update with http3

diff --git a/etc/nginx/conf.d/default.dev.conf b/etc/nginx/conf.d/default.dev.conf
index b866859d1d0401b49bd3f7eb22b618b59e1bfb9f..16219350b41cd99b147b0753f736f304d18ef8a5 100644 (file)
--- a/etc/nginx/conf.d/default.dev.conf
+++ b/etc/nginx/conf.d/default.dev.conf
@@ -11,6 +11,7 @@ server {
   add_header Alt-Svc 'h3=":443"; ma=86400' always;
   # HSTS
   add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+  ssl_trusted_certificate /etc/ssl/private/ca-certs.pem;
 
   # Sanic
   location / {
@@ -45,6 +46,8 @@ server {
   http2 on;
   http3 on;
   add_header Alt-Svc 'h3=":443"; ma=86400' always;
+  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+  ssl_trusted_certificate /etc/ssl/private/ca-certs.pem;
   location / {
     proxy_pass http://localhost:8000;
   }
@@ -61,6 +64,8 @@ server {
   http2 on;
   http3 on;
   add_header Alt-Svc 'h3=":443"; ma=86400' always;
+  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+  ssl_trusted_certificate /etc/ssl/private/ca-certs.pem;
   location / {
     proxy_pass http://localhost:9000;
   }
@@ -157,6 +162,11 @@ server {
   include /etc/letsencrypt/options-ssl-nginx.conf;
   ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
 
+  # HTTP3 and Security Headers
+  add_header Alt-Svc 'h3=":443"; ma=86400' always;
+  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+  ssl_trusted_certificate /etc/ssl/private/ca-certs.pem;
+
   return 301 https://dev.nutra.tk$request_uri;
 }
 
@@ -169,6 +179,8 @@ server {
   http2 on;
   http3 on;
   add_header Alt-Svc 'h3=":443"; ma=86400' always;
+  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+  ssl_trusted_certificate /etc/ssl/private/ca-certs.pem;
   server_name matrix.nutra.tk chat.nutra.tk;
 
   location / {
@@ -187,6 +199,13 @@ server {
 server {
   listen 8448 ssl default_server;
   listen [::]:8448 ssl default_server;
+  listen 8448 quic default_server;
+  listen [::]:8448 quic default_server;
+  http2 on;
+  http3 on;
+  add_header Alt-Svc 'h3=":8448"; ma=86400' always;
+  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+  ssl_trusted_certificate /etc/ssl/private/ca-certs.pem;
   server_name dev.nutra.tk;
 
   location / {

diff --git a/etc/nginx/conf.d/default.prod.conf b/etc/nginx/conf.d/default.prod.conf
index cf6bb9b58ce443ddf7cc14647c948863352716ff..ed482742c5241be4d11072d74282370937506544 100644 (file)
--- a/etc/nginx/conf.d/default.prod.conf
+++ b/etc/nginx/conf.d/default.prod.conf
@@ -19,6 +19,7 @@ server {
   add_header Alt-Svc 'h3=":443"; ma=86400' always;
   # HSTS
   add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+  ssl_trusted_certificate /etc/ssl/private/ca-certs.pem;
 
   # Sanic
   location / {
@@ -53,6 +54,8 @@ server {
   http2 on;
   http3 on;
   add_header Alt-Svc 'h3=":443"; ma=86400' always;
+  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+  ssl_trusted_certificate /etc/ssl/private/ca-certs.pem;
   location / {
     proxy_pass http://localhost:8000;
   }
@@ -69,6 +72,8 @@ server {
   http2 on;
   http3 on;
   add_header Alt-Svc 'h3=":443"; ma=86400' always;
+  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+  ssl_trusted_certificate /etc/ssl/private/ca-certs.pem;
   location / {
     proxy_pass http://localhost:9000;
   }
@@ -160,6 +165,12 @@ server {
   include /etc/letsencrypt/options-ssl-nginx.conf;
   ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
 
+  http2 on;
+  http3 on;
+  add_header Alt-Svc 'h3=":443"; ma=86400' always;
+  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+  ssl_trusted_certificate /etc/ssl/private/ca-certs.pem;
+
   return 301 https://nutra.tk$request_uri;
 }
 
@@ -172,6 +183,8 @@ server {
   http2 on;
   http3 on;
   add_header Alt-Svc 'h3=":443"; ma=86400' always;
+  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+  ssl_trusted_certificate /etc/ssl/private/ca-certs.pem;
   server_name matrix.nutra.tk chat.nutra.tk;
 
   location / {
@@ -190,6 +203,13 @@ server {
 server {
   listen 8448 ssl default_server;
   listen [::]:8448 ssl default_server;
+  listen 8448 quic default_server;
+  listen [::]:8448 quic default_server;
+  http2 on;
+  http3 on;
+  add_header Alt-Svc 'h3=":8448"; ma=86400' always;
+  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+  ssl_trusted_certificate /etc/ssl/private/ca-certs.pem;
   server_name nutra.tk;
 
   location / {