bitlair/ansible
6
0
Fork 1
Code Issues Pull requests Releases Activity

Add HSTS headers to all web services

Browse source
This commit is contained in:
polyfloyd 2024-06-11 20:00:40 +02:00
parent 5ae55c6c5b
commit 8a8216d78e
6 changed files with 11 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
hosts.yaml
View file

@ -31,7 +31,7 @@ all:
mqtt.bitlair.nl: mqtt.bitlair.nl:
monitoring: monitoring:
hosts: hosts:
monitoring.bitlair.nl: dashboard.bitlair.nl:
music: music:
hosts: hosts:
music.bitlair.nl: music.bitlair.nl:

4
roles/etherpad/templates/nginx-site.conf
View file

@ -12,6 +12,10 @@ server {
ssl_certificate_key "/var/lib/dehydrated/certs/{{ etherpad_domain }}/privkey.pem"; ssl_certificate_key "/var/lib/dehydrated/certs/{{ etherpad_domain }}/privkey.pem";
{% endif %} {% endif %}
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
location / { location / {
proxy_pass http://127.0.0.1:9001/; proxy_pass http://127.0.0.1:9001/;
include proxy_params; include proxy_params;

3
roles/git-server/templates/nginx-site.conf
View file

@ -13,6 +13,9 @@ server {
ssl_certificate_key "/var/lib/dehydrated/certs/{{ git_server_domain }}/privkey.pem"; ssl_certificate_key "/var/lib/dehydrated/certs/{{ git_server_domain }}/privkey.pem";
{% endif %} {% endif %}
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header X-Robots-Tag noindex; add_header X-Robots-Tag noindex;
location / { location / {

5
roles/monitoring/templates/grafana.ini
View file

@ -58,11 +58,6 @@ versions_to_keep = 20
enabled = true enabled = true
path = /var/lib/grafana/dashboards path = /var/lib/grafana/dashboards
# Alerting
[alerting]
enabled = true
execute_alerts = True
# SMTP and email config # SMTP and email config
# Logging # Logging

3
roles/monitoring/templates/nginx-site.conf
View file

@ -10,6 +10,9 @@ server {
ssl_certificate_key "/var/lib/dehydrated/certs/{{ monitoring_domain }}/privkey.pem"; ssl_certificate_key "/var/lib/dehydrated/certs/{{ monitoring_domain }}/privkey.pem";
{% endif %} {% endif %}
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header X-Robots-Tag noindex; add_header X-Robots-Tag noindex;
location / { location / {

1
roles/www/templates/nginx-site.conf
View file

@ -16,7 +16,6 @@ server {
ssl_certificate_key "/var/lib/dehydrated/certs/{{ www_domain }}/privkey.pem"; ssl_certificate_key "/var/lib/dehydrated/certs/{{ www_domain }}/privkey.pem";
{% endif %} {% endif %}
# SSL settings from https://cipherli.st/ - AK47 15 jan 2017
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
add_header X-Frame-Options DENY; add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff; add_header X-Content-Type-Options nosniff;