[Support] Linuxserver.io - SWAG - Secure Web Application Gateway (Nginx/PHP/Certbot/Fail2ban)


5265 posts in this topic Last Reply

Recommended Posts

  • Replies 5.3k
  • Created
  • Last Reply

Top Posters In This Topic

Top Posters In This Topic

Popular Posts

I will only post this once. Feel free to refer folks to this post.   A few points of clarification:   The last update of this image didn't break things. Letsencrypt abruptly disabl

Application Name: SWAG - Secure Web Application Gateway Application Site:  https://docs.linuxserver.io/general/swag Docker Hub: https://hub.docker.com/r/linuxserver/swag Github: https:/

There is a PR just merged, it will be in next Friday's image, and will let you append php.ini via editing a file in the config folder   If you want to see how the sausage is made: https://gi

Posted Images

2 hours ago, aptalca said:

Smh. You see the linuxserver version and the binhex version side by side in your screenshot and you still select the binhex version. Why? Not that there is anything wrong with that version, but I'm asking you to follow the simple steps outlined in the troubleshooting article. We put a lot of time into it and it gets frustrating when users still don't follow them even when we spell them out step by step.

 

The whole point of the troubleshooting article is so you can make sure that your ports are properly mapped and forwarded and that the container is accessible from the internet. Only then, you should try to set up letsencrypt. Otherwise there are too many reasons why it can fail and as you experienced, if it fails a bunch of times, you're throttled.

 

So read the directions carefully. 

Thank you for your assistance. 
I attempted linuxserver version (2015) first and it prompted a server error when I attempted to start it the binhex did not. 

I can understand the frustration, I knew as soon as I responded the 'smh' was understandable.
Copy that on the troubleshooting steps and outlook. Its been a long few days on this.
Long story short I made some successful progress tonight, but good things came of it.

Continue some more tomorrow.

Link to post

Anyone know where I can change the default error file locations?

I've tried adding something like this to one of my .conf

 

Nevermind. I fixed it below. Didn't have correct volume mapping path.

 

error_page 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 421 422 423 424 425 426 428 429 431 451 500 501 502 503 504 505 506 507 508 510 511 /error.html;

location = /error.html {

  ssi on;
  internal;
  auth_basic off;
  root /config/www;
}

 

Edited by KJThaDon
Link to post
48 minutes ago, izarkhin said:

HI guys,

 

My certificate fails to renew. I have a free DuckDNS account that worked just fine before. I verified that the account is valid and has the correct IP address. What could be the problem? The config and the log files are attached.

 

Thanks!

[removed].duckdns.org.conf 1015 B · 0 downloads letsencrypt.log 3.05 kB · 0 downloads

Never mind! Turns out I needed to open port 80 for the challenge to work. All fine now.

Link to post

I've set up Letsencrypt/nginx wildcard on an unraid docker with my own domain.  Letsencrypt certificates appear to download fine. I've got sonarr, radarr and a few more subdomains edited and renamed in proxy-confs. Letsencrypt docker opens and ends in "Server ready." Domain.me and anything.domain.me resolve to correct IP.

 

But nothing opens. https://sonarr.domain.me et all are unable to establish a connection to the server, even though sonarr.domain.me pings correctly (to the WAN address). I suspect a config issue, but where?

Link to post
7 hours ago, madaroda said:

I've set up Letsencrypt/nginx wildcard on an unraid docker with my own domain.  Letsencrypt certificates appear to download fine. I've got sonarr, radarr and a few more subdomains edited and renamed in proxy-confs. Letsencrypt docker opens and ends in "Server ready." Domain.me and anything.domain.me resolve to correct IP.

 

But nothing opens. https://sonarr.domain.me et all are unable to establish a connection to the server, even though sonarr.domain.me pings correctly (to the WAN address). I suspect a config issue, but where?

Try following this https://blog.linuxserver.io/2019/07/10/troubleshooting-letsencrypt-image-port-mapping-and-forwarding/

Link to post

Hey guys. I have followed this site to create a website using Wordpress but when i go to the https://servername.com it goes to my nextcloud. However, when i go to https://www.servername.com it gives me this site can be reached. Can someone help me figure out the issue please? i am using the EXTRA_DOMAIN parameters and i dont see the name of the domain i use on the logs. I only see the others from my DNS provider.

Edited by Tucubanito07
Link to post
40 minutes ago, Tucubanito07 said:

Hey guys. I have followed this site to create a website using Wordpress but when i go to the https://servername.com it goes to my nextcloud. However, when i go to https://www.servername.com it gives me this site can be reached. Can someone help me figure out the issue please? i am using the EXTRA_DOMAIN parameters and i dont see the name of the domain i use on the logs. I only see the others from my DNS provider.

Post what you changed/tried to make it work and we'll take a look

Link to post
3 minutes ago, aptalca said:

Post what you changed/tried to make it work and we'll take a look

Thank you so much @aptalca This config is the one that this guide said to use. https://technicalramblings.com/blog/how-to-set-up-a-wordpress-site-with-letsencrypt-and-mariadb-on-unraid/

 

# REDIRECT WWW TO https://[domain.com]
server {
 listen 80;
 listen 443 ssl http2;
 server_name www.domainname.com; 
 return 301 https://domainnamecom$request_uri;
}

# REDIRECT HTTP TRAFFIC TO https://[domain.com]
server {
    listen 80;
    server_name domainname.com; 
    return 301 https://domainname.com$request_uri;
}

# BLOG SITE
server {
 listen 443 ssl http2;
 server_name domainname.com;

## Source: https://github.com/1activegeek/nginx-config-collection
## READ THE COMMENT ON add_header X-Frame-Options AND add_header Content-Security-Policy IF YOU USE THIS ON A SUBDOMAIN YOU WANT TO IFRAME!

## Certificates from LE container placement
ssl_certificate /config/keys/letsencrypt/fullchain.pem;
ssl_certificate_key /config/keys/letsencrypt/privkey.pem;

## Strong Security recommended settings per cipherli.st
ssl_dhparam /config/nginx/dhparams.pem; # Bit value: 4096
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
ssl_session_timeout  10m;

## NOTE: The add_header Content-Security-Policy won't work with duckdns since you don't own the root domain. Just buy a domain. It's cheap
## Settings to add strong security profile (A+ on securityheaders.io/ssllabs.com)

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none; #SET THIS TO index IF YOU WANT GOOGLE TO INDEX YOU SITE!
add_header Content-Security-Policy "frame-ancestors https://*.$server_name https://$server_name"; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe!
add_header X-Frame-Options "ALLOW-FROM https://*.$server_name" always; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe!
add_header Referrer-Policy "strict-origin-when-cross-origin";

add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;";
#FEATURE POLICY: READ MORE HERE: https://scotthelme.co.uk/a-new-security-header-feature-policy/

proxy_cookie_path / "/; HTTPOnly; Secure"; ##NOTE: This may cause issues with unifi. Remove HTTPOnly; or create another ssl config for unifi.
more_set_headers "Server: Classified";
more_clear_headers 'X-Powered-By';
 
 client_max_body_size 0; 
 
 root /config/www/wordpress/;
 index index.html index.php;
  
location ~ /\. {
deny all;

location / {
try_files $uri $uri/ /index.php?_url=$uri&$query_string; 
}

 
# PHP
 location ~ \.php$ {
 fastcgi_split_path_info ^(.+\.php)(/.+)$;
 # With php7-cgi alone:
 fastcgi_pass 127.0.0.1:9000;
 # With php7-fpm:
 #fastcgi_pass unix:/var/run/php7-fpm.sock;
 fastcgi_index index.php;
 include /etc/nginx/fastcgi_params;
 }
 
 fastcgi_buffer_size 4K;
 fastcgi_buffers 64 4k; 
}

 

So i dont think that one is the one working. I copied the nextcloud config file and changed the name of the site server and also the app name. I believe this one is the ones that is working. Since it had nextcloud i changed it to WordPress and now i get a 502 Bad Gateway. Here is that config.

 

# make sure that your dns has a cname set for nextcloud
# assuming this container is called "letsencrypt", edit your nextcloud container's config
# located at /config/www/nextcloud/config/config.php and add the following lines before the ");":
#  'trusted_proxies' => ['letsencrypt'],
#  'overwrite.cli.url' => 'https://nextcloud.your-domain.com/',
#  'overwritehost' => 'nextcloud.your-domain.com',
#  'overwriteprotocol' => 'https',
#
# Also don't forget to add your domain name to the trusted domains array. It should look somewhat like this:
#  array (
#    0 => '192.168.0.1:444', # This line may look different on your setup, don't modify it.
#    1 => 'nextcloud.your-domain.com',
#  ),

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name mydomainname.com;

    include /config/nginx/ssl.conf;

    add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";

    client_max_body_size 0;

    location / {
        include /config/nginx/proxy.conf;
        resolver 127.0.0.11 valid=30s;
        set $upstream_app WordPress;
        set $upstream_port 443;
        set $upstream_proto https;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

        proxy_max_temp_file_size 2048m;
    }
}
 

Link to post

You have probably used the wrong name for the variable. It's EXTRA_DOMAINS.

Show us how it looks like if you click Edit on Extra domain.

 

And please use the code tag if you insert config files or else it's a pain to read them.

 

Like this

Much easier to read for our sore eyes

 

Edited by saarg
Link to post
18 minutes ago, saarg said:

You have probably used the wrong name for the variable. It's EXTRA_DOMAINS.

Show us how it looks like if you click Edit on Extra domain.

 

And please use the code tag if you insert config files or else it's a pain to read them.

 


Like this

Much easier to read for our sore eyes

 

Ok so i was missing the S in EXTRA_DOMAINS i had EXTRA_DOMAIN. I do see that my domain on the logs does not have an error. Before i was doing domainname.com,www.domainname.com. The www.domainname.com was the one throwing an error. I delete it. Now i have been trying other configs like the ones above and grrr. 

Link to post

This is the config i am using under letsencrypt/nginx/proxy-confs/

 

# REDIRECT WWW TO https://[domain.com]
server {
 listen 80;
 listen 443 ssl http2;
 server_name www.domainame.com; 
 return 301 https://domainame.com$request_uri;
}

# REDIRECT HTTP TRAFFIC TO https://[domain.com]
server {
    listen 80;
    server_name domainame.com; 
    return 301 https://domainame.com$request_uri;
}

# BLOG SITE
server {
 listen 443 ssl http2;
 server_name domainame.com;

## Source: https://github.com/1activegeek/nginx-config-collection
## READ THE COMMENT ON add_header X-Frame-Options AND add_header Content-Security-Policy IF YOU USE THIS ON A SUBDOMAIN YOU WANT TO IFRAME!

## Certificates from LE container placement
ssl_certificate /config/keys/letsencrypt/fullchain.pem;
ssl_certificate_key /config/keys/letsencrypt/privkey.pem;

## Strong Security recommended settings per cipherli.st
ssl_dhparam /config/nginx/dhparams.pem; # Bit value: 4096
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
ssl_session_timeout  10m;

## NOTE: The add_header Content-Security-Policy won't work with duckdns since you don't own the root domain. Just buy a domain. It's cheap
## Settings to add strong security profile (A+ on securityheaders.io/ssllabs.com)

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none; #SET THIS TO index IF YOU WANT GOOGLE TO INDEX YOU SITE!
add_header Content-Security-Policy "frame-ancestors https://*.$server_name https://$server_name"; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe!
add_header X-Frame-Options "ALLOW-FROM https://*.$server_name" always; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe!
add_header Referrer-Policy "strict-origin-when-cross-origin";

add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;";
#FEATURE POLICY: READ MORE HERE: https://scotthelme.co.uk/a-new-security-header-feature-policy/

proxy_cookie_path / "/; HTTPOnly; Secure"; ##NOTE: This may cause issues with unifi. Remove HTTPOnly; or create another ssl config for unifi.
more_set_headers "Server: Classified";
more_clear_headers 'X-Powered-By';
 
 client_max_body_size 0; 
 
 root /config/www/wordpress/;
 index index.html index.php;
  
location ~ /\. {
deny all;

location / {
try_files $uri $uri/ /index.php?_url=$uri&$query_string; 
}

 
# PHP
 location ~ \.php$ {
 fastcgi_split_path_info ^(.+\.php)(/.+)$;
 # With php7-cgi alone:
 fastcgi_pass 127.0.0.1:9000;
 # With php7-fpm:
 #fastcgi_pass unix:/var/run/php7-fpm.sock;
 fastcgi_index index.php;
 include /etc/nginx/fastcgi_params;
 }
 
 fastcgi_buffer_size 4K;
 fastcgi_buffers 64 4k; 
}

Link to post
56 minutes ago, Tucubanito07 said:

This is the config i am using under letsencrypt/nginx/proxy-confs/

 

# REDIRECT WWW TO https://[domain.com]
server {
 listen 80;
 listen 443 ssl http2;
 server_name www.domainame.com; 
 return 301 https://domainame.com$request_uri;
}

# REDIRECT HTTP TRAFFIC TO https://[domain.com]
server {
    listen 80;
    server_name domainame.com; 
    return 301 https://domainame.com$request_uri;
}

# BLOG SITE
server {
 listen 443 ssl http2;
 server_name domainame.com;

## Source: https://github.com/1activegeek/nginx-config-collection
## READ THE COMMENT ON add_header X-Frame-Options AND add_header Content-Security-Policy IF YOU USE THIS ON A SUBDOMAIN YOU WANT TO IFRAME!

## Certificates from LE container placement
ssl_certificate /config/keys/letsencrypt/fullchain.pem;
ssl_certificate_key /config/keys/letsencrypt/privkey.pem;

## Strong Security recommended settings per cipherli.st
ssl_dhparam /config/nginx/dhparams.pem; # Bit value: 4096
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
ssl_session_timeout  10m;

## NOTE: The add_header Content-Security-Policy won't work with duckdns since you don't own the root domain. Just buy a domain. It's cheap
## Settings to add strong security profile (A+ on securityheaders.io/ssllabs.com)

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none; #SET THIS TO index IF YOU WANT GOOGLE TO INDEX YOU SITE!
add_header Content-Security-Policy "frame-ancestors https://*.$server_name https://$server_name"; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe!
add_header X-Frame-Options "ALLOW-FROM https://*.$server_name" always; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe!
add_header Referrer-Policy "strict-origin-when-cross-origin";

add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;";
#FEATURE POLICY: READ MORE HERE: https://scotthelme.co.uk/a-new-security-header-feature-policy/

proxy_cookie_path / "/; HTTPOnly; Secure"; ##NOTE: This may cause issues with unifi. Remove HTTPOnly; or create another ssl config for unifi.
more_set_headers "Server: Classified";
more_clear_headers 'X-Powered-By';
 
 client_max_body_size 0; 
 
 root /config/www/wordpress/;
 index index.html index.php;
  
location ~ /\. {
deny all;

location / {
try_files $uri $uri/ /index.php?_url=$uri&$query_string; 
}

 
# PHP
 location ~ \.php$ {
 fastcgi_split_path_info ^(.+\.php)(/.+)$;
 # With php7-cgi alone:
 fastcgi_pass 127.0.0.1:9000;
 # With php7-fpm:
 #fastcgi_pass unix:/var/run/php7-fpm.sock;
 fastcgi_index index.php;
 include /etc/nginx/fastcgi_params;
 }
 
 fastcgi_buffer_size 4K;
 fastcgi_buffers 64 4k; 
}

Learn how to put the config in a code tag!

Don't we already have a wordpress proxy-conf?

Link to post
3 minutes ago, saarg said:

Learn how to put the config in a code tag!

Don't we already have a wordpress proxy-conf?

I don't see in under proxy-conf. That is where i looked first before asking and i don't see anything. What do you mean by putting a config in a code tag?

Link to post
3 minutes ago, Tucubanito07 said:

I don't see in under proxy-conf. That is where i looked first before asking and i don't see anything. What do you mean by putting a config in a code tag?

Look a couple of posts up. I already asked you to do it there.

 

I thought we had one, but no we don't have a proxy-conf for it.

Link to post
4 minutes ago, saarg said:

Look a couple of posts up. I already asked you to do it there.

 

I thought we had one, but no we don't have a proxy-conf for it.

Yea you guys don't have one. Now, when you say look a couple of posts up i dont see where you said to try anything.

Link to post
5 minutes ago, saarg said:

 

Screenshot_20200517-211010.png

I have already resolve the problem with not getting the certificate. I only need to point the NGINX to the wordpress domain so people can see the site. I know on nextcloud they have a config file we have to change to connect to reverse proxy. However, i dont see a config file in wordpress. 

Link to post
This is the config i am using under letsencrypt/nginx/proxy-confs/

 

# REDIRECT WWW TO https://[domain.com]
server {
 listen 80;
 listen 443 ssl http2;
 server_name www.domainame.com; 
 return 301 https://domainame.com$request_uri;
}

# REDIRECT HTTP TRAFFIC TO https://[domain.com]
server {
    listen 80;
    server_name domainame.com; 
    return 301 https://domainame.com$request_uri;
}

# BLOG SITE
server {
 listen 443 ssl http2;
 server_name domainame.com;

## Source: https://github.com/1activegeek/nginx-config-collection
## READ THE COMMENT ON add_header X-Frame-Options AND add_header Content-Security-Policy IF YOU USE THIS ON A SUBDOMAIN YOU WANT TO IFRAME!

## Certificates from LE container placement
ssl_certificate /config/keys/letsencrypt/fullchain.pem;
ssl_certificate_key /config/keys/letsencrypt/privkey.pem;

## Strong Security recommended settings per cipherli.st
ssl_dhparam /config/nginx/dhparams.pem; # Bit value: 4096
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
ssl_session_timeout  10m;

## NOTE: The add_header Content-Security-Policy won't work with duckdns since you don't own the root domain. Just buy a domain. It's cheap
## Settings to add strong security profile (A+ on securityheaders.io/ssllabs.com)

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none; #SET THIS TO index IF YOU WANT GOOGLE TO INDEX YOU SITE!
add_header Content-Security-Policy "frame-ancestors https://*.$server_name https://$server_name"; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe!
add_header X-Frame-Options "ALLOW-FROM https://*.$server_name" always; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe!
add_header Referrer-Policy "strict-origin-when-cross-origin";

add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;";
#FEATURE POLICY: READ MORE HERE: https://scotthelme.co.uk/a-new-security-header-feature-policy/

proxy_cookie_path / "/; HTTPOnly; Secure"; ##NOTE: This may cause issues with unifi. Remove HTTPOnly; or create another ssl config for unifi.
more_set_headers "Server: Classified";
more_clear_headers 'X-Powered-By';
 
 client_max_body_size 0; 
 
 root /config/www/wordpress/;
 index index.html index.php;
  
location ~ /\. {
deny all;
} 
location / {
try_files $uri $uri/ /index.php?_url=$uri&$query_string; 
}

 
# PHP
 location ~ \.php$ {
 fastcgi_split_path_info ^(.+\.php)(/.+)$;
 # With php7-cgi alone:
 fastcgi_pass 127.0.0.1:9000;
 # With php7-fpm:
 #fastcgi_pass unix:/var/run/php7-fpm.sock;
 fastcgi_index index.php;
 include /etc/nginx/fastcgi_params;
 }
 
 fastcgi_buffer_size 4K;
 fastcgi_buffers 64 4k; 
}

When you say tag do you mean like this? @saarg

Link to post
29 minutes ago, Tucubanito07 said:

This is the config i am using under letsencrypt/nginx/proxy-confs/

 

# REDIRECT WWW TO https://[domain.com]
server {
 listen 80;
 listen 443 ssl http2;
 server_name www.domainame.com; 
 return 301 https://domainame.com$request_uri;
}

# REDIRECT HTTP TRAFFIC TO https://[domain.com]
server {
    listen 80;
    server_name domainame.com; 
    return 301 https://domainame.com$request_uri;
}

# BLOG SITE
server {
 listen 443 ssl http2;
 server_name domainame.com;

## Source: https://github.com/1activegeek/nginx-config-collection
## READ THE COMMENT ON add_header X-Frame-Options AND add_header Content-Security-Policy IF YOU USE THIS ON A SUBDOMAIN YOU WANT TO IFRAME!

## Certificates from LE container placement
ssl_certificate /config/keys/letsencrypt/fullchain.pem;
ssl_certificate_key /config/keys/letsencrypt/privkey.pem;

## Strong Security recommended settings per cipherli.st
ssl_dhparam /config/nginx/dhparams.pem; # Bit value: 4096
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
ssl_session_timeout  10m;

## NOTE: The add_header Content-Security-Policy won't work with duckdns since you don't own the root domain. Just buy a domain. It's cheap
## Settings to add strong security profile (A+ on securityheaders.io/ssllabs.com)

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none; #SET THIS TO index IF YOU WANT GOOGLE TO INDEX YOU SITE!
add_header Content-Security-Policy "frame-ancestors https://*.$server_name https://$server_name"; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe!
add_header X-Frame-Options "ALLOW-FROM https://*.$server_name" always; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe!
add_header Referrer-Policy "strict-origin-when-cross-origin";

add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;";
#FEATURE POLICY: READ MORE HERE: https://scotthelme.co.uk/a-new-security-header-feature-policy/

proxy_cookie_path / "/; HTTPOnly; Secure"; ##NOTE: This may cause issues with unifi. Remove HTTPOnly; or create another ssl config for unifi.
more_set_headers "Server: Classified";
more_clear_headers 'X-Powered-By';
 
 client_max_body_size 0; 
 
 root /config/www/wordpress/;
 index index.html index.php;
  
location ~ /\. {
deny all;
} 
location / {
try_files $uri $uri/ /index.php?_url=$uri&$query_string; 
}

 
# PHP
 location ~ \.php$ {
 fastcgi_split_path_info ^(.+\.php)(/.+)$;
 # With php7-cgi alone:
 fastcgi_pass 127.0.0.1:9000;
 # With php7-fpm:
 #fastcgi_pass unix:/var/run/php7-fpm.sock;
 fastcgi_index index.php;
 include /etc/nginx/fastcgi_params;
 }
 
 fastcgi_buffer_size 4K;
 fastcgi_buffers 64 4k; 
}

When you say tag do you mean like this? @saarg

Finally 😁

Link to post

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.