From 3117429d1eb122382e78e6cb27a07dd878f7c0e9 Mon Sep 17 00:00:00 2001 From: Jan Tuomi Date: Sat, 11 Oct 2025 15:36:54 +0300 Subject: Improve ingress --- templates/ingress/usr_local_etc_nginx_nginx.conf.j2 | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) (limited to 'templates/ingress/usr_local_etc_nginx_nginx.conf.j2') diff --git a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 index 9f20a5f..04c43db 100644 --- a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 +++ b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 @@ -76,6 +76,25 @@ http { } {% endif -%} + {# TODO: parameterize this properly -#} + server { + server_name jantuomi.fi; + http2 on; + + listen 443 ssl; + listen [::]:443 ssl; + + # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7 + add_header Strict-Transport-Security "max-age=63072000" always; + + ssl_certificate /usr/local/etc/letsencrypt/live/jantuomi.fi/fullchain.pem; + ssl_certificate_key /usr/local/etc/letsencrypt/live/jantuomi.fi/privkey.pem; + include /usr/local/etc/letsencrypt/options-ssl-nginx.conf; + ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem; + + return 307 https://jan.systems$request_uri; + } + {% endfor -%} {% for jail in jails -%} server { -- cgit v1.3