From 7eddf00f8c1383ff73b77a1d1909c501d60ac53d Mon Sep 17 00:00:00 2001 From: Zoey Date: Sat, 14 Dec 2024 22:20:08 +0100 Subject: [PATCH 1/6] Improve nginx reverse proxy template based on (not identical): https://ssl-config.mozilla.org/#server=nginx&version=1.27.3&config=intermediate&openssl=3.4.0&hsts=false&ocsp=false&guideline=5.7 Signed-off-by: Zoey --- reverse-proxy.md | 37 ++++++++++++++++++------------------- 1 file changed, 18 insertions(+), 19 deletions(-) diff --git a/reverse-proxy.md b/reverse-proxy.md index a7eea8c2..224ca844 100644 --- a/reverse-proxy.md +++ b/reverse-proxy.md @@ -317,7 +317,7 @@ backend Nextcloud -### Nginx, Freenginx, Openresty +### Nginx, Freenginx, Openresty, Angie
@@ -344,24 +344,27 @@ server { if ($scheme = "http") { return 301 https://$host$request_uri; } + if ($http_x_forwarded_proto = "http") { + return 301 https://$host$request_uri; + } listen 443 ssl http2; # for nginx versions below v1.25.1 listen [::]:443 ssl http2; # for nginx versions below v1.25.1 - comment to disable IPv6 # listen 443 ssl; # for nginx v1.25.1+ # listen [::]:443 ssl; # for nginx v1.25.1+ - keep comment to disable IPv6 - - # http2 on; # uncomment to enable HTTP/2 - supported on nginx v1.25.1+ + # http2 on; # uncomment to enable HTTP/2 - supported on nginx v1.25.1+ + + # listen 443 quic reuseport; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport + # listen [::]:443 quic reuseport; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport - keep comment to disable IPv6 # http3 on; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ # quic_retry on; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ # add_header Alt-Svc 'h3=":443"; ma=86400'; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - # listen 443 quic reuseport; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport - # listen [::]:443 quic reuseport; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport - keep comment to disable IPv6 server_name ; location / { - proxy_pass http://127.0.0.1:11000$request_uri; + proxy_pass http://127.0.0.1:11000$request_uri; # adjust to match APACHE_PORT and APACHE_IP_BINDING proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Port $server_port; @@ -369,6 +372,7 @@ server { proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; + proxy_set_header Early-Data $ssl_early_data; proxy_request_buffering off; proxy_read_timeout 86400s; @@ -386,23 +390,18 @@ server { ssl_certificate /etc/letsencrypt/live//fullchain.pem; # managed by certbot on host machine ssl_certificate_key /etc/letsencrypt/live//privkey.pem; # managed by certbot on host machine + ssl_dhparam /etc/dhparam; # curl -L https://ssl-config.mozilla.org/ffdhe2048.txt -o /etc/dhparam + + ssl_early_data on; ssl_session_timeout 1d; - ssl_session_cache shared:MozSSL:10m; # about 40000 sessions - ssl_session_tickets off; + ssl_session_cache shared:SSL:10m; ssl_protocols TLSv1.2 TLSv1.3; - ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305; + ssl_ecdh_curve x25519:x448:secp521r1:secp384r1:secp256r1; + ssl_prefer_server_ciphers on; - - # Optional settings: - - # OCSP stapling - # ssl_stapling on; - # ssl_stapling_verify on; - # ssl_trusted_certificate /etc/letsencrypt/live//chain.pem; - - # replace with the IP address of your resolver - # resolver 127.0.0.1; # needed for oscp stapling: e.g. use 94.140.15.15 for adguard / 1.1.1.1 for cloudflared or 8.8.8.8 for google - you can use the same nameserver as listed in your /etc/resolv.conf file + ssl_conf_command Options PrioritizeChaCha; + ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256; } ``` From e4b0998f3c7997a2e3cea6731b5dea3c8ba2deed Mon Sep 17 00:00:00 2001 From: Zoey Date: Sat, 14 Dec 2024 22:27:55 +0100 Subject: [PATCH 2/6] small additional improvement Signed-off-by: Zoey --- reverse-proxy.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/reverse-proxy.md b/reverse-proxy.md index 224ca844..da89af9e 100644 --- a/reverse-proxy.md +++ b/reverse-proxy.md @@ -358,6 +358,7 @@ server { # listen 443 quic reuseport; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport # listen [::]:443 quic reuseport; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport - keep comment to disable IPv6 # http3 on; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ + # quic_gso on; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ # quic_retry on; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ # add_header Alt-Svc 'h3=":443"; ma=86400'; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ @@ -373,7 +374,8 @@ server { proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header Early-Data $ssl_early_data; - + + proxy_buffering off; proxy_request_buffering off; proxy_read_timeout 86400s; client_max_body_size 0; From d74d7f9a672c6b2d1a13c7dc0b9fb866f96ccf77 Mon Sep 17 00:00:00 2001 From: Zoey Date: Mon, 16 Dec 2024 19:00:19 +0100 Subject: [PATCH 3/6] improve upload speeds in nginx template Signed-off-by: Zoey --- reverse-proxy.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/reverse-proxy.md b/reverse-proxy.md index da89af9e..933e88e7 100644 --- a/reverse-proxy.md +++ b/reverse-proxy.md @@ -362,6 +362,14 @@ server { # quic_retry on; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ # add_header Alt-Svc 'h3=":443"; ma=86400'; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ + proxy_buffering off; + proxy_request_buffering off; + + client_max_body_size 0; + client_body_buffer_size 1m; + http3_stream_buffer_size 1m; + proxy_read_timeout 86400s; + server_name ; location / { @@ -375,11 +383,6 @@ server { proxy_set_header Host $host; proxy_set_header Early-Data $ssl_early_data; - proxy_buffering off; - proxy_request_buffering off; - proxy_read_timeout 86400s; - client_max_body_size 0; - # Websocket proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; @@ -434,7 +437,7 @@ Second, see these screenshots for a working config: ![grafik](https://user-images.githubusercontent.com/75573284/213889746-87dbe8c5-4d1f-492f-b251-bbf82f1510d0.png) ``` -client_body_buffer_size 512k; +client_body_buffer_size 1m; proxy_read_timeout 86400s; client_max_body_size 0; ``` From e7a36de3db2cd85922c9bbbd2fbd8384534a77d2 Mon Sep 17 00:00:00 2001 From: Zoey Date: Mon, 16 Dec 2024 22:13:05 +0100 Subject: [PATCH 4/6] also remove DHE Signed-off-by: Zoey --- reverse-proxy.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/reverse-proxy.md b/reverse-proxy.md index 933e88e7..ebeb0997 100644 --- a/reverse-proxy.md +++ b/reverse-proxy.md @@ -360,6 +360,7 @@ server { # http3 on; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ # quic_gso on; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ # quic_retry on; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ + # quic_bpf on; # improves HTTP/3 / QUIC - supported on nginx v1.25.0+, if nginx runs as a docker container you need to give it privileged permission # add_header Alt-Svc 'h3=":443"; ma=86400'; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ proxy_buffering off; @@ -406,7 +407,7 @@ server { ssl_prefer_server_ciphers on; ssl_conf_command Options PrioritizeChaCha; - ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256; + ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256; } ``` From 1ecf1092f61f189506b85f4cecf3058150d5ab2b Mon Sep 17 00:00:00 2001 From: Zoey Date: Tue, 17 Dec 2024 08:53:55 +0100 Subject: [PATCH 5/6] 512k is enough Signed-off-by: Zoey --- reverse-proxy.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/reverse-proxy.md b/reverse-proxy.md index ebeb0997..0f1693d1 100644 --- a/reverse-proxy.md +++ b/reverse-proxy.md @@ -367,8 +367,8 @@ server { proxy_request_buffering off; client_max_body_size 0; - client_body_buffer_size 1m; - http3_stream_buffer_size 1m; + client_body_buffer_size 512k; + http3_stream_buffer_size 512k; proxy_read_timeout 86400s; server_name ; @@ -438,7 +438,7 @@ Second, see these screenshots for a working config: ![grafik](https://user-images.githubusercontent.com/75573284/213889746-87dbe8c5-4d1f-492f-b251-bbf82f1510d0.png) ``` -client_body_buffer_size 1m; +client_body_buffer_size 512k; proxy_read_timeout 86400s; client_max_body_size 0; ``` From 1b3e2d6ece916fb4859a49f229ab9e1cafe55fdd Mon Sep 17 00:00:00 2001 From: Zoey Date: Tue, 17 Dec 2024 09:00:49 +0100 Subject: [PATCH 6/6] Update reverse-proxy.md Signed-off-by: Zoey --- reverse-proxy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/reverse-proxy.md b/reverse-proxy.md index 0f1693d1..03167e6e 100644 --- a/reverse-proxy.md +++ b/reverse-proxy.md @@ -360,7 +360,7 @@ server { # http3 on; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ # quic_gso on; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ # quic_retry on; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - # quic_bpf on; # improves HTTP/3 / QUIC - supported on nginx v1.25.0+, if nginx runs as a docker container you need to give it privileged permission + # quic_bpf on; # improves HTTP/3 / QUIC - supported on nginx v1.25.0+, if nginx runs as a docker container you need to give it privileged permission to use this option # add_header Alt-Svc 'h3=":443"; ma=86400'; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ proxy_buffering off;