mirror of
https://gh.llkk.cc/https://github.com/WeblateOrg/scripts.git
synced 2025-10-03 15:01:00 +08:00
64d215f99d
* chore(deps): update pre-commit hook scop/pre-commit-shfmt to v3.12.0-1 * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
33 lines
1 KiB
Bash
Executable file
33 lines
1 KiB
Bash
Executable file
#!/bin/sh
|
|
|
|
# Based on https://ssl-config.mozilla.org/#server=nginx
|
|
|
|
# Disable Letsencrypt SSL configuraion (it is weak)
|
|
sed -i '/\/etc\/letsencrypt\/options-ssl-nginx.conf/ D' /etc/nginx/sites-available/*
|
|
|
|
# Disable built-in SSL config
|
|
sed -i -e '/ssl_protocols/D' -e '/ssl_prefer_server_ciphers/D' /etc/nginx/nginx.conf
|
|
|
|
# Update SSL config
|
|
cat >/etc/nginx/conf.d/ssl.conf <<EOT
|
|
ssl_session_timeout 1d;
|
|
ssl_session_cache shared:SSL:50m;
|
|
ssl_session_tickets off;
|
|
|
|
ssl_dhparam /etc/nginx/ffdhe4096.pem;
|
|
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
|
ssl_prefer_server_ciphers off;
|
|
|
|
ssl_stapling on;
|
|
ssl_stapling_verify on;
|
|
EOT
|
|
|
|
# Update DH params
|
|
if [ ! -f /etc/nginx/ffdhe4096.pem ]; then
|
|
curl https://ssl-config.mozilla.org/ffdhe2048.txt >/etc/nginx/ffdhe4096.pem
|
|
fi
|
|
|
|
# Reload ngxin
|
|
systemctl reload nginx
|
