Enable Strict Transport Security on hydra.nixos.org and nixos.org
HSTS tells the browser that you should always use HTTPS when talking to the domain, for the next max-age. This means it will (in-browser) redirect from http to https, without hitting a the webserver. - max-age is set to 1 day in case of problems, in the future I'd like to extend this. - we can't enable includeSubdomains because the following certificates don't use TLS: - www.nixos.org (redirects to nixos.org) - releases.nixos.org (deprecated? traffic? - planet.nixos.org If we can fix these, we can add includeSubdomains too. Obviously I haven't tested this, as I don't have a local copy of nixos.org running :)
Graham Christensen committed
Jul 24, 2017 at 20:16 UTC
1281ff9c27655d56c430714bd1df640e883a8c30
2 files changed
+12
-1
delft/hydra-proxy.nix
+7
-1
@@ -49,7 +49,12 @@ in
49
adminAddr = "edolstra@gmail.com";
50
hostName = "hydra.nixos.org";
51
logFormat = ''"%h %l %u %t \"%r\" %>s %b %D"'';
52
- extraConfig = hydraProxyConfig;
52
+ extraConfig = hydraProxyConfig +
53
+ ''
54
+ RewriteEngine On
55
+ RewriteCond %{HTTPS} off
56
+ RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
57
+ '';
58
59
servedDirs =
60
[ { urlPath = "/apache-errors";
@@ -69,6 +74,7 @@ in
74
# Required by Catalyst.
75
RequestHeader set X-Forwarded-Proto https
76
RequestHeader set X-Forwarded-Port 443
77
+ Header always set Strict-Transport-Security "max-age=86400"
78
'';
79
}
80
];
nixos-org/webserver.nix
+5
@@ -49,6 +49,10 @@ let
49
RewriteEngine on
50
RewriteRule "^(.*/)?\.git/" - [F,L]
51
52
+ # Rewrite HTTP to HTTPS
53
+ RewriteCond %{HTTPS} off
54
+ RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
55
+
56
RedirectMatch "^/wiki.*" "https://nixos.org/nixos/wiki.html"
57
58
<Location /server-status>
@@ -129,6 +133,7 @@ in
133
sslServerCert = "${acmeKeyDir}/fullchain.pem";
134
extraConfig = nixosVHostConfig.extraConfig +
135
''
136
+ Header always set Strict-Transport-Security "max-age=86400"
137
SSLProtocol All -SSLv2 -SSLv3
138
SSLCipherSuite HIGH:!aNULL:!MD5:!EXP
139
SSLHonorCipherOrder on