Nginx quick reference

Just skimmed through it, and most of this seems to revolve around hardening, not performance, and most of the hardening seems questionable at best. Some of the headers that is suggested have some implications that aren't really explained at all. Like HSTS including sub-domains.

And you don't set the `default_server` as this document suggest. `default_server` is a parameter to the `listen`-directive. The only reason the docs might work is because the first server-block defined, when no-one is defined as `default_server`, becomes the default server.

  server {
    listen 80 default_server;
    return 444; 
  }

This will close the connection and log it internally, for any domain that isn't defined in Nginx.

Edit: Shout-out to #nginx on FreeNode, where you'll always find someone to point you i the right directing or help you out.

Don't casually enable HSTS with the following:

add_header Strict-Transport-Security "max-age=63072000; includeSubdomains" always;

On a top domain site like https://example.com, if there are subdomain sites like http://golf.example.com which are not configured with TLS. The setting will be stored on the clients and they need to "forget" non-https sites after you have rolled back the misconfiguration. Of course you could go in the other direction and enable https for all subdomains. :)

"Disable compression (mitigation of CRIME attack)"

Is this really the best solution? This might get me an A+ at ssllabs but I also need an "A" from gtmetrics[1] and if I turn of gzip I will not get an A.

[1] https://gtmetrix.com/enable-gzip-compression.html

For SSL Configuration there's always https://mozilla.github.io/server-side-tls/ssl-config-generat...

Off topic, it makes me wonder if a well designed IDE, a step by step wizard could save a lot of time from reading docs.

Web server Configuration should be simple if you already have the correct mindset. It's the nuances of each specific directive or variables that makes config hard. Try remember all those access_log formats. Ehh!

Not a Nginx administrator, but the general documentation flow is very much agreeable: actionable summary guideline, concise rationale, relevant example, external resource(s).

Awesome doc. Beware though lot of tradeoffs towards security in prejudice of performance and usability.

'quick reference'

1100 lines (707 sloc) 36.4 KB

A printable lists of SSL ciphers... but why?? how could that be useful to anyone?!