3

So I recently setup a personal GitLab server and I am using the following config with full SSL. I tried my best but what else can be done to make it better? I mostly learned what I know about webservers from playing around with it in spare time so I didn't really follow any conventions. Please let me know about any comments and concerns. 

server_tokens off;
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header Content-Security-Policy "default-src 'self'; script-src 'self''unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com   h   https://assets.zendesk.com https://connect.facebook.net; img-src 'self'    https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";

server {
listen 80;
listen 443 default ssl spdy;
server_name gitlab.example.com;
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";

ssl_certificate           /etc/nginx/ssl/gitlab.crt;
ssl_certificate_key       /etc/nginx/ssl/gitlab.key;
ssl_dhparam               /etc/nginx/ssl/dhparams.pem;
ssl_session_cache shared:SSL:50m;
ssl_session_timeout 5m;
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx/ssl/CA/comodo.pem;
resolver 8.8.8.8;

ssl_ciphers  "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK";

location / {
  proxy_set_header    Host                $http_host;
  proxy_set_header    X-Real-IP           $remote_addr;
  proxy_set_header    X-Forwarded-Ssl     on;
  proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
  proxy_set_header    X-Forwarded-Proto   $scheme;
  proxy_set_header    X-Frame-Options     SAMEORIGIN;
  proxy_pass          http://192.168.1.139:82;
  proxy_redirect      http://192.168.1.139:82 https://gitlab.example.com;
  }
}
Improve this question
1

1 Answer 1

Reset to default
6

Your add_header Strict-Transport-Security ... in server block removes add_headers from upper level.

proxy_redirect is superfluous. You just used default value, and moreover if you happen to change proxy_pass and forget to change proxy_redirect you'll get strange errors.

proxy_set_header X-Frame-Options is meaningless.

proxy_set_header X-Forwarded-Ssl on is strange, because you allow non-ssl connections.

Improve this answer
3
  • How do I solve the add_header Strict_Transport-Security issue so that is does not remove the other headers? Also I removed proxy_redirect as you indicated. I thought the X-Frame-Options prevents the page being rendered inside a frame to avoid clickjacking? Also what exactly do you mean that I am allowing non ssl connections? The site is never served over http. It always redirects to https. Thanks for the help!
    – Dikshant Adhikari
    Aug 14, 2015 at 19:23
  • Put them all on the same level. X-Frame-Options is for browser and you have it in second line. There is no reason to send it to server. You have listen 80 that means you allow unsecured connections to that server.
    – Alexey Ten
    Aug 14, 2015 at 20:13
  • OK so I got rid of port 80 completely. Now it only works on 443 with ssl. Thanks. And I also got rid of x frame.
    – Dikshant Adhikari
    Aug 14, 2015 at 21:25

Not the answer you're looking for? Browse other questions tagged .