Skip to content

Remove dhparams.pem and update nginx configuration for improved security and compliance with Mozilla guidelines #197

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nemchik wants to merge 2 commits into
base: 3.23
Choose a base branch
from
+23 −42
Open

Remove dhparams.pem and update nginx configuration for improved security and compliance with Mozilla guidelines #197

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a58e188
Remove dhparams.pem and update nginx configuration for improved secur…
nemchik May 4, 2026
a6cd315
Adjust Access-Control-Allow-Origin header
nemchik May 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 0 additions & 13 deletions root/defaults/nginx/dhparams.pem
View file
Open in desktop

This file was deleted.

2 changes: 1 addition & 1 deletion root/defaults/nginx/nginx.conf.sample
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ http {

# Name servers used to resolve names of upstream servers into addresses.
# It's also needed when using tcpsocket and udpsocket in Lua modules.
#resolver 1.1.1.1 1.0.0.1 2606:4700:4700::1111 2606:4700:4700::1001;
#resolver 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001];
Comment thread
nemchik marked this conversation as resolved.
include /config/nginx/resolver.conf;

# Don't tell nginx version to the clients. Default is 'on'.
Expand Down
42 changes: 22 additions & 20 deletions root/defaults/nginx/ssl.conf.sample
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,34 +1,36 @@
## Version 2025/12/26 - Changelog: https://github.com/linuxserver/docker-baseimage-alpine-nginx/commits/3.23/root/defaults/nginx/ssl.conf.sample

### Mozilla Recommendations
# generated 2025-12-26, Mozilla Guideline v5.7, nginx 1.28.0, OpenSSL 3.5.4, intermediate config, no OCSP
# https://ssl-config.mozilla.org/#server=nginx&version=1.28&config=intermediate&openssl=3.5.4&ocsp=false&guideline=5.7
## Version 2026/05/04 - Changelog: https://github.com/linuxserver/docker-baseimage-alpine-nginx/commits/3.23/root/defaults/nginx/ssl.conf.sample

ssl_certificate /config/keys/cert.crt;
ssl_certificate_key /config/keys/cert.key;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
ssl_session_tickets off;

# curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
ssl_dhparam /config/nginx/dhparams.pem;
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
#add_header Strict-Transport-Security "max-age=63072000" always;

### Mozilla SSL Configuration Generator
# generated 2026-05-04, Mozilla Guideline v6.0, nginx 1.28.3, OpenSSL 3.5.6, intermediate config, HSTS
# https://ssl-config.mozilla.org/#server=nginx&version=1.28.3&config=intermediate&openssl=3.5.6&hsts&guideline=6.0
# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ecdh_curve X25519:prime256v1:secp384r1;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1:secp384r1;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;

# HSTS (ngx_http_headers_module is required) (63072000 seconds)
#add_header Strict-Transport-Security "max-age=63072000" always;
# see also ssl_session_ticket_key alternative to stateful session cache
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m; # about 40000 sessions

# Optional additional headers
#add_header Cache-Control "no-transform" always;
#add_header Content-Security-Policy "upgrade-insecure-requests; frame-ancestors 'self'" always;
#add_header Permissions-Policy "interest-cohort=()" always;
### Mozilla Practical security implementation
# https://developer.mozilla.org/en-US/docs/Web/Security
#add_header Access-Control-Allow-Origin $http_origin always;
#add_header Content-Security-Policy "upgrade-insecure-requests; base-uri 'self'; form-action 'self'; frame-ancestors 'self';" always;
#add_header Cross-Origin-Resource-Policy "same-origin" always;
#add_header Referrer-Policy "same-origin" always;
#add_header X-Content-Type-Options "nosniff" always;
#add_header X-Frame-Options "SAMEORIGIN" always;
#add_header X-UA-Compatible "IE=Edge" always;
#add_header X-XSS-Protection "1; mode=block" always;

### Optional additional headers
#add_header Alt-Svc 'h3=":443"' always;
#add_header Cache-Control "no-transform" always;
#add_header Permissions-Policy "interest-cohort=()" always;
#add_header X-UA-Compatible "IE=Edge" always;
#add_header X-XSS-Protection "1; mode=block" always;
8 changes: 0 additions & 8 deletions root/etc/s6-overlay/s6-rc.d/init-nginx/run
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,14 +34,6 @@ if [[ ${INDEX_EXISTS} == false ]] && grep -Eq '^\s*index[^#]*index\.html' /confi
cp /defaults/www/index.html /config/www/index.html
fi

# copy pre-generated dhparams or generate if needed
if [[ ! -f /config/nginx/dhparams.pem ]]; then
cp /defaults/nginx/dhparams.pem /config/nginx/dhparams.pem
fi
if ! grep -q 'PARAMETERS' "/config/nginx/dhparams.pem"; then
curl -o /config/nginx/dhparams.pem -L "https://ssl-config.mozilla.org/ffdhe4096.txt"
fi

# Set resolver, ignore ipv6 addresses
touch /config/nginx/resolver.conf
if ! grep -q 'resolver' /config/nginx/resolver.conf; then
Expand Down