `main` or development branch in the repository.
3. **Isolate the problem** — ideally, create a [reduced test
case](https://css-tricks.com/reduced-test-cases/) and a live example.
A good bug report shouldn't leave others needing to chase you up for more
information. Please try to be as detailed as possible in your report. What is
your environment? What steps will reproduce the issue? What version of Nginx
experiences the problem? What would you expect to be the outcome? All these
details will help people to fix any potential bugs.
Example:
> Short and descriptive example bug report title
>
> A summary of the issue and server version / OS / browser environment in which
> it occurs. If suitable, include the steps required to reproduce the bug.
>
> 1. This is the first step
> 2. This is the second step
> 3. Further steps, etc.
>
> `<url>` - a link to the reduced test case
>
> Any other information you want to share that is relevant to the issue being
> reported. This might include the lines of code that you have identified as
> causing the bug, and potential solutions (and your opinions on their merits).
<a name="features"></a>
## Feature requests
Feature requests are welcome. But take a moment to find out whether your idea
fits with the scope and aims of the project. It's up to *you* to make a strong
case to convince the project's developers of the merits of this feature. Please
provide as much detail and context as possible.
<a name="pull-requests"></a>
## Pull requests
Good pull requests - patches, improvements, new features - are a fantastic
help. They should remain focused in scope and avoid containing unrelated
commits.
**Please ask first** before embarking on any significant pull request (e.g.
implementing features, refactoring code), otherwise you risk spending a lot of
time working on something that the project's developers might not want to merge
into the project.
Please adhere to the coding conventions used throughout a project (indentation,
accurate comments, etc.) and any other requirements (such as test coverage).
Adhering to the following process is the best way to get your work
included in the project:
1. [Fork](https://help.github.com/en/github/getting-started-with-github/fork-a-repo) the project, clone your
fork, and configure the remotes:
```bash
# Clone your fork of the repo into the current directory
git clone https://github.com/<your-username>/server-configs-nginx.git
# Navigate to the newly cloned directory
cd server-configs-nginx
# Assign the original repo to a remote called "upstream"
git remote add upstream https://github.com/h5bp/server-configs-nginx
```
2. If you cloned a while ago, get the latest changes from upstream:
```bash
git checkout main
git pull upstream main
```
3. Create a new topic branch (off the main project development branch) to
contain your feature, change, or fix:
```bash
git checkout -b <topic-branch-name>
```
4. Commit your changes in logical chunks. Please adhere to these [git commit
message guidelines](https://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html)
or your code is unlikely to be merged into the main project. Use Git's
[interactive rebase](https://help.github.com/en/github/using-git/about-git-rebase)
feature to tidy up your commits before making them public.
5. Locally merge (or rebase) the upstream development branch into your topic branch:
```bash
git pull [--rebase] upstream main
```
6. Push your topic branch up to your fork:
```bash
git push origin <topic-branch-name>
```
7. [Open a Pull Request](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/about-pull-requests)
with a clear title and description.
**IMPORTANT**: By submitting a patch, you agree to allow the project
owners to license your work under the terms of the [MIT License](../LICENSE.txt).
================================================
FILE: .github/FUNDING.yml
================================================
# These are supported funding model platforms
github: [LeoColomb]
patreon: # Replace with a single Patreon username
open_collective: #
ko_fi: # Replace with a single Ko-fi username
tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
custom: # Replace with a single custom sponsorship URL
================================================
FILE: .github/dependabot.yml
================================================
version: 2
updates:
- package-ecosystem: github-actions
directory: "/"
schedule:
interval: daily
================================================
FILE: .github/workflows/auto-merge.yml
================================================
# https://docs.github.com/actions
name: Auto-merge
on: pull_request_target
permissions:
pull-requests: write
contents: write
jobs:
dependabot:
name: Dependabot
runs-on: ubuntu-latest
if: ${{ github.actor == 'dependabot[bot]' }}
steps:
- name: Dependabot metadata
id: dependabot-metadata
uses: dependabot/fetch-metadata@v2.5.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
- name: Approve a PR
if: steps.dependabot-metadata.outputs.update-type != 'version-update:semver-major'
run: gh pr review --approve "$PR_URL"
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Enable auto-merge for Dependabot PRs
run: gh pr merge --auto --rebase "$PR_URL"
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
================================================
FILE: .github/workflows/lint.yml
================================================
# https://docs.github.com/actions
name: Lint
on: [push, pull_request]
jobs:
check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: Lint configuration using Gixy
uses: docker://yandex/gixy:latest
with:
args: /github/workspace/nginx.conf
================================================
FILE: .github/workflows/server.yml
================================================
# https://docs.github.com/actions
name: Server CI
on: [push, pull_request]
jobs:
check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: Check configuration
uses: docker://nginx:latest
with:
entrypoint: nginx
args: -c /github/workspace/nginx.conf -t
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: Install k6
uses: grafana/setup-k6-action@v1
- name: Test with server-configs-test
uses: h5bp/server-configs-test@8.2.3
with:
command: test
server: nginx
root-path: /var/www/server.localhost
certs-path: /etc/nginx/certs
configs-volumes: test/vhosts:/etc/nginx/conf.d;h5bp:/etc/nginx/h5bp;nginx.conf:/etc/nginx/nginx.conf;mime.types:/etc/nginx/mime.types
tests: basic-file-access;caching;cache-busting;custom-errors;forbidden-files;precompressed-files-gzip;rewrites;ssl
- name: Benchmark
uses: h5bp/server-configs-test@8.2.3
with:
command: benchmark
server: nginx
root-path: /var/www/server.localhost
certs-path: /etc/nginx/certs
configs-volumes: test/vhosts:/etc/nginx/conf.d;h5bp:/etc/nginx/h5bp;nginx.conf:/etc/nginx/nginx.conf;mime.types:/etc/nginx/mime.types
================================================
FILE: .gitignore
================================================
logs/
conf.d/*.conf
!conf.d/.default.conf
!conf.d/no-ssl.default.conf
test/*
!test/vhosts/
================================================
FILE: CHANGELOG.md
================================================
### 5.0.1 (July 23, 2023)
* Set `ssl_prefer_server_ciphers` to `off`
[https://github.com/h5bp/server-configs-nginx/pull/328]
* Add `browsing-topics` to `Permissions-Policy` header
[https://github.com/h5bp/server-configs-nginx/pull/323]
* Improve README docs
[https://github.com/h5bp/server-configs-nginx/pull/333]
* Improve inline comments
### 5.0.0 (December 05, 2022)
* 🎉 Significant improvement on `Cache-Control` definition and usage
* `Cache-Control` boilerplate with extensive control
[https://github.com/h5bp/server-configs-nginx/pull/319]
* Switch to a proper `no-cache` directive on cache expiration config
[https://github.com/h5bp/server-configs-nginx/pull/314]
* Reorder and improve cache expiration `expires` map
[https://github.com/h5bp/server-configs-nginx/pull/324]
* Drop `image/avif-sequence` MIME-type
[[4bc5275](https://github.com/h5bp/server-configs-nginx/commit/4bc5275d5a3fdb34e6298240db7215c3270a916e)]
* Improve inline comments.
### 4.2.0 (February 24, 2022)
* Extend media, font and default cache TTL to 1 year
[[4a22965](https://github.com/h5bp/server-configs-nginx/commit/4a229657fdad9c039529314aed0fc0ae17480829)]
[[3869706](https://github.com/h5bp/server-configs-nginx/commit/3869706922bf4897d20c5cc35817a1a4107d7623)]
* Add compression support for `.ico` files
[[537a022](https://github.com/h5bp/server-configs-nginx/commit/537a0229a1bfa89ebc983aa0d78b62cb6998a997)]
* Dropped legacy and non web related file types
[[a961768](https://github.com/h5bp/server-configs-nginx/commit/a9617688fc921e728d5dcd044db9327aa50ede79)]
[[175cc52](https://github.com/h5bp/server-configs-nginx/commit/175cc52e3fbd75628021df55f61f25cadca8e45c)]
### 4.1.0 (October 28, 2021)
* Add support for custom values import
[[fbdaa3f](https://github.com/h5bp/server-configs-nginx/commit/fbdaa3f867f3c8e1926df6bfe5943bfe57926ef5)]
### 4.0.0 (July 31, 2021)
* ⚠️ **Breaking**: End of support for Internet Explorer (`X-UA-Compatible` and `X-XSS-Protection` headers)
[[4556277](https://github.com/h5bp/server-configs-nginx/commit/4556277ced27fdb96874bf14d3ffe59925c7fc41)]
[[836467c](https://github.com/h5bp/server-configs-nginx/commit/836467c8b57ab6788745c441fb31046ca11384e3)]
* 🎉 Security first! Modernize TLS configuration
[[688348a](https://github.com/h5bp/server-configs-nginx/commit/688348a5fd991fcbe1a535e51056c420a81c9ae7)]
* 🎉 Security first! Refresh policies-related headers usage
* Add Cross Origin Policies headers (COOP/COEP/CORP)
[[25a569d](https://github.com/h5bp/server-configs-nginx/commit/25a569d97d9634497498a4a387f1784269d998bb)]
* Add `Permissions-Policy` header
[[36310b9](https://github.com/h5bp/server-configs-nginx/commit/36310b927b167ef8561dc6407ab9707038b804c7)]
* Make `Content-Security-Policy` disallow 'object-src' by default
[[8600df1](https://github.com/h5bp/server-configs-nginx/commit/8600df101823e9fe71e4b13a4dfa4009726929b4)]
* Add mime-type `image/jxl`
[[b9ef881](https://github.com/h5bp/server-configs-nginx/commit/b9ef881d62311ff7b2555472135529d07483bab6)]
* Improve inline comments.
### 3.3.0 (January 6, 2021)
* Add mime-type `image/avif` and `image/avifs`
[[a9aea70](https://github.com/h5bp/server-configs-nginx/commit/a9aea7038cc3c672eea0794e8af1640fd01ebc99)]
* Add mime-type `image/apng`
[[ba4967f](https://github.com/h5bp/server-configs-nginx/commit/ba4967f99ea655cdf150b56b06ed390a79b555fc)]
* Improve inline comments.
### 3.2.0 (April 14, 2020)
* Stricter default for Referrer Policy `strict-origin-when-cross-origin`
[[e0724b8](https://github.com/h5bp/server-configs-nginx/commit/e0724b814952f6aee3c09dd578480c9c143955ae)]
* Revert: drop `Cache-Control: no-transform` usage
[[bc39e4c](https://github.com/h5bp/server-configs-nginx/commit/bc39e4c07d23edfc0acd3c11de88e95af5880eee)]
* Rewrite, improve and update a large part of the documentation
[[0af3052](https://github.com/h5bp/server-configs-nginx/commit/0af305283f99abfc85e4395201ffadc7de975d4b)]
[[177a5e9](https://github.com/h5bp/server-configs-nginx/commit/177a5e94a60d9c27a8831a1d63211ffe6f6a83a3)]
[[5ca3aed](https://github.com/h5bp/server-configs-nginx/commit/5ca3aed56c83a0f80c88cc85b66abf9b118557ee)]
[[bb2a30c](https://github.com/h5bp/server-configs-nginx/commit/bb2a30caccd240bab3baa511c25152117961bd09)]
[[5ca3aed](https://github.com/h5bp/server-configs-nginx/commit/5ca3aed56c83a0f80c88cc85b66abf9b118557ee)]
* Ensure the presence of security headings where expected
[[4168940](https://github.com/h5bp/server-configs-nginx/commit/41689406c87990eb8c6200a62b1baa7c1705dd31)]
[[3615dfa](https://github.com/h5bp/server-configs-nginx/commit/3615dfa351c54e724f17737643e6ecbe7836d06c)]
[[98de990](https://github.com/h5bp/server-configs-nginx/commit/98de990c1c572354fc2d3f8c7f30940e3af9cdf0)]
* Remove non-ASCII character from config files
[[d2f5972](https://github.com/h5bp/server-configs-nginx/commit/d2f597235a1d384cf1d69cb51a74c22755c0c11c)]
* Improve inline comments.
### 3.1.0 (May 19, 2019)
* Drop `Cache-Control: no-transform` usage
[[282d979](https://github.com/h5bp/server-configs-nginx/commit/282d979af40f34dccb852df9dcbecd42b899ef18)]
* Disable cache expiration for empty content-type resources
[[c73d1ef](https://github.com/h5bp/server-configs-nginx/commit/c73d1efb60e834c57c6343745415c4b58418c934)]
* Remove Content-Security-Policy from `basic.conf` includes
[[29ff09a](https://github.com/h5bp/server-configs-nginx/commit/29ff09ac950d40dd525e1b438ab2ecaf0a4be96f)]
* Improve default Content-Security-Policy values
[[276af8d](https://github.com/h5bp/server-configs-nginx/commit/276af8da7bdf7c7d3708bbe5190092194b307789)]
* Add more common DNS resolver addresses to default `resolver`
[[28874c3](https://github.com/h5bp/server-configs-nginx/commit/28874c33f0e778fc7687f5b3926590ce09e06c98)]
* Pre-compressed content usage config files
[[8db768b](https://github.com/h5bp/server-configs-nginx/commit/8db768bd61094ad814bb56b8a2a560ccc416aef0)]
* Improve inline comments.
### 3.0.1 (March 09, 2019)
* Use regexp in MIME-types based maps
[[d65cd97](https://github.com/h5bp/server-configs-nginx/commit/d65cd977618ede702f15e084cb0f4a152e204935)]
[[db1601f](https://github.com/h5bp/server-configs-nginx/commit/db1601f6064fd7d3d822618cf2e069a6b0cb8e9f)]
* Fix SVGZ compression handling
[[cec616a](https://github.com/h5bp/server-configs-nginx/commit/cec616a103345ccef418a16549adee60f650cf52)]
* Add Referrer-Policy for html document by default
[[f600128](https://github.com/h5bp/server-configs-nginx/commit/f600128203e6319d6f3ce02e2538bf65b0ed01ea)]
### 3.0.0 (February 12, 2019)
* ⚠️ **Breaking**: Drop support for Nginx version < 1.8.0
[[1f5d635](https://github.com/h5bp/server-configs-nginx/commit/1f5d6359be53e90b634ea0451b121cfbeffa4b63)]
* ⚠️ **Breaking**: Switch from `sites-enabled`/`available` to `conf.d`
[[306af36](https://github.com/h5bp/server-configs-nginx/commit/306af367e97a5f177b8bc479cef416fef2508732)]
* ⚠️ **Breaking**: Refactor `h5bp/` directives to strict atomic structure
[[496af1c](https://github.com/h5bp/server-configs-nginx/commit/496af1cfd535d472d8bbd2db0a322f988803741b)]
[[2d13505](https://github.com/h5bp/server-configs-nginx/commit/2d135053cbd96e1e74884e4395c3163b8a39602f)]
* ⚠️ **Breaking**: Refactor and modernize TLS/SSL directives
[[1b2b4eb...d2531ac](https://github.com/h5bp/server-configs-nginx/compare/1b2b4eb...d2531ac)]
* ⚠️ **Breaking**: Move common header directives from location directives to mapped values based on MIME-types
[[6dd4cc2](https://github.com/h5bp/server-configs-nginx/commit/6dd4cc27edafc26e73d8998ab146235774d4abdc)]
* 🎉 Tests! Add tests and configure continuous integration to help community contributions
[[52e1353](https://github.com/h5bp/server-configs-nginx/commit/52e13535b46ca862d1a51d083d7696eb964fe82b)]
* Replace location block `add_header` directives with `expires` directives
[[135d093](https://github.com/h5bp/server-configs-nginx/commit/135d093a7505a72810156760b23b1f03e18c8b0a)]
* Support hashed asset names
[[1b2b4eb](https://github.com/h5bp/server-configs-nginx/commit/1b2b4eb2766e3be99f30c65c86c265fc07edcdad)]
* Update many values in MIME-types table
[[62dbd41](https://github.com/h5bp/server-configs-nginx/commit/62dbd41aeefb063be761741098a2584f1019f586)]
[[08272b6](https://github.com/h5bp/server-configs-nginx/commit/08272b63c2c9d0f875480a62caa615fe20387ad7)]
[[9c6aad8](https://github.com/h5bp/server-configs-nginx/commit/9c6aad83a509cb9dc72cacf17a54281326dd9ca9)]
[[b244111](https://github.com/h5bp/server-configs-nginx/commit/b244111468ce69218acad08ccc4b79c43f88c8c9)]
[[94262e7](https://github.com/h5bp/server-configs-nginx/commit/94262e76103a2f69d3f66b4e92c0c0ebb3cd486b)]
[[b244111](https://github.com/h5bp/server-configs-nginx/commit/b244111468ce69218acad08ccc4b79c43f88c8c9)]
[[fe7ff95](https://github.com/h5bp/server-configs-nginx/commit/fe7ff95a7fc96315a9022f4d02c11e6264b1bb1c)]
* Remove outdated `inline` script
[[8a4a1ce](https://github.com/h5bp/server-configs-nginx/commit/8a4a1ce706eb90d820f6a2ccaa23f5f55e6c056e)]
* Improve inline comments and review documentation.
### 2.0.0 (2017-05-06)
- V2.0.0. [AD7six]
- Add defaults to all directives in nginx.conf. [Andy Dawson]
The reason most of these are changed is already covered by the existing
doc block
closes #127
- Updated gzip_types and charset_types. [Tobias Reich]
… both are now using the same coding convention. Each type in its own row and `text/html` comment at the top (where all comments are placed).
- Added mime types for JPEG-XR, markdown, and CSV. [JoeArizona]
JPEG-XR: http://www.iana.org/assignments/provisional-standard-media-types/provisional-standard-media-types.xhtml
Markdown: https://tools.ietf.org/html/rfc7763
CSV: https://tools.ietf.org/html/rfc7111
- Removed SPDY support as we're using HTTP/2 now. Ref: df102c6.
[Pentago]
- Don't need that expires. [Andy Dawson]
- Remove cache-control public and better handle svgz files. [Matthew
Miller]
Fixes: #86
Fixes: #134
- Don't use expire headers in doc examples. [Andy Dawson]
- Use Cache-Control max-age instead of Expires headers. [Alan Orth]
Cache-Control max-age was introduced in HTTP/1.1 over ten years ago
and is preferred to Expires. This replaces all expiry dates with an
equivalent max-age in seconds.
See: https://developers.google.com/web/fundamentals/performance/optimizing-content-efficiency/http-caching
See: https://www.mnot.net/blog/2007/05/15/expires_max-age
- Remove references to Cache-Control public. [Alan Orth]
A previous commit removed some, but missed these. Where a location
directive was using Expires to set a future expiry in conjunction
with Cache-Control public, I have replaced the time with an equal
max-age.
Furthermore, Google's web performance guide says that "public" is
implicit if there is a max-age specified.
See: https://developers.google.com/web/fundamentals/performance/optimizing-content-efficiency/http-caching
- Enable IPv6 for no-default. [Johannes Müller]
- Remove Unnecessary Trailing Semicolon. [0ri0n]
No need to add a semicolon for the last directive. In addition, having that unnecessary semicolon causes the HSTS tool (https://hstspreload.org/) for getting on the preload list to fail with an error about the semicolon.
- Update ssl_ciphers To Latest Mozilla Intermediate. [0ri0n]
Updates to latest ciphers list for Mozilla Intermediate, which also adds support for ChaCha20 and Poly1305.
- Always add security-relevant headers to the response, regardless of
the response code (implements #147) [Leon Klingele]
From nginx' add_header documentation:
```
add_header Adds the specified field to a response header provided that
the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307.
```
At least for all security-relevant headers this should not be the case
and the header should always be added.
- Gitignore already tracked. [Edgar Ribeiro]
- Ignore files in sites-enabled. [Edgar Ribeiro]
- Fix missing ; [Edgar Ribeiro]
- Fixed #143 issue: Fix typo. [Bo-Yi Wu]
- Whitespace. [Andy Dawson]
- Add a failing example. [Andy Dawson]
- Show a successful example. [Andy Dawson]
- Now irrelevant. [Andy Dawson]
- Remove access log for probably-not-static files. [Andy Dawson]
closes #131
- Remove cache-control public. [Andy Dawson]
Closes #134
- Preload added to ssl.conf. [root]
- Add an ssl no-default example. [Andy Dawson]
I.e. an example of this:
-> curl -kI -H "Host: valid.com" https://localhost
HTTP/1.1 200 OK
...
-> curl -kI -H "Host: invalid.com" https://localhost
curl: (52) Empty reply from server
Whether this works or not depends on SNI.
- Updated ssl.exemple.com to use http2 instead of spdy. [Buzut]
http2 is available in nginx since nginx 1.9.5. Therefor it's better to use the standard.
- Documentation inconsistent with file structure. [Edward Granger]
- Fix capitalization of includeSubDomains. [Chris Chapman]
- Correct syntax for keepalive_timeout. [Alan Orth]
It doesn't seem to be a fatal error, but the keepalive_timeout
value actually requires "s" (for seconds). Another occurrence of
this was fixed in 35434b3361b04beb028f602c78a9331ef4967a0d but
these slipped through.
See: http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout
Signed-off-by: Alan Orth <alan.orth@gmail.com>
- Fix typo. [Craig Davison]
- Improve comments in nginx.conf. [Craig Davison]
- Single capitalization fix. [Corban Mailloux]
- Change default value in comment. [Craig Davison]
- Specify that keepalive_timeout is in seconds. [Craig Davison]
- Fix format. [Bo-Yi Wu]
Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com>
- Update nginx.conf. [beilharz]
Typo: sites-available should be sites-enabled
- Add white space for comment. [Bo-Yi Wu]
- Miiiiiiiiiiiiiinor typo fix. [Francisc Romano]
- Updated locations to match h5bp's Apache config. [Kimmo Salmela]
See https://github.com/h5bp/server-configs-apache/issues/31 for `well-known` change.
- Update media types in `nginx.conf` [Philipp Becker]
- Minor extension of the alphabetical sorting of media types. [Philipp
Becker]
- Added FreeBSD w/ ZFS performance instructions. [Goran]
On FreeBSD systems with ZFS, sendfile() is useless as ZFS's caching subsystem (adaptive replacement cache a.k.a ARC) already caches most frequently used files in RAM. Disabling sendfile() avoids redundant data caching.
References:
https://calomel.org/nginx.html
http://blog.vx.sk/uploads/conferences/EuroBSDcon2012/zfs-tuning-handout.pdf
- Update to mozilla's wiki's current intermediate set. [AD7six]
- Fix #113. [St. Isidore de Seville]
- Add an inline documentation link to the sites-enabled documentation
page. [Eric Andrew Lewis]
- Explain why everything in the sites-enabled folder is included. [Eric
Lewis]
- Fix misspelling. [Jeff Widman]
- Fix mispelling. [Jeff Widman]
- Fix typo. [Jeff Widman]
- Don't use invalid examples. [Andy Dawson]
A wildcard subdomain isn't valid syntax for a ACAO header
- Added 'dataready' accept_filter for SSL servers on FreeBSD hosts as
per 'accept_filter=filter' section of
http://nginx.org/en/docs/http/ngx_http_core_module.html#listen.
[Pentago]
More on FreeBSD's accept filters:
http://www.freebsd.org/cgi/man.cgi?accf_http
http://www.freebsd.org/cgi/man.cgi?accf_data
Also added 'defered' (TCP_DEFER_ACCEPT) socket option to SSL server on Linux hosts and organized/commented both platform directives above the default value.
Related to https://github.com/h5bp/server-configs-nginx/blob/master/sites-available/example.com#L19
- Fix typo in `inline.sh` [Luke Brookhart]
`h5bp/basics.conf` => `h5bp/basic.conf`
Close #97
- Update `CHANGELOG.md` [Cătălin Mariș]
- Map `.manifest` → `text/cache-manifest` media type. [Cătălin Mariș]
The specification for the manifest file for web applications was
recently updated¹ and it changed one of the recommended file extensions
from `.manifest` to the unique `.webmanifest`².
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
¹ https://github.com/w3c/manifest/commit/0eecadd09074746a657d806131a39e2f7bdc962f
² https://github.com/w3c/manifest/issues/346
- Remove vcf → text/x-vcard mapping from mime.types. [Cătălin Mariș]
Ref: http://www.iana.org/assignments/media-types/text/vcard
Fix h5bp/server-configs-nginx#92
- README.md: Make minor improvements. [Cătălin Mariș]
- Update `CHANGELOG.md` [Cătălin Mariș]
- Update the list of resources to be compressed. [Cătălin Mariș]
Ref: https://github.com/h5bp/server-configs-apache/blob/a0c4e1719075bf1d97d92a3b0ad225c7bff5dfab/src/web_performance/compression.conf
- Update `mime.types` [Cătălin Mariș]
* Reorganized media types and order them alphabetically
* Include some new media types in order to align with what is provided
by the Apache configurations.
https://github.com/h5bp/server-configs-apache/blob/c805353c4142c792267945687309259fc15b2106/src/media_types/media_types.conf
- Update `CHANGELOG.md` [Cătălin Mariș]
- Remove the .manifest → text/cache-manifest mapping. [Cătălin Mariș]
Four years ago the recommended file extension for AppCache manifest
files was changed¹ from `.manifest` to `.appcache`. So, even adding
into consideration the transitional period, it no longer makes sense
to keep the configurations that ensure that `.manifest` files are
served with the AppCache required `text/cache-manifest` media type.
Also, recently, `.manifest` became one of the recommended file
extensions for web application manifest² files.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
¹ https://html5.org/r/5812
² http://w3c.github.io/manifest/
- Rename `LICENSE.md` to `LICENSE.txt` [Cătălin Mariș]
Change made so that the process of opening the `LICENSE` file is
easier for non-technical people.
- Change media types for `.atom` and `.rss` files. [Sylvain Emery]
Modify the configurations so that:
* `.atom` files are served with the `application/atom+xml`¹ media type
* `.rss` files are served with the `application/rss+xml`² media type
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
¹ https://www.iana.org/assignments/media-types/application/atom+xml
² http://tools.ietf.org/id/draft-nottingham-rss-media-type-00.txt
Ref: https://github.com/h5bp/server-configs-apache/pull/50#issuecomment-76552855
https://github.com/h5bp/server-configs-apache/commit/653c461c35a982e757fa94ddd73088f2581a88f9
Close h5bp/server-configs-nginx#90
- Dropping the eggs. [Pedro de Carvalho]
removed the blah blah and link to documentation.
- Calling reload nginx by the system scripts. [Pedro de Carvalho]
- Update getting-started.md. [Pedro de Carvalho]
- Added the -s flag to the reload command. [Pedro de Carvalho]
The nginx documentation advises on using the -s signal to reload configuration.
- Spacing words. [Pedro de Carvalho]
- Add MIME-Types for .xsl files. [Steffen Weber]
The correct MIME-Type for XSL files is "application/xslt+xml" according to http://www.w3.org/TR/2007/REC-xslt20-20070123/#media-type-registration.
- Add the Mozilla SSL config generator to related projects. [Roland
Warmerdam]
- Fix minor typos and the capitalization of acronyms. [Drew Hammond]
Close h5bp/server-configs-nginx#83
- Fix typo in `expires.conf` [Joey Geiger]
Close h5bp/server-configs-nginx#82.
- Remove include directive in ssl.example.com. [Philipp Becker]
To include the SSL related directives in the port 80 server block seems to be redundant.
Because we are redirecting explicit all incoming traffic via port 80 to the HTTPS host on
port 443 where only the *secure-connection-magic* is happen.
Maybe I am missing something, but I tested the configuration
under the following system and encountered no negative side effects:
**Server**
* Ubuntu 14.04 LTS
* Nginx 1.7.7 mainline
**Client**
* OS X 10.9.5
* Browser: FF 33, Chrome 38, Safari 7
- Update extra-security.conf. [Chris McKee]
- Extra security headers without a home. [Chris McKee]
- Change note / add missing header. [Chris McKee]
- Avoid long lines. [Andy Dawson]
- Add secondary google dns ip and 2 failover DYN DNS public dns ips, and
timeouts. [Chris McKee]
- Update Cipher list to latest add version of STS. [Chris McKee]
Updated latest "intermediate" ciphers from mozilla
Add another version of the STS header including subdomains and comments
Add note at base to consider ssl-stapling
- Move SVG media type into the "Images" group. [Steffen Weber]
SVG is primarily an image format. Its usage as a font format is a
legacy issue for supporting iOS 3 and iOS 4. In Chrome 38, support
for SVG fonts has been removed (http://caniuse.com/#feat=svg-fonts).
They have never been supported in Firefox or IE.
Close h5bp/server-configs-nginx#74
- MIME-Types: support for .opus files. [Steffen Weber]
http://en.wikipedia.org/wiki/Opus_(audio_format)
- Bump the minimum version requirement to 1.6.0. [AD7six]
using the version shipped with debian stable (which is where 1.2.1 came
from) holds back this repository too much.
- Correct bad link. [Andy Dawson]
### 1.0.0 (2014-10-24)
- V1.0.0. [AD7six]
- Add a header doc block. [AD7six]
- Add some structure to this bash script. [AD7six]
Add help usage and examples. Some structural hints taken from
http://linuxcommand.org/html_text/new_script.README.html
- Add very simple debugging script. [AD7six]
this script converts include statements to dump the included file's
contents inline.
- Add a brief description of h5bp's contents. [AD7six]
- Add doc files for sites-enabled|available. [AD7six]
- Add info on ngx_pagespeed & content transformation. [Cătălin Mariș]
Provide information about `ngx_pagespeed` not rewriting any / some
of the resources if the `Cache-Control: no-transform` response header
is set.
Ref: https://developers.google.com/speed/pagespeed/module/configuration#notransform
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Thanks to @Nikita-S-Doroshenko for pointing this out!
Ref: h5bp/server-configs-apache#46
- Whitespace matters. [AD7six]
- Add hotlink protection example. [AD7six]
closes #7
- Better wording. [AD7six]
- Correct typo. [AD7six]
- Mention try_files in server context gotcha. [AD7six]
- Dynamically handling request which match a location block. [AD7six]
- Add a document explaining request handling. [AD7six]
it's not exactly the same as one might expect
- Add a document (stub) for common problems. [AD7six]
fixes #29
- Add nginx-conf-md to the toc. [AD7six]
- Add a description of nginx.conf. [AD7six]
it's not intended to be complete, merely guide users unfamiliar with
nginx.
fixes #39
- Remove quotes from SSL cipher list. [Mike Almond]
- Add note about POODLE attack against SSLv3. [Mike Almond]
- Update SSL ciphers to the updated defaults by Mozilla. [Mike Almond]
- HSTS off by default. [Daniel Marquard]
Consensus to disable HSTS by default.
- Removed "includeSubDomains" [Daniel Marquard]
As a best practice, Nginx should only direct clients to use the certificate on specified domains. This is because not all servers using other subdomains necessarily listen on 443 and because, unless it is a wildcard certificate, it likely won't be valid on subdomains other than WWW.
- IPv6 only is the default. [Jack Wearden]
- IPv6 only is the default. [Jack Wearden]
- IPv6 support. [Jack Wearden]
- IPv6 support. [Jack Wearden]
- Use a more conventional location for sites. [AD7six]
it's more common (at least IME) to use /var/www/example.com rather than
creating a new root folder `sites` to put apps in.
- Fix typo in `getting-started.md` [Philipp Becker]
User and group name should be separated by a space character.
Otherwise, only one value `www-data-www-data` is passed:
"If group is omitted, a group whose name equals that of user is used."
- Add configs for WOFF 2.0 font files (`.woff2`) [Przemek Matylla]
Ref: http://www.w3.org/TR/WOFF2/
h5bp/server-configs-apache#32
Close: h5bp/server-configs-nginx#54
- Remove Chrome Frame related comment. [Matthew Haughton]
Fix h5bp/server-configs-nginx#30
Close h5bp/server-configs-nginx#62
- Use relative path for mime.types. [Vladimir Sazhin]
- Remove gzip_http_version parameter. [Drew Hammond]
The gzip_http_version override is no longer needed because CloudFront
now forwards requests using HTTP/1.1. We can remove this line entirely
and let nginx use its default value of 1.1.
- Fix 'directive' typo. [Joshua Gigg]
Spotted by @honi in #51
- Add missing semicolons in `ssl.example.com` [Cătălin Mariș]
Close h5bp/server-configs-nginx#52.
- Use a much longer ssl_session_timeout. [AD7six]
To match the settings from istlsfastyet.com
Add a mention of ssl_buffer_size even though it can 't be enabled yet
- Add ssl example site. [AD7six]
ensure to avoid any use of if as that's "extremely inefficient" and
eliminate redirects where possible
- Don't include ssl config by default. [AD7six]
If the server has no ssl config - there's no need to load a config file
full of ssl config
- Disable ssl_session_tickets. [AD7six]
it's only recently added so is a config error otherwise
- Add stubs for ssl-stapling and spdy. [AD7six]
- Default to use HTTP strict transport security. [AD7six]
- Add increased ssl timeout. [AD7six]
- Turn off ssl session tickets. [AD7six]
Stolen from istlsfastyet.com's config
It is probably a more logical default to turn off session tickets
given the diff linked in the comment block.
- Remove SSLv3 from the ssl protocol list. [AD7six]
As suggested in #44, and since h5bp doesn't support IE6 it seems to be
appropriate to remove a protocol which is in the list only to permit use
with IE6.
- Move ssl config to a separate file. [AD7six]
- Remove tcp_nodelay. [AD7six]
The Nagle buffering algorithm is apparently that the best thing
to enable by default.
closes #28
- Fix typo, Update/Add Nginx Command to test a particular config file,
Update Restart Command & Comments. [Syed I.R]
- Format README, Add Verify Config & Restart Nginx Command. [Syed I.R]
- Fix typo. [Marvin Roger]
Close h5bp/server-configs-nginx#48.
- Make minor format related improvement in README.md. [Syed I.R]
- Apply cross-domain changes proposed in #23. [AD7six]
closes #23
- Added missing semicolon, removed text/html charset. [Odontopera
Mediochrea]
I believe the error was because text/html is implied by default.
- Fix charset_types as mime.types is updated. [Tsz Ming WONG]
- Correct link to documentation. [Andy Dawson]
- Update README.md. [Markus Amalthea Magnuson]
- Fix broken documentation link. [Markus Amalthea Magnuson]
The documentation link in the README is broken. It can be fixed either by changing "blob" to "tree", or by linking to the table of contents. This fix opts for the latter.
- Ssl_ciphers update. [Chris McKee]
Updated ciphers to provide forwarding secrecy, a wider range of support and to match those provided by Mozilla security https://wiki.mozilla.org/Security/Server_Side_TLS#Nginx
- Fix spelling errors in nginx config docs. [Peter Kowalczyk]
- Remove Chrome Frame meta tag. Reference h5bp/server-configs-nginx#2.
[Bo-Yi Wu]
- Renamed h5bp.conf to basic.conf README. [Syed I.R]
Updated with correct filename.
- Update doc. [Domenico Leone Luciani]
Because nginx doesn't start without fix access_log path.
- Move config snippets around. [AD7six]
Make it more obvious which snippets are location based, and which
are just directives. Need to provide more files like basic.conf to
cover more of the common use cases.
- Create getting started doc. [AD7six]
- Adds no value, remove. [AD7six]
- Wrong dash. [AD7six]
- Get started on the documentation. [AD7six]
- Remove readme from doc folder. [AD7six]
a readme prevents navigating existing files via github
- Add a doc block to no-default. [AD7six]
and remove the default_server directive from example.com. Since this file
is likely to be the copy-and-paste file for multiple server configs,
don't mark example.com as the default.
- Add a config file for no default site. [AD7six]
fixes #10
- Rename conf folder to h5bp. [AD7six]
The name "conf" is potentially confusing as something which should be included
en masse rather than a folder of config snippets.
Closes #13
- Ensure compatibility with earlier/current versions of nginx. [AD7six]
auto was not introdued until 1.3.8 and 1.2.5.
Debian wheezy for example only comes with 1.2.1, only the next version
(in testing) will have a version of nginx which supports auto.
- Remove the sites-enabled readme. [AD7six]
this file is considered a site config file, preventing the use of the repo as is
- Typo foorbar -> foobar. [James Freeman]
- Grammar, doesn't modify code. [Corprew Reed]
- Remove `font.css` reference. [Matt Robenolt]
Close #6.
- Add configs for cursor images (`.cur`) [Oskar S. Jakieła]
Apply all the configs used for `.ico` files to `.cur` files as the two
image formats are almost identical.
The MIME type for the `.cur` file doesn't matter as browsers seem to
sniff the content. However, `image/x-icon` is specified because it's
the one usually used for `.ico` file and because it's shorter then the
other frequentlly used one (`image/vnd.microsoft.icon`), making the
header size smaller.
See also:
* http://en.wikipedia.org/wiki/ICO_%28file_format%29
* http://msdn.microsoft.com/en-us/library/windows/desktop/ms648007%28v=vs.85%29.aspx
Close: #5.
- Update CONTRIBUTING.md and LICENSE.md. [Cătălin Mariș]
Replace the Apache references with Nginx ones.
- Add MIME type for `.torrent` files. [Andrej Čremožnik]
Serve `.torrent` files with the `application/x-bittorrent` MIME type
instead of the default `application/octet-stream`. This helps improve
the user experience in some browsers (e.g.: in Firefox, the user is
offered the option to open the file with a torrent application, if
it has one installed).
Close h5bp/server-configs-nginx#4
- Don't map the .jsonp extension to the JS MIME type. [Cătălin Mariș]
Remove `.jsonp` as there isn't any convention around the JSONP MIME-type
or the `.jsonp` extension. Also, it seems that, `application/javascript`
is arguably the wrong type to use for JSONP.
Ref: broofa/node-mime#64
- Add `CHANGELOG.md` [Cătălin Mariș]
Use a `CHANGELOG.md` file to keep the project history available within
the repository, therefore, making it easier to track what has changed
since the last tagged release.
- Add `README.md` [Cătălin Mariș]
- Add MIT license. [Cătălin Mariș]
In order to remove any ambiguity, provide a proper, highly permissive
license, recognized by the Open Source Initiative (OSI).
- Add `CONTRIBUTING.md` [Cătălin Mariș]
Providing the `CONTRIBUTING.md` file allows us to take advantage
of GitHub's UI and prompt contributors to read the repository's
guidelines before creating an issue or opening a pull request:
https://github.com/blog/1184-contributing-guidelines.
The content in the `CONTRIBUTING.md` file is based on @necolas's
Issue Guidelines: https://github.com/necolas/issue-guidelines.
- Move nginx server configs to their own repository. [Cătălin Mariș]
- Move documentations into `doc` directories. [Cătălin Mariș]
- [nginx] Remove `text/html` from `gzip_types` [alrra]
Fix: h5bp/server-configs#144.
- Nginx.conf: repair broken log format (someone had swapped two
variables around, breaking the intended apache log format
compatibility) [Aitte]
Conflicts:
nginx/nginx.conf
- Update server configs. [alrra]
Update some of the server configurations to match
the ones used in the Apache hypertext access file.
- Expires.conf: add missing .htc file type. [Aitte]
- Protect-system-files.conf: clarify why people should be using it.
[Aitte]
- Cache-file-descriptors.conf: new feature which greatly speeds up
performance on very busy production sites. [Aitte]
- Nginx.conf: Add support for default SSL certificate served to clients
with old browsers. [Aitte]
- Nginx.conf: Massively speed up SSL connections by caching the sessions
for 10 minutes rather than constantly re-negotiating. [Aitte]
- Nginx.conf: protect server against the BEAST SSL attack (ref:
http://nginx.org/en/docs/http/configuring_https_servers.html) [Aitte]
- Replacing everything with more descriptive comments. [Aitte]
for people that don't know what the options do
- Nginx.conf: Make use of the "auto" directive to let nginx spawn as
many workers as there are CPU cores. [Aitte]
- Nginx.conf: Remove the gzip_buffers directive and let nginx figure it
out instead, that way it will align them to CPU cache lines for
greater performance. [Aitte]
- Protect-system-files.conf: use "deny all" for clearer intent when
blocking access. [Aitte]
- Nginx: change regex patterns to non-capturing for speedup. [Aitte]
- Don't cache .html or .htm files. [Andy Dawson]
Thanks @aitte, ref h5bp/server-configs#133
- Expires.conf: remove duplicate .ico cache headers. [Aitte]
- Change WOFF MIME type to `application/font-woff` [alrra]
The WOFF MIME Type was formally registered as `application/font-woff`:
- http://www.iana.org/assignments/media-types/application/font-woff
- One more space. [Nicolae Vartolomei]
- Code style consistency across nginx configs. [Nicolae Vartolomei]
- Port wiki docs to README's. [Nicolas Gallagher]
Move the wiki documentation into a README for each server config dir.
Make formatting improvements to the IIS documentation.
- Move .htaccess to the `server-configs` repository. [alrra]
- Update Microsoft Office Mime-Types (h5bp/server-configs#94) [Christian
Boenning]
Add mimetypes for all major MS office file types > 2003
Reference:
http://technet.microsoft.com/en-us/library/ee309278(v=office.12).aspx
- Whitespace correction. [Andy Dawson]
Make the markdown render correctly
- Update nginx/nginx.conf. [nvartolomei]
- Update gzip_disable option to match best practice. [James Aitken]
Nginx recommend to use the string ``msie6`` instead of the previously recommended regex.
The string matches the same stuff as the regex, but is faster according to their docs.
See: http://nginx.org/en/docs/http/ngx_http_gzip_module.html#gzip_disable
- Correct cache headers for webfonts. [AD7six]
Only one location match is ever executed - therefore the relevant
location match must contain all relevant rules.
cross-domain-fonts is included by default, therefore for right now add
the cache rules for these requests directly to the
cross-domain-fonts.conf file
fixes h5bp/server-configs#85
fixes h5bp/server-configs#86
Thanks to @MisterJack
- Split the default server config. [AD7six]
Make it possible to pick and mix server rules.
- Improve READMEs. [Alessandro Vendruscolo]
- Rename default.conf to example.com. [Alessandro Vendruscolo]
This should encourage users to keep the config files indexed by domain
name
- Per-site configuration, using two server blocks. [Alessandro
Vendruscolo]
- Correct syntax error. [Andy Dawson]
- Cleanup mess made doing pointless merge. [Chris McKee]
- Revert "Merge remote-tracking branch 'upstream/master' (HLBP Master
Server Configs)" [Chris McKee]
This reverts commit 19aa2e8a56ee3366feb99207aa6a43d498d92a0f, reversing
changes made to 1007c16e697790da227fab1b7ade6343be02ddb6.
- Only include conf files. [AD7six]
- Don't need this "hint" symlink. [AD7six]
there's a readme instead.
- Adding readm files to sites-available/enabled. [AD7six]
- Remove embedded config lost in merge. [AD7six]
- Use sites-available vhost style. [AD7six]
If there is only one host - this doesn't add any problems, and makes
it easier to isolate changes related to the host from that of the host
in general.
When more than one host is used, it makes things much, much simpler.
- Add `cache-control: no-transform` header. [Alessandro Vendruscolo]
- Cross-domain stuff. [Alessandro Vendruscolo]
- Security tweaks, returning 403 if needed. [Alessandro Vendruscolo]
- Add filename based cache busting. [Alessandro Vendruscolo]
- Handle www to non-www redirect. [Alessandro Vendruscolo]
A secondary `server` block has been added. It'll listen on the `www`
host and redirect to the `non-www` host.
- Encourage users to use multiple virtual hosts. [Alessandro
Vendruscolo]
- Add the MIME type for AAC audio files. [Roland Warmerdam]
- Update the nginx gzip MIME types. [Roland Warmerdam]
- Use valid font mime types in the nginx config. [Roland Warmerdam]
- Normalize whitespace. [AD7six]
make it easier to keep this file and the .htaccess file it is based upon
in sync, by using the same indent
- Syncing with latest H5BP `.htaccess` [Chris Jones]
- Add the x-web-app-manifest-json mimetype for webapp files. [James
Long]
- Fix configuration syntax. http://wiki.nginx.org/ConfigurationSyntax.
[Indrek Ardel]
- Serve .mp4 and .m4v files as `video/mp4` as per RFC 4337. [Mathias
Bynens]
Closes h5bp/html5-boilerplate#1024. See http://tools.ietf.org/html/rfc4337#section-2.
- Whoops - 1Y is not valid. [AD7six]
one year is 1y
- Apparently this is the same header as apache serves. [AD7six]
- Move all server configs into folders. [AD7six]
easier to organise. We could also possibly then simply add a README
file toeach folder rather than use wiki pages - maybe.
- Make xml application/xml. [AD7six]
- Add json. [AD7six]
- Add expire rules mimicking that of the apache config. [AD7six]
These rules are closer to the expire logic defined for apache, and also
use a none-capturing regex which will be (unnoticably) faster.
Added a comment as to why there is no default expire header defined.
- Do not set a default expire. [AD7six]
Unless your entire site is static it's inappropriate to do so - dynamic
requests will be cached by the browser unless your application code
overrides the expires which nginx is setting by default.
- Added m4a/m4v mime types. [John-Scott Atlakson]
This was recently added upstream => http://trac.nginx.org/nginx/changeset/4252/nginx
- Specify a charset. [ram]
- Use the correct MIME type for XHTML files. [Mathias Bynens]
- Add mime types from default mime.types. [James McKinney]
- Updating configs to match H5BP .htaccess defaults. [Mike Almond]
- Add mime type for .wav files. [Tinnet Coronam]
'x-wav' seems to be the standard, but could also be 'wav' or 'wave' or 'vnd.wav' according to wikipedia
- We also need application/x-javascript for google chrome. [Iurii
Ogiienko]
- Merge. i thinkkk. [Paul Irish]
- Nginx.conf Improvements/Corrections. [sean]
Don't think it makes sense to turn this off for a single worker and it's on by default.
The docs indicate that Nginx will use the best method based on the available methods
Keepalive of 5 seems very low - i've seen recommendations of 10-20
gzip_proxied was set twice
gzip_static should be off unless actually used
default is deprecated
server_name _; shouldn't be used
Shoudn't use expires in the server {} block - should be inside location {}
Extra root lines not needed
gzip_comp_level seems too low
gzip_min_length seems too high
- Added some comments to the nginx config relating to expires. [Mark
Wolfe]
- Added some comments to the nginx config relating to expires. [Mark
Wolfe]
- Specify 404 page. [Ben Hanzl]
- Image/x-icon to match our htaccess. thx badboy. [Paul Irish]
- Remove access logging for static files to save disk writes. [Graham
Weldon]
- Add to and fix typo in MIME types to be gzipped: [Paul Sarena]
Add text/x-component. It's listed in html5-boilerplate/.htaccess and is in our nginx-mime.types
Fix application/xml+rss, should be application/rss+xml
Comment indicating text/html is always compressed, so there's no need to include it
- Remove access logging for static files to save disk writes. [Graham
Weldon]
- Add to and fix typo in MIME types to be gzipped: [Paul Sarena]
Add text/x-component. It's listed in html5-boilerplate/.htaccess and is in our nginx-mime.types
Fix application/xml+rss, should be application/rss+xml
Comment indicating text/html is always compressed, so there's no need to include it
- Associate mime.types file with nginx. [Paul Irish]
- Nginx: js wasnt being gzipped. thanks poswald! fixes h5bp/server-
configs#5. [Paul Irish]
- Use the .appcache extension instead of .manifest, as per
http://html5.org/r/5812 - thx mathias. [Paul Irish]
- X-UA-Compatible for nginx. thanks mucho joshgillies. [Paul Irish]
- Adding minor note about who owns the mime.types file. [Paul Irish]
- Whats up, sweetass configurations? boom boom. [Paul Irish]
================================================
FILE: LICENSE.txt
================================================
Copyright (c) H5BP
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
of the Software, and to permit persons to whom the Software is furnished to do
so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
================================================
FILE: README.md
================================================
# [Nginx Server Configs](https://github.com/h5bp/server-configs-nginx)
[](https://github.com/h5bp/server-configs-nginx/actions/workflows/server.yml)
**Nginx Server Configs** is a collection of configuration files that can help
your server improve the website's performance and security, while also
ensuring that resources are served with the correct content-type and are
accessible, if needed, even cross-domain.
## Getting Started
Using the Nginx server configs repo directly has a few required steps to be able to work.
* [Nginx Beginners Guide](https://nginx.org/en/docs/beginners_guide.html)
* [Nginx Request Processing](https://nginx.org/en/docs/http/request_processing.html)
### Check `nginx.conf` settings
The first thing to check is that the `nginx.conf` file contains appropriate values for
your specific install.
Most specific variables are:
* `user`
* `error_log`
* `pid`
* `access_log`
### Nginx test and restart
* To verify Nginx config
```shell
nginx -t
```
* To verify Nginx config with a custom file
```shell
nginx -t -c nginx.conf
```
* To reload Nginx and apply the new config
```shell
nginx -s reload
```
### Repository structure
This repository has the following structure:
```text
./
├── conf.d/
│ ├── default.conf
│ └── templates/
├── h5bp/
│ ├── basic.conf
│ ├── location/
│ └── .../
├── custom.d/
│ └── .../
├── mime.types
└── nginx.conf
```
* **`conf.d/`**
This directory should contain all the `server` definitions.
Except if they are dot prefixed or non `.conf` extension, all files in this
directory are loaded automatically.
* **`templates` folder**
Files in this directory contain a `server` template for secure and non-secure
hosts. They are intended to be copied in the `conf.d` directory with all
`example.com` occurrences changed to the target host.
* **`h5bp/`**
This directory contains config snippets (mixins) to be included as desired.
There are two types of config files provided: individual config snippets and
combined config files which provide convenient defaults.
* **`basic.conf`**
This file loads a small subset of the rules provided by this repository to add
`expires` headers, allow cross-domain fonts and protect system files from web
access.
The `basic.conf` file includes the rules which are recommended to always be
defined.
* **`location/`**
Files in this directory contain one or more `location` directives. They are
intended to be loaded in the `server` context (or, in a nested `location` block).
* **`custom.d/`**
This directory should contain all the custom `nginx.conf` configuration.
Except if they are dot prefixed or non `.conf` extension, all files in this
folder are loaded automatically.
* **`mime.types`**
The `mime.types` file is responsible for mapping file extensions to MIME types.
* **`nginx.conf`**
The main Nginx config file.
## Usage
### As a reference
To use as reference requires no special installation steps, download/checkout the
repository to a convenient location and adapt your existing Nginx configuration
incorporating the desired functionality from this repository.
Download the [latest release archive](https://github.com/h5bp/server-configs-nginx/releases/latest).
### Directly
To use directly, replace the Nginx config directory with this repository.
For example:
```shell
nginx -s stop
cd /etc
mv nginx nginx-previous
git clone https://github.com/h5bp/server-configs-nginx.git nginx
# install-specific edits
nginx
```
### Manage sites
```bash
cd /etc/nginx/conf.d
```
* Creating a new site
```bash
cp templates/example.com.conf .actual-hostname.conf
sed -i 's/example.com/actual-hostname/g' .actual-hostname.conf
```
* Enabling a site
```bash
mv .actual-hostname.conf actual-hostname.conf
```
* Disabling a site
```bash
mv actual-hostname.conf .actual-hostname.conf
```
```bash
nginx -s reload
```
## Support
* Nginx v**1.8.0**+
## Contributing
Anyone is welcome to [contribute](.github/CONTRIBUTING.md),
however, if you decide to get involved, please take a moment to review
the [guidelines](.github/CONTRIBUTING.md):
* [Bug reports](.github/CONTRIBUTING.md#bugs)
* [Feature requests](.github/CONTRIBUTING.md#features)
* [Pull requests](.github/CONTRIBUTING.md#pull-requests)
## Acknowledgements
[Nginx Server Configs](https://github.com/h5bp/server-configs-nginx) is
only possible thanks to all the awesome
[contributors](https://github.com/h5bp/server-configs-nginx/graphs/contributors)!
## License
The code is available under the [MIT license](LICENSE.txt).
================================================
FILE: conf.d/.default.conf
================================================
# ----------------------------------------------------------------------
# | Default behavior for unknown hosts |
# ----------------------------------------------------------------------
#
# Drop requests for unknown hosts.
#
# If no default server is defined, Nginx will use the first found server.
# To prevent host header attacks, or other potential problems when an unknown
# server name is used in a request, it's recommended to drop the request
# returning 444 "No Response".
server {
listen [::]:443 ssl http2 default_server;
listen 443 ssl http2 default_server;
server_name _;
include h5bp/tls/ssl_engine.conf;
include h5bp/tls/certificate_files.conf;
include h5bp/tls/policy_balanced.conf;
return 444;
}
================================================
FILE: conf.d/no-ssl.default.conf
================================================
# ----------------------------------------------------------------------
# | Default behavior for unknown hosts |
# ----------------------------------------------------------------------
#
# Drop requests for unknown hosts.
#
# If no default server is defined, Nginx will use the first found server.
# To prevent host header attacks, or other potential problems when an unknown
# server name is used in a request, it's recommended to drop the request
# returning 444 "No Response".
#
# (1) In production, only secure hosts should be used (all `no-ssl` disabled).
# If so, redirect first ANY request to a secure connection before handling
# it, even if the host is unknown.
#
# https://observatory.mozilla.org/faq/
server {
listen [::]:80 default_server deferred;
listen 80 default_server deferred;
server_name _;
# (1)
# return 301 https://$host$request_uri;
return 444;
}
================================================
FILE: conf.d/templates/example.com.conf
================================================
# ----------------------------------------------------------------------
# | Config file for example.com host |
# ----------------------------------------------------------------------
#
# This file is a template for an Nginx server.
# This Nginx server listens for the `example.com` host and handles requests.
# Replace `example.com` with your hostname before enabling.
# Choose between www and non-www, listen on the wrong one and redirect to
# the right one.
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/#server-name-if
server {
listen [::]:443 ssl http2;
listen 443 ssl http2;
server_name www.example.com;
include h5bp/tls/ssl_engine.conf;
include h5bp/tls/certificate_files.conf;
include h5bp/tls/policy_balanced.conf;
return 301 $scheme://example.com$request_uri;
}
server {
# listen [::]:443 ssl http2 accept_filter=dataready; # for FreeBSD
# listen 443 ssl http2 accept_filter=dataready; # for FreeBSD
listen [::]:443 ssl http2;
listen 443 ssl http2;
# The host name to respond to
server_name example.com;
include h5bp/tls/ssl_engine.conf;
include h5bp/tls/certificate_files.conf;
include h5bp/tls/policy_balanced.conf;
# Path for static files
root /var/www/example.com/public;
# Custom error pages
include h5bp/errors/custom_errors.conf;
# Include the basic h5bp config set
include h5bp/basic.conf;
}
================================================
FILE: conf.d/templates/no-ssl.example.com.conf
================================================
# ----------------------------------------------------------------------
# | Config file for non-secure example.com host |
# ----------------------------------------------------------------------
#
# This file is a template for a non-secure Nginx server.
# This Nginx server listens for the `example.com` host and handles requests.
# Replace `example.com` with your hostname before enabling.
# Choose between www and non-www, listen on the wrong one and redirect to
# the right one.
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/#server-name-if
server {
listen [::]:80;
listen 80;
server_name www.example.com;
return 301 $scheme://example.com$request_uri;
}
server {
# listen [::]:80 accept_filter=httpready; # for FreeBSD
# listen 80 accept_filter=httpready; # for FreeBSD
listen [::]:80;
listen 80;
# The host name to respond to
server_name example.com;
# Path for static files
root /var/www/example.com/public;
# Custom error pages
include h5bp/errors/custom_errors.conf;
# Include the basic h5bp config set
include h5bp/basic.conf;
}
================================================
FILE: h5bp/basic.conf
================================================
# Nginx Server Configs | MIT License
# https://github.com/h5bp/server-configs-nginx
include h5bp/security/referrer-policy.conf;
include h5bp/security/x-content-type-options.conf;
include h5bp/security/x-frame-options.conf;
include h5bp/location/security_file_access.conf;
include h5bp/cross-origin/requests.conf;
================================================
FILE: h5bp/cross-origin/requests.conf
================================================
# ----------------------------------------------------------------------
# | Cross-origin requests |
# ----------------------------------------------------------------------
# Allow cross-origin requests.
#
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS
# https://enable-cors.org/
# https://www.w3.org/TR/cors/
# (!) Do not use this without understanding the consequences.
# This will permit access from any other website.
# Instead of using this file, consider using a specific rule such as
# allowing access based on (sub)domain:
#
# add_header Access-Control-Allow-Origin "subdomain.example.com";
add_header Access-Control-Allow-Origin $cors;
================================================
FILE: h5bp/cross-origin/resource_timing.conf
================================================
# ----------------------------------------------------------------------
# | Cross-origin resource timing |
# ----------------------------------------------------------------------
# Allow cross-origin access to the timing information for all resources.
#
# If a resource isn't served with a `Timing-Allow-Origin` header that would
# allow its timing information to be shared with the document, some of the
# attributes of the `PerformanceResourceTiming` object will be set to zero.
#
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Timing-Allow-Origin
# https://www.w3.org/TR/resource-timing/
# https://www.stevesouders.com/blog/2014/08/21/resource-timing-practical-tips/
add_header Timing-Allow-Origin "*";
================================================
FILE: h5bp/errors/custom_errors.conf
================================================
# ----------------------------------------------------------------------
# | Custom error messages/pages |
# ----------------------------------------------------------------------
# Customize what Nginx returns to the client in case of an error.
#
# https://nginx.org/en/docs/http/ngx_http_core_module.html#error_page
error_page 404 /404.html;
================================================
FILE: h5bp/location/security_file_access.conf
================================================
# ----------------------------------------------------------------------
# | File access |
# ----------------------------------------------------------------------
# Block access to all hidden files and directories except for the
# visible content from within the `/.well-known/` hidden directory.
#
# These types of files usually contain user preferences or the preserved state
# of a utility, and can include rather private places like, for example, the
# `.git` or `.svn` directories.
#
# The `/.well-known/` directory represents the standard (RFC 5785) path prefix
# for "well-known locations" (e.g.: `/.well-known/manifest.json`,
# `/.well-known/keybase.txt`), and therefore, access to its visible content
# should not be blocked.
#
# https://www.mnot.net/blog/2010/04/07/well-known
# https://tools.ietf.org/html/rfc5785
location ~* /\.(?!well-known\/) {
deny all;
}
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# Block access to files that can expose sensitive information.
#
# By default, block access to backup and source files that may be left by some
# text editors and can pose a security risk when anyone has access to them.
#
# https://feross.org/cmsploit/
#
# (!) Update the `location` regular expression from below to include any files
# that might end up on your production server and can expose sensitive
# information about your website. These files may include: configuration
# files, files that contain metadata about the project (e.g.: project
# dependencies, build scripts, etc.).
location ~* (?:#.*#|\.(?:bak|conf|dist|fla|in[ci]|log|orig|psd|sh|sql|sw[op])|~)$ {
deny all;
}
================================================
FILE: h5bp/location/web_performance_filename-based_cache_busting.conf
================================================
# ----------------------------------------------------------------------
# | Filename-based cache busting |
# ----------------------------------------------------------------------
# If you're not using a build process to manage your filename version revving,
# you might want to consider enabling the following directives.
#
# To understand why this is important and even a better solution than using
# something like `*.css?v231`, please see:
# https://www.stevesouders.com/blog/2008/08/23/revving-filenames-dont-use-querystring/
location ~* (.+)\.(?:\w+)\.(avifs?|bmp|css|cur|gif|ico|jpe?g|jxl|m?js|a?png|svgz?|webp|webmanifest)$ {
try_files $uri $1.$2;
}
================================================
FILE: h5bp/location/web_performance_svgz-compression.conf
================================================
# ----------------------------------------------------------------------
# | SVGZ Compression |
# ----------------------------------------------------------------------
# SVGZ files are already compressed.
# Disable gzip function for `.svgz` files.
location ~* \.svgz$ {
gzip off;
add_header Content-Encoding gzip;
include h5bp/security/x-content-type-options.conf;
include h5bp/security/content-security-policy.conf;
include h5bp/security/referrer-policy.conf;
include h5bp/security/permissions-policy.conf;
include h5bp/security/cross-origin-policy.conf;
include h5bp/cross-origin/requests.conf;
}
================================================
FILE: h5bp/media_types/character_encodings.conf
================================================
# ----------------------------------------------------------------------
# | Character encodings |
# ----------------------------------------------------------------------
# Serve all resources labeled as `text/html` or `text/plain` with the media type
# `charset` parameter set to `UTF-8`.
#
# https://nginx.org/en/docs/http/ngx_http_charset_module.html#charset
charset utf-8;
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# Update charset_types to match updated mime.types.
# `text/html` is always included by charset module.
# Default: text/html text/xml text/plain text/vnd.wap.wml application/javascript application/rss+xml
#
# https://nginx.org/en/docs/http/ngx_http_charset_module.html#charset_types
charset_types
text/css
text/plain
text/vnd.wap.wml
text/javascript
text/markdown
text/calendar
text/x-component
text/vcard
text/cache-manifest
text/vtt
application/json
application/manifest+json;
================================================
FILE: h5bp/media_types/media_types.conf
================================================
# ----------------------------------------------------------------------
# | Media types |
# ----------------------------------------------------------------------
# Serve resources with the proper media types (f.k.a. MIME types).
#
# https://www.iana.org/assignments/media-types/media-types.xhtml
# https://nginx.org/en/docs/http/ngx_http_core_module.html#types
include mime.types;
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# Default: text/plain
#
# https://nginx.org/en/docs/http/ngx_http_core_module.html#default_type
default_type application/octet-stream;
================================================
FILE: h5bp/security/content-security-policy.conf
================================================
# ----------------------------------------------------------------------
# | Content Security Policy (CSP) |
# ----------------------------------------------------------------------
# Mitigate the risk of cross-site scripting and other content-injection
# attacks.
#
# This can be done by setting a Content Security Policy which permits
# trusted sources of content for your website.
#
# There is no policy that fits all websites, you will have to modify the
# `Content-Security-Policy` directives in the example depending on your needs.
#
# To make your CSP implementation easier, you can use an online CSP header
# generator such as:
# https://report-uri.com/home/generate/
#
# It is encouraged that you validate your CSP header using a CSP validator
# such as:
# https://csp-evaluator.withgoogle.com
#
# https://www.w3.org/TR/CSP/
# https://owasp.org/www-project-secure-headers/#content-security-policy
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
# https://developers.google.com/web/fundamentals/security/csp
# https://content-security-policy.com/
add_header Content-Security-Policy $content_security_policy always;
================================================
FILE: h5bp/security/cross-origin-policy.conf
================================================
# ----------------------------------------------------------------------
# | Cross Origin Policy |
# ----------------------------------------------------------------------
# Set strict a Cross Origin Policy to mitigate information leakage.
#
# (1) Cross-Origin-Embedder-Policy prevents a document from loading any
# cross-origin resources that don’t explicitly grant the document
# permission.
# https://html.spec.whatwg.org/multipage/origin.html#coep
# https://owasp.org/www-project-secure-headers/#cross-origin-embedder-policy
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy
#
# (2) Cross-Origin-Opener-Policy allows you to ensure a top-level document does
# not share a browsing context group with cross-origin documents.
# https://html.spec.whatwg.org/multipage/origin.html#cross-origin-opener-policies
# https://owasp.org/www-project-secure-headers/#cross-origin-opener-policy
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy
#
# (3) Cross-Origin-Resource-Policy allows to define a policy that lets web
# sites and applications opt in to protection against certain requests from
# other origins, to mitigate speculative side-channel attacks.
# https://fetch.spec.whatwg.org/#cross-origin-resource-policy-header
# https://owasp.org/www-project-secure-headers/#cross-origin-resource-policy
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy
# https://resourcepolicy.fyi/
#
# To check your Cross Origin Policy, you can use an online service, such as:
# https://securityheaders.com/
# https://observatory.mozilla.org/
#
# https://web.dev/coop-coep/
# https://web.dev/why-coop-coep/
# https://web.dev/cross-origin-isolation-guide/
# https://scotthelme.co.uk/coop-and-coep/
# (1)
add_header Cross-Origin-Embedder-Policy $coep_policy always;
# (2)
add_header Cross-Origin-Opener-Policy $coop_policy always;
# (3)
add_header Cross-Origin-Resource-Policy $corp_policy always;
================================================
FILE: h5bp/security/permissions-policy.conf
================================================
# ----------------------------------------------------------------------
# | Permissions Policy |
# ----------------------------------------------------------------------
# Set a strict Permissions Policy to mitigate access to browser features.
#
# The header uses a structured syntax, and allows sites to more tightly
# restrict which origins can be granted access to features.
# The list of available features:
# https://github.com/w3c/webappsec-permissions-policy/blob/main/features.md
#
# The example policy below aims to disable all features expect synchronous
# `XMLHttpRequest` requests on the same origin.
#
# To check your Permissions Policy, you can use an online service, such as:
# https://securityheaders.com/
# https://observatory.mozilla.org/
#
# https://www.w3.org/TR/permissions-policy-1/
# https://owasp.org/www-project-secure-headers/#permissions-policy
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy
# https://scotthelme.co.uk/a-new-security-header-feature-policy/
add_header Permissions-Policy $permissions_policy always;
================================================
FILE: h5bp/security/referrer-policy.conf
================================================
# ----------------------------------------------------------------------
# | Referrer Policy |
# ----------------------------------------------------------------------
# Set a strict Referrer Policy to mitigate information leakage.
#
# (1) The `Referrer-Policy` header is included in responses for resources
# that are able to request (or navigate to) other resources.
#
# This includes the commonly used resource types:
# HTML, CSS, XML/SVG, PDF documents, scripts and workers.
#
# To prevent referrer leakage entirely, specify the `no-referrer` value
# instead. Note that the effect could impact analytics metrics negatively.
#
# To check your Referrer Policy, you can use an online service, such as:
# https://securityheaders.com/
# https://observatory.mozilla.org/
#
# https://www.w3.org/TR/referrer-policy/
# https://owasp.org/www-project-secure-headers/#referrer-policy
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
# https://scotthelme.co.uk/a-new-security-header-referrer-policy/
add_header Referrer-Policy $referrer_policy always;
================================================
FILE: h5bp/security/server_software_information.conf
================================================
# ----------------------------------------------------------------------
# | Server software information |
# ----------------------------------------------------------------------
# Prevent Nginx from sending its version number in the "Server" response header.
#
# https://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens
server_tokens off;
================================================
FILE: h5bp/security/strict-transport-security.conf
================================================
# ----------------------------------------------------------------------
# | HTTP Strict Transport Security (HSTS) |
# ----------------------------------------------------------------------
# Force client-side TLS (Transport Layer Security) redirection.
#
# If a user types `example.com` in their browser, even if the server redirects
# them to the secure version of the website, that still leaves a window of
# opportunity (the initial HTTP connection) for an attacker to downgrade or
# redirect the request.
#
# The following header ensures that a browser only connects to your server
# via HTTPS, regardless of what the users type in the browser's address bar.
#
# (!) Be aware that Strict Transport Security is not revokable and you
# must ensure being able to serve the site over HTTPS for the duration
# you've specified in the `max-age` directive. When you don't have a
# valid TLS connection anymore (e.g. due to an expired TLS certificate)
# your visitors will see a nasty error message even when attempting to
# connect over HTTP.
#
# (1) Preloading Strict Transport Security.
# To submit your site for HSTS preloading, it is required that:
# * the `includeSubDomains` directive is specified
# * the `preload` directive is specified
# * the `max-age` is specified with a value of at least 31536000 seconds
# (1 year).
# https://hstspreload.org/#deployment-recommendations
#
# https://tools.ietf.org/html/rfc6797#section-6.1
# https://owasp.org/www-project-secure-headers/#http-strict-transport-security
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
# https://www.html5rocks.com/en/tutorials/security/transport-layer-security/
# https://hstspreload.org/
add_header Strict-Transport-Security "max-age=16070400; includeSubDomains" always;
# (1) Enable your site for HSTS preload inclusion.
# add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
================================================
FILE: h5bp/security/x-content-type-options.conf
================================================
# ----------------------------------------------------------------------
# | Content Type Options |
# ----------------------------------------------------------------------
# Prevent some browsers from MIME-sniffing the response.
#
# This reduces exposure to drive-by download attacks and cross-origin data
# leaks, and should be left uncommented, especially if the server is serving
# user-uploaded content or content that could potentially be treated as
# executable by the browser.
#
# https://owasp.org/www-project-secure-headers/#x-content-type-options
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
# https://blogs.msdn.microsoft.com/ie/2008/07/02/ie8-security-part-v-comprehensive-protection/
# https://mimesniff.spec.whatwg.org/
add_header X-Content-Type-Options nosniff always;
================================================
FILE: h5bp/security/x-frame-options.conf
================================================
# ----------------------------------------------------------------------
# | Frame Options |
# ----------------------------------------------------------------------
# Protect website against clickjacking.
#
# The example below sends the `X-Frame-Options` response header with the value
# `DENY`, informing browsers not to display the content of the web page in any
# frame.
#
# This might not be the best setting for everyone. You should read about the
# other two possible values the `X-Frame-Options` header field can have:
# `SAMEORIGIN` and `ALLOW-FROM`.
# https://tools.ietf.org/html/rfc7034#section-2.1.
#
# Keep in mind that while you could send the `X-Frame-Options` header for all
# of your website's pages, this has the potential downside that it forbids even
# non-malicious framing of your content.
#
# Nonetheless, you should ensure that you send the `X-Frame-Options` header for
# all pages that allow a user to make a state-changing operation (e.g: pages
# that contain one-click purchase links, checkout or bank-transfer confirmation
# pages, pages that make permanent configuration changes, etc.).
#
# Sending the `X-Frame-Options` header can also protect your website against
# more than just clickjacking attacks.
# https://cure53.de/xfo-clickjacking.pdf.
#
# (!) The `Content-Security-Policy` header has a `frame-ancestors` directive
# which obsoletes this header for supporting browsers.
#
# https://tools.ietf.org/html/rfc7034
# https://owasp.org/www-project-secure-headers/#x-frame-options
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
# https://docs.microsoft.com/archive/blogs/ieinternals/combating-clickjacking-with-x-frame-options
add_header X-Frame-Options $x_frame_options always;
================================================
FILE: h5bp/tls/certificate_files.conf
================================================
# ----------------------------------------------------------------------
# | Certificate files |
# ----------------------------------------------------------------------
# This default SSL certificate will be served whenever the client lacks support
# for SNI (Server Name Indication).
#
# (1) Certificate and key files location
# The certificate file can contain an intermediate certificate.
#
# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate
#
# (2) Intermediate certificate location if loaded certificate (1) does not
# contain intermediate certificate when enabling OCSP stapling.
#
# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_trusted_certificate
#
# (3) CA certificate file location for client certificate authentication.
#
# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_client_certificate
# (1)
ssl_certificate /etc/nginx/certs/default.crt;
ssl_certificate_key /etc/nginx/certs/default.key;
# (2)
# ssl_trusted_certificate /path/to/ca.crt;
# (3)
# ssl_client_certificate /etc/nginx/default_ssl.crt;
================================================
FILE: h5bp/tls/ocsp_stapling.conf
================================================
# ----------------------------------------------------------------------
# | Online Certificate Status Protocol stapling |
# ----------------------------------------------------------------------
# OCSP is a lightweight, only one record to help clients verify the validity of
# the server certificate.
# OCSP stapling allows the server to send its cached OCSP record during the TLS
# handshake, without the need of 3rd party OCSP responder.
#
# https://wiki.mozilla.org/Security/Server_Side_TLS#OCSP_Stapling
# https://tools.ietf.org/html/rfc6066#section-8
# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling
#
# (1) Use Cloudflare 1.1.1.1 DNS resolver
# https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1/
#
# (2) Use Google 8.8.8.8 DNS resolver
# https://developers.google.com/speed/public-dns/docs/using
#
# (3) Use OpenDNS resolver
# https://use.opendns.com
ssl_stapling on;
ssl_stapling_verify on;
resolver
# (1)
1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]
# (2)
8.8.8.8 8.8.4.4 [2001:4860:4860::8888] [2001:4860:4860::8844]
# (3)
# 208.67.222.222 208.67.220.220 [2620:119:35::35] [2620:119:53::53]
valid=60s;
resolver_timeout 2s;
================================================
FILE: h5bp/tls/policy_balanced.conf
================================================
# ----------------------------------------------------------------------
# | SSL policy - Balanced |
# ----------------------------------------------------------------------
# For services that need to support a wide range of clients, this configuration
# is reasonably balanced.
#
# (1) The NIST curves (prime256v1, secp384r1, secp521r1) are known to be weak
# and potentially vulnerable but are required to support Microsoft Edge
# and Safari.
# https://safecurves.cr.yp.to/
#
# https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations
# https://nginx.org/en/docs/http/ngx_http_ssl_module.html
ssl_protocols TLSv1.2;
ssl_ciphers EECDH+CHACHA20:EECDH+AES;
# (1)
ssl_ecdh_curve X25519:prime256v1:secp521r1:secp384r1;
================================================
FILE: h5bp/tls/policy_strict.conf
================================================
# ----------------------------------------------------------------------
# | SSL policy - Strict |
# ----------------------------------------------------------------------
# For services that don't need backward compatibility, the parameters below
# provide the highest level of security and performance.
#
# (!) This policy enforces a strong TLS configuration, which may raise
# errors with old clients.
# If a more compatible profile is required, use the "balanced" policy.
#
# (!) TLSv1.3 and its 0-RTT feature require NGINX >=1.15.4 and OpenSSL >=1.1.1
# to be installed.
#
# (!) Don't enable `ssl_early_data` blindly! Requests sent within early data are
# subject to replay attacks.
#
# (1) The NIST curves (prime256v1, secp384r1, secp521r1) are known to be weak
# and potentially vulnerable.
#
# Add them back to the parameter `ssl_ecdh_curve` below to support
# Microsoft Edge and Safari.
#
# https://safecurves.cr.yp.to/
#
# (2) Enables TLS 1.3 0-RTT, allows for faster resumption of TLS sessions.
#
# (!) Requests sent within early data are subject to replay attacks.
# To protect against such attacks at the application layer, the
# `$ssl_early_data` variable should be used:
#
# proxy_set_header Early-Data $ssl_early_data;
#
# The application should return response code 425 "Too Early" for anything
# that could contain user supplied data.
#
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/425
#
# https://github.com/certbot/certbot/issues/6367
# https://github.com/mozilla/server-side-tls/issues/217
# https://nginx.org/en/docs/http/ngx_http_ssl_module.html
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers EECDH+CHACHA20:EECDH+AES;
# (1)
ssl_ecdh_curve X25519;
# (2)
#ssl_early_data on;
================================================
FILE: h5bp/tls/ssl_engine.conf
================================================
# ----------------------------------------------------------------------
# | SSL engine |
# ----------------------------------------------------------------------
# (1) Optimize SSL by caching session parameters for 24 hours.
# This cuts down on the number of expensive SSL handshakes.
# By enabling a cache, we tell the client to re-use the already
# negotiated state.
# Here 10m (10 MB) in ssl_session_cache is size value (not time).
# 1 MB cache can store about 4000 sessions, so we can store 40000 sessions.
#
# (2) Use a higher keepalive timeout to reduce the need for repeated handshakes
# (!) Shouldn't be done unless you serve primarily HTTPS.
# Default is 75s
#
# (3) SSL buffer size
# Set 1400 bytes to fit in one MTU.
# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_buffer_size
#
# (4) Disable session tickets
# Session tickets keys are not auto-rotated. Only a HUP / restart will do
# so and when a restart is performed the previous key is lost, which resets
# all previous sessions.
# Only enable session tickets if you set up a manual rotation mechanism.
# https://trac.nginx.org/nginx/changeset/1356a3b9692441e163b4e78be4e9f5a46c7479e9/nginx
# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_tickets
#
# (5) The TLS 1.2 and 1.3 ciphers in use in current policies are not considered
# dangerous. This directive let the client choose the one that best fits their needs.
# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers
# https://wiki.mozilla.org/Security/Server_Side_TLS
# (1)
ssl_session_timeout 24h;
ssl_session_cache shared:SSL:10m;
# (2)
keepalive_timeout 300s;
# (3)
# ssl_buffer_size 1400;
# (4)
ssl_session_tickets off;
# (5)
ssl_prefer_server_ciphers off;
================================================
FILE: h5bp/web_performance/cache-control.conf
================================================
# ----------------------------------------------------------------------
# | Cache Control |
# ----------------------------------------------------------------------
# Serve resources with appropriate cache control directives.
#
# The `Cache-Control` header field holds directives (instructions) that control
# caching in browsers and shared caches (e.g. Proxies, CDNs).
# Its use targets web performances improvement by specifying the expected
# client and network caches behaviors.
#
# The usable cache directives are listed here:
# https://www.iana.org/assignments/http-cache-directives/http-cache-directives.xml
#
# The cache directives are documented here:
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control#response_directives
#
# (!) Enable and configure this configuration with care.
# Default values should embrace conformance for static files and simple
# apps, but cache control definition at backend level is highly preferred.
# Incorrect directives can lead to data leaks, or can degrade performances.
#
# More specifically, in-depth understanding on `public` vs `private`
# directives meanings is highly recommended. A resource with `public` will
# be cached by shared caches like CDN, even if a user session is active.
#
# (*) To avoid duplication of the directive `no-cache` on `Cache-Control`,
# the value is skipped here.
# The directive `no-cache` is already defined by Nginx `expires` when set
# to `epoch`. This ensure a correct value enforcement whenever cache
# control configuration is used or not.
# Cache expiration configuration `expires` is described in the file
# h5bp/web_performance/cache_expiration.conf.
# https://nginx.org/en/docs/http/ngx_http_headers_module.html#expires
#
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control
# https://www.rfc-editor.org/rfc/rfc9111.html
# https://www.rfc-editor.org/rfc/rfc8246.html
# https://www.rfc-editor.org/rfc/rfc5861.html
# https://www.iana.org/assignments/http-cache-directives/http-cache-directives.xml
# https://cache-tests.fyi/
add_header Cache-Control $cache_control;
================================================
FILE: h5bp/web_performance/cache-file-descriptors.conf
================================================
# ----------------------------------------------------------------------
# | Cache file-descriptors |
# ----------------------------------------------------------------------
# This tells Nginx to cache open file handles, "Not Found" errors and
# metadata about files and their permissions.
#
# Based on these cached metadata, Nginx can immediately begin sending data when
# a popular file is requested, and will also know to immediately send a 404 if a
# file is missing on disk, and so on.
#
# (!) It also means that the server won't react immediately to changes on disk,
# which may be undesirable.
# As only metadata are cached, edited files may be truncated until the cache
# is refreshed.
# https://github.com/h5bp/server-configs-nginx/issues/203
#
# In the below configuration, inactive files are released from the cache after
# 20 seconds, whereas active (recently requested) files are re-validated every
# 30 seconds.
# Descriptors will not be cached unless they are used at least 2 times within
# 20 seconds (the inactive time).
# A maximum of the 1000 most recently used file descriptors can be cached at
# any time.
#
# Production servers with stable file collections will definitely want to enable
# the cache.
#
# https://nginx.org/en/docs/http/ngx_http_core_module.html#open_file_cache
open_file_cache max=1000 inactive=20s;
open_file_cache_valid 30s;
open_file_cache_min_uses 2;
open_file_cache_errors on;
================================================
FILE: h5bp/web_performance/cache_expiration.conf
================================================
# ----------------------------------------------------------------------
# | Cache expiration |
# ----------------------------------------------------------------------
# Serve resources with a far-future expiration date.
#
# (!) If you don't control versioning with filename-based cache busting, you
# should consider lowering the cache times to something like one week.
#
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expires
# https://nginx.org/en/docs/http/ngx_http_headers_module.html#expires
map $sent_http_content_type $expires {
# Default: Fallback
default 1y;
# Default: No content
"" off;
# Specific: Assets
~*image/svg\+xml 1y;
~*image/vnd.microsoft.icon 1w;
~*image/x-icon 1w;
# Specific: Manifests
~*application/manifest\+json 1w;
~*text/cache-manifest epoch;
# Specific: Data interchange
~*application/atom\+xml 1h;
~*application/rdf\+xml 1h;
~*application/rss\+xml 1h;
# Specific: Documents
~*text/html epoch;
~*text/markdown epoch;
~*text/calendar epoch;
# Specific: Other
~*text/x-cross-domain-policy 1w;
# Generic: Data
~*json epoch;
~*xml epoch;
# Generic: WebAssembly
# ~*application/wasm 1y; # default
# Generic: Assets
# ~*application/javascript 1y; # default
# ~*application/x-javascript 1y; # default
# ~*text/javascript 1y; # default
# ~*text/css 1y; # default
# Generic: Medias
# ~*audio/ 1y; # default
# ~*image/ 1y; # default
# ~*video/ 1y; # default
# ~*font/ 1y; # default
}
expires $expires;
================================================
FILE: h5bp/web_performance/compression.conf
================================================
# ----------------------------------------------------------------------
# | Compression |
# ----------------------------------------------------------------------
# https://nginx.org/en/docs/http/ngx_http_gzip_module.html
# Enable gzip compression.
# Default: off
gzip on;
# Compression level (1-9).
# 5 is a perfect compromise between size and CPU usage, offering about 75%
# reduction for most ASCII files (almost identical to level 9).
# Default: 1
gzip_comp_level 5;
# Don't compress anything that's already small and unlikely to shrink much if at
# all (the default is 20 bytes, which is bad as that usually leads to larger
# files after gzipping).
# Default: 20
gzip_min_length 256;
# Compress data even for clients that are connecting to us via proxies,
# identified by the "Via" header (required for CloudFront).
# Default: off
gzip_proxied any;
# Tell proxies to cache both the gzipped and regular version of a resource
# whenever the client's Accept-Encoding capabilities header varies;
# Avoids the issue where a non-gzip capable client (which is extremely rare
# today) would display gibberish if their proxy gave them the gzipped version.
# Default: off
gzip_vary on;
# Compress all output labeled with one of the following MIME-types.
# `text/html` is always compressed by gzip module.
# Default: text/html
gzip_types
application/atom+xml
application/geo+json
application/javascript
application/x-javascript
application/json
application/ld+json
application/manifest+json
application/rdf+xml
application/rss+xml
application/vnd.ms-fontobject
application/wasm
application/x-web-app-manifest+json
application/xhtml+xml
application/xml
font/eot
font/otf
font/ttf
image/bmp
image/svg+xml
image/vnd.microsoft.icon
image/x-icon
text/cache-manifest
text/calendar
text/css
text/javascript
text/markdown
text/plain
text/xml
text/vcard
text/vnd.rim.location.xloc
text/vtt
text/x-component
text/x-cross-domain-policy;
================================================
FILE: h5bp/web_performance/content_transformation.conf
================================================
# ----------------------------------------------------------------------
# | Content transformation |
# ----------------------------------------------------------------------
# Prevent intermediate caches or proxies (such as those used by mobile
# network providers) and browsers data-saving features from modifying
# the website's content using the `no-transform` directive for
# `Cache-Control` header.
#
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control
# https://tools.ietf.org/html/rfc7234#section-5.2.2.4
#
# (!) Carefully consider the impact on your visitors before disabling
# content transformation. These transformations are performed to
# improve the experience for data- and cost-constrained users
# (e.g. users on a 2G connection).
#
# You can test the effects of content transformation applied by
# Google's Lite Mode by visiting: https://googleweblight.com/i?u=https://www.example.com
#
# https://support.google.com/webmasters/answer/6211428
#
# (!) If you are using `ngx_pagespeed`, note that disabling this will
# prevent `PageSpeed` from rewriting HTML files, and, if the
# `pagespeed DisableRewriteOnNoTransform` directive isn't set to
# `off`, also from rewriting other resources.
#
# https://developers.google.com/speed/pagespeed/module/configuration#notransform
add_header Cache-Control "no-transform";
================================================
FILE: h5bp/web_performance/pre-compressed_content_brotli.conf
================================================
# ----------------------------------------------------------------------
# | Brotli pre-compressed content |
# ----------------------------------------------------------------------
# Serve brotli compressed CSS, JS, HTML, SVG, ICS and JSON files if they exist
# and if the client accepts br encoding.
#
# (!) To make this part relevant, you need to generate encoded files by your
# own. Enabling this part will not auto-generate brotlied files.
#
# Note that some clients (e.g. browsers) require a secure connection to request
# brotli-compressed resources.
# https://www.chromestatus.com/feature/5420797577396224
#
# https://github.com/eustas/ngx_brotli/#brotli_static
brotli_static on;
================================================
FILE: h5bp/web_performance/pre-compressed_content_gzip.conf
================================================
# ----------------------------------------------------------------------
# | GZip pre-compressed content |
# ----------------------------------------------------------------------
# Serve gzip compressed CSS, JS, HTML, SVG, ICS, and JSON files if they exist
# and if the client accepts gzip encoding.
#
# (!) To make this part relevant, you need to generate encoded files by your
# own. Enabling this part will not auto-generate gziped files.
#
# https://nginx.org/en/docs/http/ngx_http_gzip_static_module.html
gzip_static on;
================================================
FILE: mime.types
================================================
types {
# Data interchange
application/atom+xml atom;
application/json json map topojson;
application/ld+json jsonld;
application/rss+xml rss;
# Normalize to standard type.
# https://tools.ietf.org/html/rfc7946#section-12
application/geo+json geojson;
application/xml xml;
# Normalize to standard type.
# https://tools.ietf.org/html/rfc3870#section-2
application/rdf+xml rdf;
# JavaScript
# Servers should use text/javascript for JavaScript resources.
# https://html.spec.whatwg.org/multipage/scripting.html#scriptingLanguages
text/javascript js mjs;
application/wasm wasm;
# Manifest files
application/manifest+json webmanifest;
application/x-web-app-manifest+json webapp;
text/cache-manifest appcache;
# Media files
audio/midi mid midi kar;
audio/mp4 aac f4a f4b m4a;
audio/mpeg mp3;
audio/ogg oga ogg opus;
audio/x-realaudio ra;
audio/x-wav wav;
image/apng apng;
image/avif avif avifs;
image/bmp bmp;
image/gif gif;
image/jpeg jpeg jpg;
image/jxl jxl;
image/jxr jxr hdp wdp;
image/png png;
image/svg+xml svg svgz;
image/tiff tif tiff;
image/vnd.wap.wbmp wbmp;
image/webp webp;
image/x-jng jng;
video/3gpp 3gp 3gpp;
video/mp4 f4p f4v m4v mp4;
video/mpeg mpeg mpg;
video/ogg ogv;
video/quicktime mov;
video/webm webm;
video/x-flv flv;
video/x-mng mng;
video/x-ms-asf asf asx;
video/x-msvideo avi;
# Serving `.ico` image files with a different media type
# prevents Internet Explorer from displaying then as images:
# https://github.com/h5bp/html5-boilerplate/commit/37b5fec090d00f38de64b591bcddcb205aadf8ee
image/x-icon cur ico;
# Microsoft Office
application/msword doc;
application/vnd.ms-excel xls;
application/vnd.ms-powerpoint ppt;
application/vnd.openxmlformats-officedocument.wordprocessingml.document docx;
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx;
application/vnd.openxmlformats-officedocument.presentationml.presentation pptx;
# Web fonts
font/woff woff;
font/woff2 woff2;
application/vnd.ms-fontobject eot;
font/ttf ttf;
font/collection ttc;
font/otf otf;
# Other
application/java-archive ear jar war;
application/mac-binhex40 hqx;
application/octet-stream bin deb dll dmg exe img iso msi msm msp safariextz;
application/pdf pdf;
application/postscript ai eps ps;
application/rtf rtf;
application/vnd.google-earth.kml+xml kml;
application/vnd.google-earth.kmz kmz;
application/vnd.wap.wmlc wmlc;
application/x-7z-compressed 7z;
application/x-bb-appworld bbaw;
application/x-bittorrent torrent;
application/x-chrome-extension crx;
application/x-cocoa cco;
application/x-java-archive-diff jardiff;
application/x-java-jnlp-file jnlp;
application/x-makeself run;
application/x-opera-extension oex;
application/x-perl pl pm;
application/x-pilot pdb prc;
application/x-rar-compressed rar;
application/x-redhat-package-manager rpm;
application/x-sea sea;
application/x-shockwave-flash swf;
application/x-stuffit sit;
application/x-tcl tcl tk;
application/x-x509-ca-cert crt der pem;
application/x-xpinstall xpi;
application/xhtml+xml xhtml;
application/xslt+xml xsl;
application/zip zip;
text/calendar ics;
text/css css;
text/csv csv;
text/html htm html shtml;
text/markdown md markdown;
text/mathml mml;
text/plain txt;
text/vcard vcard vcf;
text/vnd.rim.location.xloc xloc;
text/vnd.sun.j2me.app-descriptor jad;
text/vnd.wap.wml wml;
text/vtt vtt;
text/x-component htc;
}
================================================
FILE: nginx.conf
================================================
# Configuration File - Nginx Server Configs
# https://nginx.org/en/docs/
# Run as a unique, less privileged user for security reasons.
# Default: nobody nobody
# https://nginx.org/en/docs/ngx_core_module.html#user
# https://en.wikipedia.org/wiki/Principle_of_least_privilege
user www-data;
# Sets the worker threads to the number of CPU cores available in the system for
# best performance. Should be > the number of CPU cores.
# Maximum number of connections = worker_processes * worker_connections
# Default: 1
# https://nginx.org/en/docs/ngx_core_module.html#worker_processes
worker_processes auto;
# Maximum number of open files per worker process.
# Should be > worker_connections.
# Default: no limit
# https://nginx.org/en/docs/ngx_core_module.html#worker_rlimit_nofile
worker_rlimit_nofile 8192;
# Provides the configuration file context in which the directives that affect
# connection processing are specified.
# https://nginx.org/en/docs/ngx_core_module.html#events
events {
# If you need more connections than this, you start optimizing your OS.
# That's probably the point at which you hire people who are smarter than you
# as this is *a lot* of requests.
# Should be < worker_rlimit_nofile.
# Default: 512
# https://nginx.org/en/docs/ngx_core_module.html#worker_connections
worker_connections 8000;
}
# Log errors and warnings to this file
# This is only used when you don't override it on a `server` level
# Default: logs/error.log error
# https://nginx.org/en/docs/ngx_core_module.html#error_log
error_log /var/log/nginx/error.log warn;
# The file storing the process ID of the main process
# Default: logs/nginx.pid
# https://nginx.org/en/docs/ngx_core_module.html#pid
pid /var/run/nginx.pid;
# Include files in the custom.d folder.
# Custom configuration and value files should be placed in the custom.d
# folder.
# The configurations should be disabled by prefixing files with a dot.
include custom.d/*.conf;
http {
# Hide Nginx version information.
include h5bp/security/server_software_information.conf;
# Specify media (MIME) types for files.
include h5bp/media_types/media_types.conf;
# Set character encodings.
include h5bp/media_types/character_encodings.conf;
# Include $http_x_forwarded_for within default format used in log files
# https://nginx.org/en/docs/http/ngx_http_log_module.html#log_format
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
# Log access to this file
# This is only used when you don't override it on a `server` level
# Default: logs/access.log combined
# https://nginx.org/en/docs/http/ngx_http_log_module.html#access_log
access_log /var/log/nginx/access.log main;
# How long to allow each connection to stay idle.
# Longer values are better for each individual client, particularly for SSL,
# but means that worker connections are tied up longer.
# Default: 75s
# https://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout
keepalive_timeout 20s;
# Speed up file transfers by using `sendfile()` to copy directly between
# descriptors rather than using `read()`/`write()``.
# For performance reasons, on FreeBSD systems w/ ZFS this option should be
# disabled as ZFS's ARC caches frequently used files in RAM by default.
# Default: off
# https://nginx.org/en/docs/http/ngx_http_core_module.html#sendfile
sendfile on;
# Don't send out partial frames; this increases throughput since TCP frames
# are filled up before being sent out.
# Default: off
# https://nginx.org/en/docs/http/ngx_http_core_module.html#tcp_nopush
tcp_nopush on;
# Enable gzip compression.
include h5bp/web_performance/compression.conf;
# Specify file cache expiration.
include h5bp/web_performance/cache_expiration.conf;
# Add Cache-Control.
# h5bp/web_performance/cache-control.conf
map $sent_http_content_type $cache_control {
default "public, immutable, stale-while-revalidate";
# No content
"" "no-store";
# Manifest files
~*application/manifest\+json "public";
~*text/cache-manifest ""; # `no-cache` (*)
# Assets
~*image/svg\+xml "public, immutable, stale-while-revalidate";
# Data interchange
~*application/(atom|rdf|rss)\+xml "public, stale-while-revalidate";
# Documents
~*text/html "private, must-revalidate";
~*text/markdown "private, must-revalidate";
~*text/calendar "private, must-revalidate";
# Data
~*json ""; # `no-cache` (*)
~*xml ""; # `no-cache` (*)
}
# Add X-Frame-Options for HTML documents.
# h5bp/security/x-frame-options.conf
map $sent_http_content_type $x_frame_options {
~*text/html DENY;
}
# Add Content-Security-Policy for HTML documents.
# h5bp/security/content-security-policy.conf
map $sent_http_content_type $content_security_policy {
~*text/(html|javascript)|application/pdf|xml "default-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; upgrade-insecure-requests";
}
# Add Permissions-Policy for HTML documents.
# h5bp/security/permissions-policy.conf
map $sent_http_content_type $permissions_policy {
~*text/(html|javascript)|application/pdf|xml "accelerometer=(),autoplay=(),browsing-topics=(),camera=(),display-capture=(),document-domain=(),encrypted-media=(),fullscreen=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(),publickey-credentials-get=(),screen-wake-lock=(),sync-xhr=(self),usb=(),web-share=(),xr-spatial-tracking=()";
}
# Add Referrer-Policy for HTML documents.
# h5bp/security/referrer-policy.conf
map $sent_http_content_type $referrer_policy {
~*text/(css|html|javascript)|application\/pdf|xml "strict-origin-when-cross-origin";
}
# Add Cross-Origin-Policies for HTML documents.
# h5bp/security/cross-origin-policy.conf
# Cross-Origin-Embedder-Policy
map $sent_http_content_type $coep_policy {
~*text/(html|javascript)|application/pdf|xml "require-corp";
}
# Cross-Origin-Opener-Policy
map $sent_http_content_type $coop_policy {
~*text/(html|javascript)|application/pdf|xml "same-origin";
}
# Cross-Origin-Resource-Policy
map $sent_http_content_type $corp_policy {
~*text/(html|javascript)|application/pdf|xml "same-origin";
}
# Add Access-Control-Allow-Origin.
# h5bp/cross-origin/requests.conf
map $sent_http_content_type $cors {
# Images
~*image/ "*";
# Web fonts
~*font/ "*";
~*application/vnd.ms-fontobject "*";
~*application/x-font-ttf "*";
~*application/font-woff "*";
~*application/x-font-woff "*";
~*application/font-woff2 "*";
}
# Include files in the conf.d folder.
# `server` configuration files should be placed in the conf.d folder.
# The configurations should be disabled by prefixing files with a dot.
include conf.d/*.conf;
}
gitextract_6tgcy6ja/ ├── .editorconfig ├── .gitattributes ├── .github/ │ ├── CODEOWNERS │ ├── CODE_OF_CONDUCT.md │ ├── CONTRIBUTING.md │ ├── FUNDING.yml │ ├── dependabot.yml │ └── workflows/ │ ├── auto-merge.yml │ ├── lint.yml │ └── server.yml ├── .gitignore ├── CHANGELOG.md ├── LICENSE.txt ├── README.md ├── conf.d/ │ ├── .default.conf │ ├── no-ssl.default.conf │ └── templates/ │ ├── example.com.conf │ └── no-ssl.example.com.conf ├── h5bp/ │ ├── basic.conf │ ├── cross-origin/ │ │ ├── requests.conf │ │ └── resource_timing.conf │ ├── errors/ │ │ └── custom_errors.conf │ ├── location/ │ │ ├── security_file_access.conf │ │ ├── web_performance_filename-based_cache_busting.conf │ │ └── web_performance_svgz-compression.conf │ ├── media_types/ │ │ ├── character_encodings.conf │ │ └── media_types.conf │ ├── security/ │ │ ├── content-security-policy.conf │ │ ├── cross-origin-policy.conf │ │ ├── permissions-policy.conf │ │ ├── referrer-policy.conf │ │ ├── server_software_information.conf │ │ ├── strict-transport-security.conf │ │ ├── x-content-type-options.conf │ │ └── x-frame-options.conf │ ├── tls/ │ │ ├── certificate_files.conf │ │ ├── ocsp_stapling.conf │ │ ├── policy_balanced.conf │ │ ├── policy_strict.conf │ │ └── ssl_engine.conf │ └── web_performance/ │ ├── cache-control.conf │ ├── cache-file-descriptors.conf │ ├── cache_expiration.conf │ ├── compression.conf │ ├── content_transformation.conf │ ├── pre-compressed_content_brotli.conf │ └── pre-compressed_content_gzip.conf ├── mime.types └── nginx.conf
Condensed preview — 49 files, each showing path, character count, and a content snippet. Download the .json file or copy for the full structured content (115K chars).
[
{
"path": ".editorconfig",
"chars": 426,
"preview": "# For more information about the properties used in\n# this file, please see the EditorConfig documentation:\n# https://ed"
},
{
"path": ".gitattributes",
"chars": 519,
"preview": "# Automatically normalize line endings for all text-based files\n# https://git-scm.com/docs/gitattributes#_end_of_line_co"
},
{
"path": ".github/CODEOWNERS",
"chars": 128,
"preview": "# https://help.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners\n\n* @h5bp/server-config"
},
{
"path": ".github/CODE_OF_CONDUCT.md",
"chars": 121,
"preview": "Please read [Code of Conduct for H5BP](https://github.com/h5bp/html5-boilerplate/blob/master/.github/CODE_OF_CONDUCT.md)"
},
{
"path": ".github/CONTRIBUTING.md",
"chars": 5474,
"preview": "# Contributing to Nginx Server Configs\n\n♥ [Nginx Server Configs](https://github.com/h5bp/server-configs-nginx) and\nwant "
},
{
"path": ".github/FUNDING.yml",
"chars": 323,
"preview": "# These are supported funding model platforms\n\ngithub: [LeoColomb]\npatreon: # Replace with a single Patreon username\nope"
},
{
"path": ".github/dependabot.yml",
"chars": 105,
"preview": "version: 2\nupdates:\n- package-ecosystem: github-actions\n directory: \"/\"\n schedule:\n interval: daily\n"
},
{
"path": ".github/workflows/auto-merge.yml",
"chars": 958,
"preview": "# https://docs.github.com/actions\n\nname: Auto-merge\n\non: pull_request_target\n\npermissions:\n pull-requests: write\n cont"
},
{
"path": ".github/workflows/lint.yml",
"chars": 322,
"preview": "# https://docs.github.com/actions\r\n\r\nname: Lint\r\n\r\non: [push, pull_request]\r\n\r\njobs:\r\n check:\r\n runs-on: ubuntu-late"
},
{
"path": ".github/workflows/server.yml",
"chars": 1351,
"preview": "# https://docs.github.com/actions\n\nname: Server CI\n\non: [push, pull_request]\n\njobs:\n check:\n runs-on: ubuntu-latest\n"
},
{
"path": ".gitignore",
"chars": 91,
"preview": "logs/\nconf.d/*.conf\n!conf.d/.default.conf\n!conf.d/no-ssl.default.conf\ntest/*\n!test/vhosts/\n"
},
{
"path": "CHANGELOG.md",
"chars": 41189,
"preview": "### 5.0.1 (July 23, 2023)\n\n* Set `ssl_prefer_server_ciphers` to `off`\n [https://github.com/h5bp/server-configs-nginx/pu"
},
{
"path": "LICENSE.txt",
"chars": 1043,
"preview": "Copyright (c) H5BP\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and as"
},
{
"path": "README.md",
"chars": 4739,
"preview": "# [Nginx Server Configs](https://github.com/h5bp/server-configs-nginx)\n\n[![Server CI](https://github.com/h5bp/server-con"
},
{
"path": "conf.d/.default.conf",
"chars": 763,
"preview": "# ----------------------------------------------------------------------\n# | Default behavior for unknown hosts "
},
{
"path": "conf.d/no-ssl.default.conf",
"chars": 932,
"preview": "# ----------------------------------------------------------------------\n# | Default behavior for unknown hosts "
},
{
"path": "conf.d/templates/example.com.conf",
"chars": 1434,
"preview": "# ----------------------------------------------------------------------\n# | Config file for example.com host "
},
{
"path": "conf.d/templates/no-ssl.example.com.conf",
"chars": 1133,
"preview": "# ----------------------------------------------------------------------\n# | Config file for non-secure example.com host"
},
{
"path": "h5bp/basic.conf",
"chars": 314,
"preview": "# Nginx Server Configs | MIT License\n# https://github.com/h5bp/server-configs-nginx\n\ninclude h5bp/security/referrer-poli"
},
{
"path": "h5bp/cross-origin/requests.conf",
"chars": 739,
"preview": "# ----------------------------------------------------------------------\n# | Cross-origin requests "
},
{
"path": "h5bp/cross-origin/resource_timing.conf",
"chars": 761,
"preview": "# ----------------------------------------------------------------------\n# | Cross-origin resource timing "
},
{
"path": "h5bp/errors/custom_errors.conf",
"chars": 385,
"preview": "# ----------------------------------------------------------------------\n# | Custom error messages/pages "
},
{
"path": "h5bp/location/security_file_access.conf",
"chars": 1706,
"preview": "# ----------------------------------------------------------------------\n# | File access "
},
{
"path": "h5bp/location/web_performance_filename-based_cache_busting.conf",
"chars": 701,
"preview": "# ----------------------------------------------------------------------\n# | Filename-based cache busting "
},
{
"path": "h5bp/location/web_performance_svgz-compression.conf",
"chars": 685,
"preview": "# ----------------------------------------------------------------------\n# | SVGZ Compression "
},
{
"path": "h5bp/media_types/character_encodings.conf",
"chars": 1029,
"preview": "# ----------------------------------------------------------------------\n# | Character encodings "
},
{
"path": "h5bp/media_types/media_types.conf",
"chars": 650,
"preview": "# ----------------------------------------------------------------------\n# | Media types "
},
{
"path": "h5bp/security/content-security-policy.conf",
"chars": 1198,
"preview": "# ----------------------------------------------------------------------\n# | Content Security Policy (CSP) "
},
{
"path": "h5bp/security/cross-origin-policy.conf",
"chars": 2100,
"preview": "# ----------------------------------------------------------------------\n# | Cross Origin Policy "
},
{
"path": "h5bp/security/permissions-policy.conf",
"chars": 1121,
"preview": "# ----------------------------------------------------------------------\n# | Permissions Policy "
},
{
"path": "h5bp/security/referrer-policy.conf",
"chars": 1135,
"preview": "# ----------------------------------------------------------------------\n# | Referrer Policy "
},
{
"path": "h5bp/security/server_software_information.conf",
"chars": 396,
"preview": "# ----------------------------------------------------------------------\n# | Server software information "
},
{
"path": "h5bp/security/strict-transport-security.conf",
"chars": 2008,
"preview": "# ----------------------------------------------------------------------\n# | HTTP Strict Transport Security (HSTS) "
},
{
"path": "h5bp/security/x-content-type-options.conf",
"chars": 871,
"preview": "# ----------------------------------------------------------------------\n# | Content Type Options "
},
{
"path": "h5bp/security/x-frame-options.conf",
"chars": 1800,
"preview": "# ----------------------------------------------------------------------\n# | Frame Options "
},
{
"path": "h5bp/tls/certificate_files.conf",
"chars": 1136,
"preview": "# ----------------------------------------------------------------------\n# | Certificate files "
},
{
"path": "h5bp/tls/ocsp_stapling.conf",
"chars": 1235,
"preview": "# ----------------------------------------------------------------------\n# | Online Certificate Status Protocol stapling"
},
{
"path": "h5bp/tls/policy_balanced.conf",
"chars": 797,
"preview": "# ----------------------------------------------------------------------\n# | SSL policy - Balanced "
},
{
"path": "h5bp/tls/policy_strict.conf",
"chars": 1818,
"preview": "# ----------------------------------------------------------------------\n# | SSL policy - Strict "
},
{
"path": "h5bp/tls/ssl_engine.conf",
"chars": 1880,
"preview": "# ----------------------------------------------------------------------\n# | SSL engine "
},
{
"path": "h5bp/web_performance/cache-control.conf",
"chars": 2202,
"preview": "# ----------------------------------------------------------------------\n# | Cache Control "
},
{
"path": "h5bp/web_performance/cache-file-descriptors.conf",
"chars": 1484,
"preview": "# ----------------------------------------------------------------------\n# | Cache file-descriptors "
},
{
"path": "h5bp/web_performance/cache_expiration.conf",
"chars": 2220,
"preview": "# ----------------------------------------------------------------------\n# | Cache expiration "
},
{
"path": "h5bp/web_performance/compression.conf",
"chars": 2049,
"preview": "# ----------------------------------------------------------------------\n# | Compression "
},
{
"path": "h5bp/web_performance/content_transformation.conf",
"chars": 1435,
"preview": "# ----------------------------------------------------------------------\n# | Content transformation "
},
{
"path": "h5bp/web_performance/pre-compressed_content_brotli.conf",
"chars": 732,
"preview": "# ----------------------------------------------------------------------\n# | Brotli pre-compressed content "
},
{
"path": "h5bp/web_performance/pre-compressed_content_gzip.conf",
"chars": 572,
"preview": "# ----------------------------------------------------------------------\n# | GZip pre-compressed content "
},
{
"path": "mime.types",
"chars": 5775,
"preview": "types {\n\n # Data interchange\n\n application/atom+xml atom;\n application/json "
},
{
"path": "nginx.conf",
"chars": 7293,
"preview": "# Configuration File - Nginx Server Configs\n# https://nginx.org/en/docs/\n\n# Run as a unique, less privileged user for se"
}
]
About this extraction
This page contains the full source code of the h5bp/server-configs-nginx GitHub repository, extracted and formatted as plain text for AI agents and large language models (LLMs). The extraction includes 49 files (106.7 KB), approximately 28.8k tokens. Use this with OpenClaw, Claude, ChatGPT, Cursor, Windsurf, or any other AI tool that accepts text input. You can copy the full output to your clipboard or download it as a .txt file.
Extracted by GitExtract — free GitHub repo to text converter for AI. Built by Nikandr Surkov.