From ae9be6373428471dd4c95f64741b990638c272c0 Mon Sep 17 00:00:00 2001
From: Jan Tuomi <jan@jantuomi.fi>
Date: Mon, 6 Oct 2025 00:06:54 +0300
Subject: Work on networking

---
 templates/usr_local_etc_nginx_nginx.conf.j2 | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

(limited to 'templates/usr_local_etc_nginx_nginx.conf.j2')

diff --git a/templates/usr_local_etc_nginx_nginx.conf.j2 b/templates/usr_local_etc_nginx_nginx.conf.j2
index 55c55df..cee7878 100644
--- a/templates/usr_local_etc_nginx_nginx.conf.j2
+++ b/templates/usr_local_etc_nginx_nginx.conf.j2
@@ -22,17 +22,23 @@ http {
 
     {% for site in static_sites -%}
     {% if site.tls -%}
-    {#server {
-        listen 443 ssl;
+    server {
         server_name {{ site.host }};
-
         root /usr/local/www/{{ site.site }};
+
+        listen 443 ssl;
+        listen [::]:443 ssl;
+        http2 on;
+
         index index.html;
 
         location / {
             try_files $uri $uri.html $uri/ =404;
         }
 
+        # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7
+        add_header Strict-Transport-Security "max-age=63072000" always;
+
         access_log /var/log/nginx/{{ site.site }}/access.log;
         error_log /var/log/nginx/{{ site.site }}/error.log;
 
@@ -41,7 +47,6 @@ http {
         include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
         ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;
     }
-    #}
     {% endif -%}
 
     server {
-- 
cgit v1.3