From: nodiscc <nodiscc@gmail.com>
Date: Mon, 18 May 2020 19:08:51 +0000 (+0200)
Subject: doc: nginx: add let's encrypt ssl configuration
X-Git-Tag: v0.12.0-beta-1~16^2~34
X-Git-Url: https://git.immae.eu/?p=github%2Fshaarli%2FShaarli.git;a=commitdiff_plain;h=778add2c9cc858bcc1aa8180620bd46590b84e15;hp=538fb324a8a8d57b7b06e30dfe2310137918f844

doc: nginx: add let's encrypt ssl configuration
---

diff --git a/doc/md/Server-configuration.md b/doc/md/Server-configuration.md
index 2bb403e5..6e21de91 100644
--- a/doc/md/Server-configuration.md
+++ b/doc/md/Server-configuration.md
@@ -250,6 +250,14 @@ server {
     ssl_certificate      /etc/ssl/shaarli.mydomain.org.crt;
     ssl_certificate_key  /etc/ssl/private/shaarli.mydomain.org.key;
 
+    # Let's Encrypt SSL settings from https://github.com/certbot/certbot/blob/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf
+    ssl_session_cache shared:le_nginx_SSL:10m;
+    ssl_session_timeout 1440m;
+    ssl_session_tickets off;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers off;
+    ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
+
     # increase the maximum file upload size if needed: by default nginx limits file upload to 1MB (413 Entity Too Large error)
     client_max_body_size 100m;