finallycoffee/matrix-docker-ansible-deploy
finallycoffee/matrix-docker-ansible-deploy
2
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

variable matrix_nginx_proxy_hsts_preload_enable added

Browse Source
This commit is contained in:
sakkiii 2021-04-24 20:04:20 +05:30
parent 5b4fdf9b87
commit 40fe6bd5c1
7 changed files with 41 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
roles/matrix-nginx-proxy/defaults/main.yml
View File

@ -279,6 +279,17 @@ matrix_nginx_proxy_proxy_domain_additional_server_configuration_blocks: []
# Of course, a better solution is to just stop using browsers (like Chrome), which participate in such tracking practices. # Of course, a better solution is to just stop using browsers (like Chrome), which participate in such tracking practices.
matrix_nginx_proxy_floc_optout_enabled: true matrix_nginx_proxy_floc_optout_enabled: true
# HSTS Preloading Enable
#
# In its strongest and recommended form, the [HSTS policy](https://www.chromium.org/hsts) includes all subdomains, and
# indicates a willingness to be “preloaded” into browsers:
# `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`
# For more information visit:
# - https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
# - https://hstspreload.org/#opt-in
matrix_nginx_proxy_hsts_preload_enable: false
# Specifies the SSL configuration that should be used for the SSL protocols and ciphers # Specifies the SSL configuration that should be used for the SSL protocols and ciphers
# This is based on the Mozilla Server Side TLS Recommended configurations. # This is based on the Mozilla Server Side TLS Recommended configurations.
# #

6
roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-bot-go-neb.conf.j2
View File

@ -3,7 +3,11 @@
{% macro render_vhost_directives() %} {% macro render_vhost_directives() %}
gzip on; gzip on;
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif; gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; {% if matrix_nginx_proxy_hsts_preload_enable %}
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
{% else %}
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
{% endif %}
add_header X-XSS-Protection "1; mode=block";; add_header X-XSS-Protection "1; mode=block";;
add_header X-Content-Type-Options nosniff; add_header X-Content-Type-Options nosniff;

6
roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-client-element.conf.j2
View File

@ -4,7 +4,11 @@
gzip on; gzip on;
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif; gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; {% if matrix_nginx_proxy_hsts_preload_enable %}
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
{% else %}
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
{% endif %}
add_header X-Content-Type-Options nosniff; add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block"; add_header X-XSS-Protection "1; mode=block";
add_header X-Frame-Options SAMEORIGIN; add_header X-Frame-Options SAMEORIGIN;

6
roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-dimension.conf.j2
View File

@ -3,7 +3,11 @@
{% macro render_vhost_directives() %} {% macro render_vhost_directives() %}
gzip on; gzip on;
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif; gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; {% if matrix_nginx_proxy_hsts_preload_enable %}
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
{% else %}
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
{% endif %}
add_header X-XSS-Protection "1; mode=block"; add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options nosniff; add_header X-Content-Type-Options nosniff;
{% if matrix_nginx_proxy_floc_optout_enabled %} {% if matrix_nginx_proxy_floc_optout_enabled %}

6
roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-grafana.conf.j2
View File

@ -4,7 +4,11 @@
gzip on; gzip on;
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif; gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; {% if matrix_nginx_proxy_hsts_preload_enable %}
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
{% else %}
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
{% endif %}
# duplicate X-Content-Type-Options & X-Frame-Options header # duplicate X-Content-Type-Options & X-Frame-Options header
# Enabled by grafana by default # Enabled by grafana by default
# add_header X-Content-Type-Options nosniff; # add_header X-Content-Type-Options nosniff;

6
roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-jitsi.conf.j2
View File

@ -3,7 +3,11 @@
{% macro render_vhost_directives() %} {% macro render_vhost_directives() %}
gzip on; gzip on;
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif; gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; {% if matrix_nginx_proxy_hsts_preload_enable %}
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
{% else %}
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
{% endif %}
add_header X-XSS-Protection "1; mode=block"; add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options nosniff; add_header X-Content-Type-Options nosniff;
{% if matrix_nginx_proxy_floc_optout_enabled %} {% if matrix_nginx_proxy_floc_optout_enabled %}

6
roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-sygnal.conf.j2
View File

@ -3,7 +3,11 @@
{% macro render_vhost_directives() %} {% macro render_vhost_directives() %}
gzip on; gzip on;
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif; gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; {% if matrix_nginx_proxy_hsts_preload_enable %}
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
{% else %}
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
{% endif %}
add_header X-XSS-Protection "1; mode=block"; add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options nosniff; add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options DENY; add_header X-Frame-Options DENY;